---
title: AWS RDS Cluster deleted
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: Docs > Datadog Security > OOTB Rules > AWS RDS Cluster deleted
---

# AWS RDS Cluster deleted
Classification:attackTactic:[TA0040-impact](https://attack.mitre.org/tactics/TA0040)Technique:[T1485-data-destruction](https://attack.mitre.org/techniques/T1485) 
## Goal{% #goal %}

Detect when a user deleted a database cluster in RDS.

## Strategy{% #strategy %}

This rule lets you monitor this CloudTrail API call to detect if an attacker is deleting a RDS cluster:

- [DeleteDBCluster](https://docs.aws.amazon.com/cli/latest/reference/rds/delete-db-cluster.html)

## Triage and response{% #triage-and-response %}

1. Determine if the API call: {{@evt.name}} should have occurred.
1. If it shouldn't have been made:
   - Contact the user: {{@userIdentity.arn}} and see if they made the API call.
1. If the API call was not made by the user:
   - Rotate the user credentials.
   - Determine what other API calls were made with the old credentials that were not made by the user.

## Changelog{% #changelog %}

6 April 2022 - Updated rule and signal message.