Description

Ensure that the AWS account has at least one AWS Backup plan configured, defining a backup schedule, lifecycle, and vault destination for one or more resource types, so that critical resources are protected by a centrally managed, automated backup process.

Rationale

Without an AWS Backup plan, organizations typically rely on ad hoc, resource-specific backup mechanisms (or none at all), which are inconsistent, difficult to audit centrally, and prone to gaps in coverage. AWS Backup provides a centralized, policy-driven way to schedule, retain, and monitor backups across supported resource types, helping ensure critical data can be recovered after accidental deletion, corruption, or a broader incident.

Impact

  • Establishes a centralized, auditable backup process for supported AWS resources

  • Improves the organization's ability to recover from accidental deletion, corruption, or ransomware-style incidents

  • Introduces additional storage cost for backup retention that should be sized to an appropriate retention policy

Default Value

No AWS Backup plans exist by default; backup plans, vaults, and resource assignments must be explicitly created.

Pre-Requisites

  • IAM permissions to create AWS Backup plans, vaults, and resource assignments (backup:CreateBackupPlan, backup:CreateBackupVault, backup:CreateBackupSelection)

  • A documented backup schedule and retention requirement for the organization's critical resources

Test Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to AWS Backup > Backup plans.

  3. Verify that at least one backup plan exists.

  4. Open the plan and verify it includes a backup rule with an appropriate schedule, lifecycle (transition to cold storage / expiration), and destination vault.

  5. Navigate to Resource assignments within the plan and verify that the intended resources or resource tags are assigned to the plan.

  6. If no backup plan exists, or no resources are assigned, follow the implementation steps.

Implementation Steps

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to AWS Backup > Backup plans and select Create Backup plan.

  3. Choose Build a new plan, provide a plan name, and define one or more backup rules, including the backup vault, frequency, backup window, and lifecycle/retention settings.

  4. Select Create plan.

  5. Under Resource assignments, select Assign resources, and define the assignment either by specific resource IDs or by resource tags.

  6. Save the resource assignment and verify the first scheduled backup job runs successfully under AWS Backup > Jobs.

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to AWS Backup > Backup plans and select the plan to remove.

  3. Delete the resource assignments associated with the plan.

  4. Delete the backup plan.

Reference