# Ensure at Least One AWS Backup Plan Exists

- Source: https://support.icompaas.com/support/solutions/articles/a_1788890023725533-ensure-at-least-one-aws-backup-plan-exists
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS Cloud](https://support.icompaas.com/support/solutions/c_1788889426924716) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1788889470630116)
- Last updated: 2026-09-08
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that the AWS account has at least one AWS Backup plan configured, defining a backup schedule, lifecycle, and vault destination for one or more resource types, so that critical resources are protected by a centrally managed, automated backup process.

**Rationale**

Without an AWS Backup plan, organizations typically rely on ad hoc, resource-specific backup mechanisms (or none at all), which are inconsistent, difficult to audit centrally, and prone to gaps in coverage. AWS Backup provides a centralized, policy-driven way to schedule, retain, and monitor backups across supported resource types, helping ensure critical data can be recovered after accidental deletion, corruption, or a broader incident.

**Impact**

-   Establishes a centralized, auditable backup process for supported AWS resources
    
-   Improves the organization's ability to recover from accidental deletion, corruption, or ransomware-style incidents
    
-   Introduces additional storage cost for backup retention that should be sized to an appropriate retention policy
    

**Default Value**

No AWS Backup plans exist by default; backup plans, vaults, and resource assignments must be explicitly created.

**Pre-Requisites**

-   IAM permissions to create AWS Backup plans, vaults, and resource assignments (backup:CreateBackupPlan, backup:CreateBackupVault, backup:CreateBackupSelection)
    
-   A documented backup schedule and retention requirement for the organization's critical resources
    

**Test Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to AWS Backup > Backup plans.
    
3.  Verify that at least one backup plan exists.
    
4.  Open the plan and verify it includes a backup rule with an appropriate schedule, lifecycle (transition to cold storage / expiration), and destination vault.
    
5.  Navigate to Resource assignments within the plan and verify that the intended resources or resource tags are assigned to the plan.
    
6.  If no backup plan exists, or no resources are assigned, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to AWS Backup > Backup plans and select Create Backup plan.
    
3.  Choose Build a new plan, provide a plan name, and define one or more backup rules, including the backup vault, frequency, backup window, and lifecycle/retention settings.
    
4.  Select Create plan.
    
5.  Under Resource assignments, select Assign resources, and define the assignment either by specific resource IDs or by resource tags.
    
6.  Save the resource assignment and verify the first scheduled backup job runs successfully under AWS Backup > Jobs.
    

**Backout Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to AWS Backup > Backup plans and select the plan to remove.
    
3.  Delete the resource assignments associated with the plan.
    
4.  Delete the backup plan.
    

**Reference**

-   [https://docs.aws.amazon.com/aws-backup/latest/devguide/creating-a-backup-plan.html](https://docs.aws.amazon.com/aws-backup/latest/devguide/creating-a-backup-plan.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.