Description

Ensure that AWS Backup recovery points (the individual backups created by a backup job) are encrypted at rest, which is achieved by storing them in a backup vault that has encryption configured with an AWS KMS key.

Rationale

Backup data often contains a complete copy of an application's sensitive data, so unencrypted backups represent a significant confidentiality risk if the underlying storage is ever accessed by an unauthorized party. Since encryption for AWS Backup recovery points is inherited from the backup vault's encryption key, ensuring every vault used for sensitive resources has a KMS key configured ensures that resulting recovery points are encrypted at rest.

Impact

  • Ensures sensitive backup data is protected at rest with strong encryption

  • Supports compliance requirements mandating encryption of backup and archival data

  • Requires the KMS key used for the vault to remain available and correctly permissioned for backup and restore operations to succeed

Default Value

AWS Backup vaults are encrypted using an AWS-managed key (aws/backup) by default unless a customer-managed key is explicitly specified at vault creation; all recovery points inherit the encryption of their containing vault.

Pre-Requisites

  • A backup vault with an AWS KMS key (AWS-managed or customer-managed) configured

  • IAM permissions to view backup vaults and recovery points (backup:DescribeBackupVault, backup:ListRecoveryPointsByBackupVault)

Test Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to AWS Backup > Backup vaults.

  3. Select the vault to review.

  4. Review the Encryption key field to confirm a KMS key (AWS-managed or customer-managed) is associated with the vault.

  5. Select a recovery point within the vault and confirm its Encrypted status shows as Yes.

  6. If a vault or its recovery points show as not encrypted, follow the implementation steps.

Implementation Steps

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to AWS Backup > Backup vaults and select Create Backup vault (note that an existing vault's encryption key cannot be changed after creation).

  3. Provide a vault name and select an AWS KMS key (a customer-managed key is recommended for greater control).

  4. Select Create Backup vault.

  5. Update the relevant backup plan(s) to target this newly created, encrypted vault for future backup jobs.

  6. For existing recovery points in an unencrypted or differently encrypted vault, use AWS Backup's copy-to-vault capability to copy recovery points into the new encrypted vault, then update retention policy for the original vault as appropriate.

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to AWS Backup > Backup plans and update the plan's target vault back to the previous vault.

Reference