Description

Ensure that every AWS Backup vault is configured with an AWS KMS encryption key (AWS-managed or customer-managed), so that all recovery points stored in the vault are encrypted at rest.

Rationale

A backup vault's encryption key determines the protection applied to every recovery point it stores; verifying vault-level encryption configuration is the most direct way to confirm that backups of potentially sensitive resources are protected at rest, and using a customer-managed key additionally provides the organization with control over key rotation, access policy, and auditability.

Impact

  • Confirms that all recovery points within the vault are encrypted at rest

  • Enables stronger control over the encryption key when a customer-managed key is used

  • Vault encryption key cannot be changed after vault creation, so this must be planned in advance

Default Value

New backup vaults created via the console default to the AWS-managed key (aws/backup) unless a customer-managed key is explicitly selected at creation.

Pre-Requisites

  • A Cloud KMS/AWS KMS customer-managed key, if customer-managed encryption is required

  • IAM permissions to view and create backup vaults (backup:DescribeBackupVault, backup:CreateBackupVault)

Test Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to AWS Backup > Backup vaults.

  3. For each vault, review the Encryption key column or the vault's details page.

  4. Verify that each vault storing sensitive resource backups has an appropriate KMS key (AWS-managed at minimum, customer-managed if required by policy) configured.

  5. If a vault does not meet the required encryption standard, follow the implementation steps.

Implementation Steps

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to AWS Backup > Backup vaults and select Create Backup vault.

  3. Provide a vault name and select the required KMS key.

  4. Select Create Backup vault.

  5. Update backup plans to target the newly created vault, and migrate/copy existing recovery points as needed using AWS Backup's copy job feature.

  6. Decommission the old vault once all required recovery points have been migrated and its retention requirements have been satisfied.

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to AWS Backup > Backup plans and redirect the plan back to the original vault.

Reference