# Ensure AWS Backup Vault is Encrypted at Rest

- Source: https://support.icompaas.com/support/solutions/articles/a_1788890024752993-ensure-aws-backup-vault-is-encrypted-at-rest
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS Cloud](https://support.icompaas.com/support/solutions/c_1788889426924716) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1788889470630116)
- Last updated: 2026-09-08
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that every AWS Backup vault is configured with an AWS KMS encryption key (AWS-managed or customer-managed), so that all recovery points stored in the vault are encrypted at rest.

**Rationale**

A backup vault's encryption key determines the protection applied to every recovery point it stores; verifying vault-level encryption configuration is the most direct way to confirm that backups of potentially sensitive resources are protected at rest, and using a customer-managed key additionally provides the organization with control over key rotation, access policy, and auditability.

**Impact**

-   Confirms that all recovery points within the vault are encrypted at rest
    
-   Enables stronger control over the encryption key when a customer-managed key is used
    
-   Vault encryption key cannot be changed after vault creation, so this must be planned in advance
    

**Default Value**

New backup vaults created via the console default to the AWS-managed key (aws/backup) unless a customer-managed key is explicitly selected at creation.

**Pre-Requisites**

-   A Cloud KMS/AWS KMS customer-managed key, if customer-managed encryption is required
    
-   IAM permissions to view and create backup vaults (backup:DescribeBackupVault, backup:CreateBackupVault)
    

**Test Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to AWS Backup > Backup vaults.
    
3.  For each vault, review the Encryption key column or the vault's details page.
    
4.  Verify that each vault storing sensitive resource backups has an appropriate KMS key (AWS-managed at minimum, customer-managed if required by policy) configured.
    
5.  If a vault does not meet the required encryption standard, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to AWS Backup > Backup vaults and select Create Backup vault.
    
3.  Provide a vault name and select the required KMS key.
    
4.  Select Create Backup vault.
    
5.  Update backup plans to target the newly created vault, and migrate/copy existing recovery points as needed using AWS Backup's copy job feature.
    
6.  Decommission the old vault once all required recovery points have been migrated and its retention requirements have been satisfied.
    

**Backout Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to AWS Backup > Backup plans and redirect the plan back to the original vault.
    

**Reference**

-   [https://docs.aws.amazon.com/aws-backup/latest/devguide/encryption.html](https://docs.aws.amazon.com/aws-backup/latest/devguide/encryption.html)
    
-   [https://docs.aws.amazon.com/aws-backup/latest/devguide/creating-a-vault.html](https://docs.aws.amazon.com/aws-backup/latest/devguide/creating-a-vault.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.