Description

Ensure that every Amazon EBS volume is protected by an AWS Backup plan. A volume is protected when a resource assignment (backup selection) of a backup plan lists the volume's ARN, all EBS volumes (arn:aws:ec2:*:*:volume/*) or all resources (*), so that the volume is backed up on the plan's schedule and kept according to its retention rules. Only the resource list of each assignment is considered; volumes that are covered only through tag-based resource assignments (tags or conditions) are reported as unprotected.

Rationale

Without backup coverage, an EBS volume that is deleted or corrupted, accidentally or maliciously, may have no recovery path. This can cause permanent data loss, long outages, missed retention requirements and slower incident response. Including all critical volumes in standard AWS Backup plans that match your recovery point and recovery time objectives, with cross-Region or cross-account copies, Vault Lock, encryption and regular restore tests, ensures that data can be recovered.

Impact

  • Provides scheduled, policy-driven backups of EBS volumes

  • Allows recovery from deletion, corruption or ransomware

  • Backups (EBS snapshots) incur storage charges based on the amount of data kept

Default Value

EBS volumes are not protected by any AWS Backup plan by default.

Pre-Requisites

  • IAM permissions: ec2:DescribeVolumes, backup:ListBackupPlans, backup:ListBackupSelections, backup:GetBackupSelection, backup:CreateBackupSelection, backup:DeleteBackupSelection and iam:PassRole

  • A backup plan in each region in use, with a schedule and retention that match your recovery objectives

  • An IAM role that AWS Backup can use, such as AWSBackupDefaultServiceRole (created automatically the first time the default role is selected in the AWS Backup console)

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the AWS Backup console and select Backup plans.

  3. Select each backup plan and review its Resource assignments.

  4. Check that a resource assignment includes the volume, either by its volume ID, by all EBS volumes, or by all resource types.

  5. Repeat for each region in use.

  6. If a volume is not included in any resource assignment, follow the implementation steps.

CLI:

List the backup plans in a region:

aws backup list-backup-plans --region <REGION> --query "BackupPlansList[].[BackupPlanName,BackupPlanId]" --output table

List the resource assignments of a backup plan:

aws backup list-backup-selections --region <REGION> --backup-plan-id <BACKUP_PLAN_ID> --query "BackupSelectionsList[].[SelectionName,SelectionId]" --output table

Show the resources included in a resource assignment:

aws backup get-backup-selection --region <REGION> --backup-plan-id <BACKUP_PLAN_ID> --selection-id <SELECTION_ID> --query "BackupSelection.Resources"

List the EBS volumes in a region:

aws ec2 describe-volumes --region <REGION> --query "Volumes[].[VolumeId,State,Size]" --output table

A volume fails if no resource assignment lists its ARN, arn:aws:ec2:*:*:volume/* or * in Resources. Volumes selected only by tags or conditions are not counted as protected.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the AWS Backup console and select Backup plans.

  3. Select an existing backup plan, or choose Create backup plan and create one from a template.

  4. In the plan, choose Assign resources.

  5. Enter a resource assignment name and select the IAM role, for example Default role.

  6. Choose Include specific resource types and select EBS.

  7. Select all EBS volumes, or the specific volumes to protect.

  8. Choose Assign resources.

  9. Repeat for each region in use.

CLI:

Assign all EBS volumes to a backup plan:

aws backup create-backup-selection --region <REGION> --backup-plan-id <BACKUP_PLAN_ID> --backup-selection '{"SelectionName":"<SELECTION_NAME>","IamRoleArn":"arn:aws:iam::<ACCOUNT_ID>:role/service-role/AWSBackupDefaultServiceRole","Resources":["arn:aws:ec2:*:*:volume/*"]}'

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the AWS Backup console and select Backup plans.

  3. Select the backup plan and, under Resource assignments, select the assignment created during implementation.

  4. Choose Delete and confirm.

CLI:

aws backup delete-backup-selection --region <REGION> --backup-plan-id <BACKUP_PLAN_ID> --selection-id <SELECTION_ID>

Note: rolling back stops new backups of the volumes. Recovery points already created are kept until their retention period ends.

Reference