# Ensure EBS volumes are in an AWS Backup selection - Source: https://support.icompaas.com/support/solutions/articles/a_1793292227677300-ensure-ebs-volumes-are-in-an-aws-backup-selection - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224) - Last updated: 2026-10-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **Description** Ensure that every Amazon EBS volume is protected by an AWS Backup plan. A volume is protected when a resource assignment (backup selection) of a backup plan lists the volume's ARN, all EBS volumes (arn:aws:ec2:\*:\*:volume/\*) or all resources (\*), so that the volume is backed up on the plan's schedule and kept according to its retention rules. Only the resource list of each assignment is considered; volumes that are covered only through tag-based resource assignments (tags or conditions) are reported as unprotected. **Rationale** Without backup coverage, an EBS volume that is deleted or corrupted, accidentally or maliciously, may have no recovery path. This can cause permanent data loss, long outages, missed retention requirements and slower incident response. Including all critical volumes in standard AWS Backup plans that match your recovery point and recovery time objectives, with cross-Region or cross-account copies, Vault Lock, encryption and regular restore tests, ensures that data can be recovered. **Impact** - Provides scheduled, policy-driven backups of EBS volumes - Allows recovery from deletion, corruption or ransomware - Backups (EBS snapshots) incur storage charges based on the amount of data kept **Default Value** EBS volumes are not protected by any AWS Backup plan by default. **Pre-Requisites** - IAM permissions: ec2:DescribeVolumes, backup:ListBackupPlans, backup:ListBackupSelections, backup:GetBackupSelection, backup:CreateBackupSelection, backup:DeleteBackupSelection and iam:PassRole - A backup plan in each region in use, with a schedule and retention that match your recovery objectives - An IAM role that AWS Backup can use, such as AWSBackupDefaultServiceRole (created automatically the first time the default role is selected in the AWS Backup console) **Remediation** **Test Plan** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the AWS Backup console and select **Backup plans**. 3. Select each backup plan and review its **Resource assignments**. 4. Check that a resource assignment includes the volume, either by its volume ID, by all EBS volumes, or by all resource types. 5. Repeat for each region in use. 6. If a volume is not included in any resource assignment, follow the implementation steps. **CLI:** List the backup plans in a region: aws backup list-backup-plans --region --query "BackupPlansList\[\].\[BackupPlanName,BackupPlanId\]" --output table List the resource assignments of a backup plan: aws backup list-backup-selections --region --backup-plan-id --query "BackupSelectionsList\[\].\[SelectionName,SelectionId\]" --output table Show the resources included in a resource assignment: aws backup get-backup-selection --region --backup-plan-id --selection-id --query "BackupSelection.Resources" List the EBS volumes in a region: aws ec2 describe-volumes --region --query "Volumes\[\].\[VolumeId,State,Size\]" --output table A volume fails if no resource assignment lists its ARN, arn:aws:ec2:\*:\*:volume/\* or \* in Resources. Volumes selected only by tags or conditions are not counted as protected. **Implementation Steps** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the AWS Backup console and select **Backup plans**. 3. Select an existing backup plan, or choose **Create backup plan** and create one from a template. 4. In the plan, choose **Assign resources**. 5. Enter a resource assignment name and select the IAM role, for example **Default role**. 6. Choose **Include specific resource types** and select **EBS**. 7. Select all EBS volumes, or the specific volumes to protect. 8. Choose **Assign resources**. 9. Repeat for each region in use. **CLI:** Assign all EBS volumes to a backup plan: aws backup create-backup-selection --region --backup-plan-id --backup-selection '{"SelectionName":"","IamRoleArn":"arn:aws:iam:::role/service-role/AWSBackupDefaultServiceRole","Resources":\["arn:aws:ec2:\*:\*:volume/\*"\]}' **Backout Plan** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the AWS Backup console and select **Backup plans**. 3. Select the backup plan and, under **Resource assignments**, select the assignment created during implementation. 4. Choose **Delete** and confirm. **CLI:** aws backup delete-backup-selection --region --backup-plan-id --selection-id Note: rolling back stops new backups of the volumes. Recovery points already created are kept until their retention period ends. **Reference** - [https://docs.aws.amazon.com/aws-backup/latest/devguide/assigning-resources.html](https://docs.aws.amazon.com/aws-backup/latest/devguide/assigning-resources.html) - [https://aws.amazon.com/blogs/storage/protecting-your-critical-amazon-ebs-volumes-using-aws-backup/](https://aws.amazon.com/blogs/storage/protecting-your-critical-amazon-ebs-volumes-using-aws-backup/) - [https://docs.aws.amazon.com/config/latest/developerguide/ebs-resources-protected-by-backup-plan.html](https://docs.aws.amazon.com/config/latest/developerguide/ebs-resources-protected-by-backup-plan.html) - [https://docs.aws.amazon.com/cli/latest/reference/backup/create-backup-selection.html](https://docs.aws.amazon.com/cli/latest/reference/backup/create-backup-selection.html) ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.