Description

Ensure that the AWS account has at least one AWS Backup plan. A backup plan defines when backups are taken, which backup vault stores them and how long the recovery points are kept, and is assigned to the resources it protects.

Rationale

Without a backup plan, resources have no scheduled recovery points. Data that is deleted, corrupted or encrypted by ransomware may be impossible to recover, and outages last longer because no recent restore point is available. Backup plans with defined schedules, retention and resource assignments make recovery predictable and help meet recovery point and recovery time objectives.

Impact

  • Provides scheduled, centrally managed backups of the assigned resources

  • Improves the ability to recover from accidental deletion, data corruption and ransomware

  • Backup storage and restore operations are charged, so retention periods should be chosen with cost in mind

  • A plan only protects the resources assigned to it, so resource assignments must be kept up to date

Default Value

No backup plans exist by default in an AWS account. They must be created in each region where resources need to be backed up.

Pre-Requisites

  • IAM permissions: backup:ListBackupPlans, backup:ListBackupVaults, backup:CreateBackupPlan, backup:CreateBackupSelection, backup:CreateBackupVault and iam:PassRole

  • An IAM role that AWS Backup can use to create backups (for example, the AWSBackupDefaultServiceRole that the console can create)

  • Agreement on the backup frequency, retention period and resources to protect

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the AWS Backup console and select Backup plans in the left menu.

  3. Check whether any backup plan is listed.

  4. Repeat for each region in use.

  5. If no backup plan exists in any region, follow the implementation steps.

CLI:

List the backup plans in a region:

aws backup list-backup-plans --region <REGION> --query "BackupPlansList[].[BackupPlanName,BackupPlanId,LastExecutionDate]" --output table

List the backup vaults in a region:

aws backup list-backup-vaults --region <REGION> --query "BackupVaultList[].BackupVaultName"

The account fails if no backup plan exists in any region in use. The account is only evaluated when at least one backup vault exists.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the AWS Backup console and select Backup plans in the left menu.

  3. Choose Create backup plan and select Build a new plan.

  4. Enter a Backup plan name.

  5. Under Backup rule configuration, enter:

    • a Backup rule name,

    • the Backup vault to store the recovery points (for example Default),

    • the Backup frequency and Retention period that meet your recovery needs.

  6. Choose Create plan.

  7. On the plan page, choose Assign resources, enter a resource assignment name, select the IAM role (for example Default role) and select the resources to protect.

  8. Choose Assign resources.

  9. Repeat for each region in use where resources need to be backed up.

CLI:

If the target backup vault does not exist yet, create it:

aws backup create-backup-vault --backup-vault-name <BACKUP_VAULT_NAME> --region <REGION>

Save the following as backup-plan.json (daily backup at 05:00 UTC, kept for 35 days):

{"BackupPlanName": "<BACKUP_PLAN_NAME>", "Rules": [{"RuleName": "<RULE_NAME>", "TargetBackupVaultName": "<BACKUP_VAULT_NAME>", "ScheduleExpression": "cron(0 5 ? * * *)", "Lifecycle": {"DeleteAfterDays": 35}}]}

Create the backup plan:

aws backup create-backup-plan --region <REGION> --backup-plan file://backup-plan.json

The schedule and retention period are set explicitly so that the plan does not depend on defaults and recovery points do not accumulate without limit.

Save the following as backup-selection.json to assign resources to the plan:

{"SelectionName": "<SELECTION_NAME>", "IamRoleArn": "<BACKUP_ROLE_ARN>", "Resources": ["<RESOURCE_ARN>"]}

Assign the resources, using the BackupPlanId returned by the previous command:

aws backup create-backup-selection --region <REGION> --backup-plan-id <BACKUP_PLAN_ID> --backup-selection file://backup-selection.json

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the AWS Backup console and select Backup plans in the left menu.

  3. Select the backup plan that was created.

  4. Delete each of its resource assignments, then choose Delete for the plan and confirm.

CLI:

aws backup delete-backup-selection --region <REGION> --backup-plan-id <BACKUP_PLAN_ID> --selection-id <SELECTION_ID>
aws backup delete-backup-plan --region <REGION> --backup-plan-id <BACKUP_PLAN_ID>

Note: deleting the plan stops new scheduled backups. Existing recovery points stay in the backup vault until they are deleted or reach the end of their retention period.

Reference