# Ensure at least one AWS Backup plan exists - Source: https://support.icompaas.com/support/solutions/articles/a_179329223415422-ensure-at-least-one-aws-backup-plan-exists - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224) - Last updated: 2026-10-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **Description** Ensure that the AWS account has at least one AWS Backup plan. A backup plan defines when backups are taken, which backup vault stores them and how long the recovery points are kept, and is assigned to the resources it protects. **Rationale** Without a backup plan, resources have no scheduled recovery points. Data that is deleted, corrupted or encrypted by ransomware may be impossible to recover, and outages last longer because no recent restore point is available. Backup plans with defined schedules, retention and resource assignments make recovery predictable and help meet recovery point and recovery time objectives. **Impact** - Provides scheduled, centrally managed backups of the assigned resources - Improves the ability to recover from accidental deletion, data corruption and ransomware - Backup storage and restore operations are charged, so retention periods should be chosen with cost in mind - A plan only protects the resources assigned to it, so resource assignments must be kept up to date **Default Value** No backup plans exist by default in an AWS account. They must be created in each region where resources need to be backed up. **Pre-Requisites** - IAM permissions: backup:ListBackupPlans, backup:ListBackupVaults, backup:CreateBackupPlan, backup:CreateBackupSelection, backup:CreateBackupVault and iam:PassRole - An IAM role that AWS Backup can use to create backups (for example, the AWSBackupDefaultServiceRole that the console can create) - Agreement on the backup frequency, retention period and resources to protect **Remediation** **Test Plan** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the AWS Backup console and select **Backup plans** in the left menu. 3. Check whether any backup plan is listed. 4. Repeat for each region in use. 5. If no backup plan exists in any region, follow the implementation steps. **CLI:** List the backup plans in a region: aws backup list-backup-plans --region --query "BackupPlansList\[\].\[BackupPlanName,BackupPlanId,LastExecutionDate\]" --output table List the backup vaults in a region: aws backup list-backup-vaults --region --query "BackupVaultList\[\].BackupVaultName" The account fails if no backup plan exists in any region in use. The account is only evaluated when at least one backup vault exists. **Implementation Steps** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the AWS Backup console and select **Backup plans** in the left menu. 3. Choose **Create backup plan** and select **Build a new plan**. 4. Enter a **Backup plan name**. 5. Under **Backup rule configuration**, enter: - a **Backup rule name**, - the **Backup vault** to store the recovery points (for example Default), - the **Backup frequency** and **Retention period** that meet your recovery needs. 6. Choose **Create plan**. 7. On the plan page, choose **Assign resources**, enter a resource assignment name, select the IAM role (for example **Default role**) and select the resources to protect. 8. Choose **Assign resources**. 9. Repeat for each region in use where resources need to be backed up. **CLI:** If the target backup vault does not exist yet, create it: aws backup create-backup-vault --backup-vault-name --region Save the following as backup-plan.json (daily backup at 05:00 UTC, kept for 35 days): {"BackupPlanName": "", "Rules": \[{"RuleName": "", "TargetBackupVaultName": "", "ScheduleExpression": "cron(0 5 ? \* \* \*)", "Lifecycle": {"DeleteAfterDays": 35}}\]} Create the backup plan: aws backup create-backup-plan --region --backup-plan file://backup-plan.json The schedule and retention period are set explicitly so that the plan does not depend on defaults and recovery points do not accumulate without limit. Save the following as backup-selection.json to assign resources to the plan: {"SelectionName": "", "IamRoleArn": "", "Resources": \[""\]} Assign the resources, using the BackupPlanId returned by the previous command: aws backup create-backup-selection --region --backup-plan-id --backup-selection file://backup-selection.json **Backout Plan** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the AWS Backup console and select **Backup plans** in the left menu. 3. Select the backup plan that was created. 4. Delete each of its resource assignments, then choose **Delete** for the plan and confirm. **CLI:** aws backup delete-backup-selection --region --backup-plan-id --selection-id aws backup delete-backup-plan --region --backup-plan-id Note: deleting the plan stops new scheduled backups. Existing recovery points stay in the backup vault until they are deleted or reach the end of their retention period. **Reference** - [https://docs.aws.amazon.com/aws-backup/latest/devguide/about-backup-plans.html](https://docs.aws.amazon.com/aws-backup/latest/devguide/about-backup-plans.html) - [https://docs.aws.amazon.com/aws-backup/latest/devguide/assigning-resources.html](https://docs.aws.amazon.com/aws-backup/latest/devguide/assigning-resources.html) - [https://docs.aws.amazon.com/cli/latest/reference/backup/create-backup-plan.html](https://docs.aws.amazon.com/cli/latest/reference/backup/create-backup-plan.html) ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.