Description

Ensure that every AWS Backup vault has an AWS KMS key configured to encrypt the recovery points it stores. A vault's encryption key is chosen when the vault is created and cannot be changed afterwards.

Rationale

If a backup vault is not protected by a KMS key, the recovery points it holds can be read when storage or credentials are compromised, enabling data theft. A KMS key adds a second access control layer, because readers also need permission to use the key, and key usage is recorded in AWS CloudTrail for investigations. Customer managed keys give the most control, including key policies, rotation and the ability to disable access quickly.

Impact

  • Protects recovery points at rest and limits access to principals allowed to use the KMS key

  • Provides an audit trail of key usage

  • Moving to a new vault requires updating backup plans and copying or keeping existing recovery points, and copies add storage charges

  • If the KMS key is disabled or deleted, recovery points encrypted with it can no longer be restored

Default Value

AWS Backup encrypts every backup vault. If no key is chosen when the vault is created, the AWS managed key aws/backup is used.

Pre-Requisites

  • IAM permissions: backup:ListBackupVaults, backup:CreateBackupVault, backup:UpdateBackupPlan, backup:StartCopyJob, backup:DeleteBackupVault, kms:DescribeKey and kms:CreateGrant

  • A KMS key to use for the vault (preferably a customer managed key) whose key policy allows AWS Backup to use it

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the AWS Backup console and select Backup vaults in the left menu.

  3. Select a backup vault and check the encryption key shown in its details.

  4. Repeat for each backup vault in each region in use.

  5. If any vault has no encryption key, follow the implementation steps.

CLI:

Show the encryption key of each backup vault in a region:

aws backup list-backup-vaults --region <REGION> --query "BackupVaultList[].[BackupVaultName,EncryptionKeyArn]" --output table

A vault fails if EncryptionKeyArn is empty.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the AWS Backup console and select Backup vaults in the left menu.

  3. Choose Create backup vault.

  4. Enter a Backup vault name and, under Encryption key, select a customer managed KMS key (or the AWS managed key aws/backup).

  5. Choose Create backup vault.

  6. Select Backup plans, open each plan that uses the old vault, edit its backup rules and set the target backup vault to the new vault.

  7. If existing recovery points must be kept, select each one in the old vault and copy it to the new vault.

  8. When the old vault is empty and no longer needed, select it and choose Delete.

  9. Repeat for each affected vault in each region in use.

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the AWS Backup console and select Backup plans in the left menu.

  3. Edit the backup rules of each plan and set the target backup vault back to the original vault, as long as it has not been deleted.

Note: a vault's encryption key cannot be changed after creation, and a deleted vault cannot be restored. Keep the original vault until the new vault is confirmed to work.

Reference