# Ensure AWS Backup vault is encrypted at rest - Source: https://support.icompaas.com/support/solutions/articles/a_1793292234802831-ensure-aws-backup-vault-is-encrypted-at-rest - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224) - Last updated: 2026-10-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **Description** Ensure that every AWS Backup vault has an AWS KMS key configured to encrypt the recovery points it stores. A vault's encryption key is chosen when the vault is created and cannot be changed afterwards. **Rationale** If a backup vault is not protected by a KMS key, the recovery points it holds can be read when storage or credentials are compromised, enabling data theft. A KMS key adds a second access control layer, because readers also need permission to use the key, and key usage is recorded in AWS CloudTrail for investigations. Customer managed keys give the most control, including key policies, rotation and the ability to disable access quickly. **Impact** - Protects recovery points at rest and limits access to principals allowed to use the KMS key - Provides an audit trail of key usage - Moving to a new vault requires updating backup plans and copying or keeping existing recovery points, and copies add storage charges - If the KMS key is disabled or deleted, recovery points encrypted with it can no longer be restored **Default Value** AWS Backup encrypts every backup vault. If no key is chosen when the vault is created, the AWS managed key aws/backup is used. **Pre-Requisites** - IAM permissions: backup:ListBackupVaults, backup:CreateBackupVault, backup:UpdateBackupPlan, backup:StartCopyJob, backup:DeleteBackupVault, kms:DescribeKey and kms:CreateGrant - A KMS key to use for the vault (preferably a customer managed key) whose key policy allows AWS Backup to use it **Remediation** **Test Plan** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the AWS Backup console and select **Backup vaults** in the left menu. 3. Select a backup vault and check the encryption key shown in its details. 4. Repeat for each backup vault in each region in use. 5. If any vault has no encryption key, follow the implementation steps. **CLI:** Show the encryption key of each backup vault in a region: aws backup list-backup-vaults --region --query "BackupVaultList\[\].\[BackupVaultName,EncryptionKeyArn\]" --output table A vault fails if EncryptionKeyArn is empty. **Implementation Steps** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the AWS Backup console and select **Backup vaults** in the left menu. 3. Choose **Create backup vault**. 4. Enter a **Backup vault name** and, under **Encryption key**, select a customer managed KMS key (or the AWS managed key aws/backup). 5. Choose **Create backup vault**. 6. Select **Backup plans**, open each plan that uses the old vault, edit its backup rules and set the target backup vault to the new vault. 7. If existing recovery points must be kept, select each one in the old vault and copy it to the new vault. 8. When the old vault is empty and no longer needed, select it and choose **Delete**. 9. Repeat for each affected vault in each region in use. **Backout Plan** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the AWS Backup console and select **Backup plans** in the left menu. 3. Edit the backup rules of each plan and set the target backup vault back to the original vault, as long as it has not been deleted. Note: a vault's encryption key cannot be changed after creation, and a deleted vault cannot be restored. Keep the original vault until the new vault is confirmed to work. **Reference** - [https://docs.aws.amazon.com/aws-backup/latest/devguide/encryption.html](https://docs.aws.amazon.com/aws-backup/latest/devguide/encryption.html) - [https://docs.aws.amazon.com/aws-backup/latest/devguide/create-a-vault.html](https://docs.aws.amazon.com/aws-backup/latest/devguide/create-a-vault.html) - [https://docs.aws.amazon.com/cli/latest/reference/backup/list-backup-vaults.html](https://docs.aws.amazon.com/cli/latest/reference/backup/list-backup-vaults.html) ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.