Check ID: backup_plans_exist
Provider: AWS
Service: backup
Severity: LOW
Categories: resilience
Resource type: AwsBackupBackupPlan

What this check verifies

AWS Backup is assessed for the existence of at least one backup plan that schedules and retains recovery points for selected resources. The evaluation determines whether any plan is configured; when none is found-even if backup vaults exist-the absence of a plan is noted.

Risk

Without a backup plan, resources lack scheduled recovery points, undermining RPO/RTO.
  • Irrecoverable data after deletion or corruption (integrity)
  • Prolonged outages due to unavailable restores (availability)
  • Inconsistent backups that hinder investigations and controlled recovery

Recommendation

Establish and enforce backup plans for critical workloads:
  • Define schedules, retention, and lifecycle to meet RPO/RTO
  • Use tagging to include all required resources by policy
  • Enable cross-Region/account copies and immutability where feasible
  • Apply least privilege to backup roles
  • Regularly test restores and review reports

Remediation

aws backup create-backup-plan --backup-plan "{\"BackupPlanName\":\"<example_resource_name>\",\"Rules\":[{\"RuleName\":\"<example_resource_name>\",\"TargetBackupVaultName\":\"Default\"}]}"

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = backup_plans_exist. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks