Check ID:
Provider: AWS
Service:
Severity: LOW
Categories:
Resource type:
backup_plans_existProvider: AWS
Service:
backupSeverity: LOW
Categories:
resilienceResource type:
AwsBackupBackupPlanWhat this check verifies
AWS Backup is assessed for the existence of at least one backup plan that schedules and retains recovery points for selected resources. The evaluation determines whether any plan is configured; when none is found-even if backup vaults exist-the absence of a plan is noted.Risk
Without a backup plan, resources lack scheduled recovery points, undermining RPO/RTO.- Irrecoverable data after deletion or corruption (integrity)
- Prolonged outages due to unavailable restores (availability)
- Inconsistent backups that hinder investigations and controlled recovery
Recommendation
Establish and enforce backup plans for critical workloads:- Define schedules, retention, and lifecycle to meet RPO/RTO
- Use tagging to include all required resources by policy
- Enable cross-Region/account copies and immutability where feasible
- Apply least privilege to backup roles
- Regularly test restores and review reports
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
References
- https://awscli.amazonaws.com/v2/documentation/api/2.0.33/reference/backup/create-backup-plan.html
- https://docs.aws.amazon.com/aws-backup/latest/devguide/about-backup-plans.html
- https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/backup_plan
- https://medium.com/@christopheradamson253/backup-strategies-using-aws-backup-1b17b94a7957
Where this check fires
This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable byCheck ID = backup_plans_exist. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks