Check ID: backup_recovery_point_encrypted
Provider: AWS
Service: backup
Severity: MEDIUM
Categories: encryption
Resource type: AwsBackupRecoveryPoint

​
What this check verifies

AWS Backup recovery points are evaluated for encryption at rest using the backup vault’s KMS configuration. Items lacking vault-level encryption are highlighted, regardless of the source resource’s encryption.

​
Risk

Unencrypted recovery points can be read or copied if vault access is obtained, enabling offline analysis and data theft (confidentiality). Snapshots or restores may be altered (integrity), and unsafe restores can disrupt recovery operations (availability).

​
Recommendation

Encrypt all recovery points with KMS, preferring customer-managed keys for rotation and control. Apply least privilege to keys and vaults, require encrypted copies across accounts/Regions, and continuously monitor for unencrypted artifacts. Use aws/backup or CMEK consistently.

​
Remediation

# Encrypted AWS Backup Vault
resource "aws_backup_vault" "<example_resource_name>" {
  name        = "<example_resource_name>"
  kms_key_arn = "<kms_key_arn>" # Critical: ensures recovery points in this vault are encrypted at rest
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = backup_recovery_point_encrypted. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks