Check ID:
Provider: AWS
Service:
Severity: LOW
Categories:
Resource type:
backup_reportplans_existProvider: AWS
Service:
backupSeverity: LOW
Categories:
loggingResource type:
AwsBackupBackupPlanWhat this check verifies
AWS Backup environments with existing backup plans are assessed for the presence of at least one report plan that generatesjobs or compliance reports.
Risk
Without a report plan, backup failures and missed restores may go unnoticed, harming availability and recovery objectives. Gaps in retention, scheduling, or encryption controls can persist unreported, weakening integrity and auditability across accounts and Regions, increasing the chance of SLA breaches.Recommendation
Establish and maintain report plans to continuously monitor backup activity and policy adherence.- Apply least privilege to report storage
- Include relevant accounts and Regions for coverage
- Review reports routinely and alert on anomalies
- Enforce separation of duties between backup admins and auditors
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
References
Where this check fires
This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable byCheck ID = backup_reportplans_exist. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks