Check ID: backup_reportplans_exist
Provider: AWS
Service: backup
Severity: LOW
Categories: logging
Resource type: AwsBackupBackupPlan

What this check verifies

AWS Backup environments with existing backup plans are assessed for the presence of at least one report plan that generates jobs or compliance reports.

Risk

Without a report plan, backup failures and missed restores may go unnoticed, harming availability and recovery objectives. Gaps in retention, scheduling, or encryption controls can persist unreported, weakening integrity and auditability across accounts and Regions, increasing the chance of SLA breaches.

Recommendation

Establish and maintain report plans to continuously monitor backup activity and policy adherence.
  • Apply least privilege to report storage
  • Include relevant accounts and Regions for coverage
  • Review reports routinely and alert on anomalies
  • Enforce separation of duties between backup admins and auditors

Remediation

aws backup create-report-plan --report-plan-name <REPORT_PLAN_NAME> --report-delivery-channel s3BucketName=<S3_BUCKET_NAME>,formats=CSV --report-setting reportTemplate=BACKUP_JOB_REPORT

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = backup_reportplans_exist. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks