Check ID: backup_vaults_encrypted
Provider: AWS
Service: backup
Severity: MEDIUM
Categories: encryption
Resource type: AwsBackupBackupVault

​
What this check verifies

AWS Backup vaults are evaluated for encryption at rest with AWS KMS. The finding highlights vaults without a configured KMS key protecting stored recovery points.

​
Risk

Unencrypted vaults allow recovery points to be read if storage or credentials are compromised, undermining confidentiality and enabling data exfiltration. Missing KMS controls also weaken integrity guarantees and impede forensic auditability during investigations.

​
Recommendation

Encrypt every backup vault with customer-managed KMS keys (CMK). Enforce least privilege in key policies, enable rotation, and separate key admins from backup operators. Add defense-in-depth with vault lock and logging. For copies, ensure destination vaults use appropriate KMS keys.

​
Remediation

# Encrypted AWS Backup Vault
resource "aws_backup_vault" "<example_resource_name>" {
  name        = "<example_resource_name>"
  kms_key_arn = "<kms_key_arn>"  # CRITICAL: enables encryption at rest for the vault
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = backup_vaults_encrypted. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks