At least one AWS Backup vault exists

Check ID: backup_vaults_exist
Provider: AWS
Service: backup
Severity: LOW
Categories: resilience
Resource type: AwsBackupBackupVault

What this check verifies

AWS Backup in the account/region includes at least one backup vault that stores and organizes recovery points for use by backup plans and copies.

Risk

Without a vault, recovery points cannot be created or retained in AWS Backup, degrading availability and integrity. Data may be irrecoverable after deletion, ransomware, or misconfiguration, and RPO/RTO targets may be missed during incidents.

Recommendation

Create and maintain a backup vault in each required region. Enforce least privilege access, encrypt with KMS CMKs, and enable Vault Lock to prevent tampering. Use lifecycle rules and cross-region/cross-account copies, and regularly test restores for defense in depth.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws backup create-backup-vault —backup-vault-name <example_resource_name>

# Create a Backup Vault
resource "aws_backup_vault" "<example_resource_name>" {
  name = "<example_resource_name>" # Critical: ensures at least one backup vault exists
}

# CloudFormation: create a Backup Vault
Resources:
  BackupVault:
    Type: AWS::Backup::BackupVault
    Properties:
      VaultName: <example_resource_name>  # Critical: creates a backup vault to satisfy the check

References

https://docs.aws.amazon.com/aws-backup/latest/devguide/vaults.html

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = backup_vaults_exist. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

AWS Backup vault is encrypted at rest Bedrock agent uses a guardrail to protect agent sessions

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires