Region with EBS snapshots has a snapshot lifecycle policy

Check ID: dlm_ebs_snapshot_lifecycle_policy_exists
Provider: AWS
Service: dlm
Severity: MEDIUM
Categories: forensics-ready
Resource type: Other

What this check verifies

EBS snapshots are expected to be governed by Data Lifecycle Manager (DLM) policies in each Region where snapshots exist. The evaluation looks for lifecycle policies that automate snapshot creation, retention, and cleanup for those snapshots.

Risk

Without automated lifecycle policies, backups become inconsistent and error-prone, reducing availability and weakening recovery objectives. Missing retention rules cause premature deletion or snapshot sprawl, increasing cost and exposing stale data. Lack of cross-Region/account copies limits resilience to regional outages and malicious deletion.

Recommendation

Implement DLM lifecycle policies for all volumes that require backup.

Schedule creations to meet RPO/RTO
Define retention to prevent sprawl and enforce least data exposure
Use least privilege roles and separation of duties
Copy snapshots to another Region/account for defense in depth
Monitor policy health and coverage with tags

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws dlm create-lifecycle-policy --region <region> --execution-role-arn <execution-role-arn> --description "<description>" --state ENABLED --policy-details '{"PolicyType":"EBS_SNAPSHOT_MANAGEMENT","ResourceTypes":["VOLUME"],"TargetTags":[{"Key":"<tag_key>","Value":"<tag_value>"}],"Schedules":[{"CreateRule":{"Interval":24,"IntervalUnit":"HOURS"},"RetainRule":{"Count":1}}]}'

# Terraform: minimal EBS snapshot lifecycle policy
resource "aws_dlm_lifecycle_policy" "<example_resource_name>" {
  description        = "<description>"
  execution_role_arn = "<example_resource_arn>"
  state              = "ENABLED" # Critical: enables the policy so it is counted by the check

  policy_details {
    policy_type    = "EBS_SNAPSHOT_MANAGEMENT" # Critical: creates an EBS snapshot lifecycle policy
    resource_types = ["VOLUME"]
    target_tags = {
      "<tag_key>" = "<tag_value>" # Critical: selects target volumes by tag
    }
    schedule {
      create_rule {
        interval      = 24
        interval_unit = "HOURS"
      }
      retain_rule {
        count = 1
      }
    }
  }
}

# CloudFormation: minimal EBS snapshot lifecycle policy
Resources:
  <example_resource_name>:
    Type: AWS::DLM::LifecyclePolicy
    Properties:
      Description: "<description>"
      ExecutionRoleArn: "<example_resource_arn>"
      State: ENABLED  # Critical: enables the policy so it is counted by the check
      PolicyDetails:
        PolicyType: EBS_SNAPSHOT_MANAGEMENT  # Critical: creates an EBS snapshot lifecycle policy
        ResourceTypes: [VOLUME]
        TargetTags:
          - Key: "<tag_key>"  # Critical: selects target volumes by tag
            Value: "<tag_value>"
        Schedules:
          - CreateRule:
              Interval: 24
              IntervalUnit: HOURS
            RetainRule:
              Count: 1

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = dlm_ebs_snapshot_lifecycle_policy_exists. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

AWS Directory Service directory has RADIUS-based MFA enabled DMS MongoDB endpoint has an authentication mechanism enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires