FSx file system has copy tags to backups enabled

Check ID: fsx_file_system_copy_tags_to_backups_enabled
Provider: AWS
Service: fsx
Severity: LOW
Categories: resilience
Resource type: AwsFSxFileSystem

What this check verifies

Amazon FSx file systems are evaluated for whether they copy resource tags to their backups via the copy_tags_to_backups setting.

Risk

Missing tag inheritance leaves backups unclassified and outside tag-based controls, weakening confidentiality and availability. Tag-aware IAM and retention policies may not apply, enabling unauthorized access, accidental deletion, or orphaned backups that complicate recovery and inflate costs.

Recommendation

Enable tag copying for FSx backups and standardize mandatory tags (owner, data classification, environment). Map least privilege and lifecycle policies to these tags, enforce with automation and guardrails, and regularly audit to prevent untagged or misclassified backups.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws fsx update-file-system --file-system-id <file-system-id> --open-zfs-configuration CopyTagsToBackups=true

# Terraform: Enable copying tags to backups for FSx OpenZFS
resource "aws_fsx_openzfs_file_system" "<example_resource_name>" {
  subnet_ids          = ["<subnet_id>"]
  deployment_type     = "SINGLE_AZ_1"
  throughput_capacity = 64
  storage_capacity    = 128

  copy_tags_to_backups = true # Critical: ensures tags are copied to backups (passes the check)
}

# CloudFormation: Enable copying tags to backups for FSx OpenZFS
Resources:
  <example_resource_name>:
    Type: AWS::FSx::FileSystem
    Properties:
      FileSystemType: OPENZFS
      OpenZFSConfiguration:
        CopyTagsToBackups: true  # Critical: ensures tags are copied to backups (passes the check)

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = fsx_file_system_copy_tags_to_backups_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

All AWS FMS policies are compliant for all accounts FSx file system has copy tags to volumes enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires