Check provider logo

At least one AWS Backup vault exists

backup_vaults_exist

Severitylow
Servicebackup
by Prowler
resilience

AWS Backup in the account/region includes at least one backup vault that stores and organizes recovery points for use by backup plans and copies.

Risk

Without a vault, recovery points cannot be created or retained in AWS Backup, degrading availability and integrity. Data may be irrecoverable after deletion, ransomware, or misconfiguration, and RPO/RTO targets may be missed during incidents.

Run this check with Prowler CLI

prowler aws --checks backup_vaults_exist

Run in Prowler Cloud

Recommendation

Create and maintain a backup vault in each required region. Enforce least privilege access, encrypt with KMS CMKs, and enable Vault Lock to prevent tampering. Use lifecycle rules and cross-region/cross-account copies, and regularly test restores for defense in depth.

Remediation

CLI

aws backup create-backup-vault --backup-vault-name <example_resource_name>

Native IaC
Terraform
Other
  1. Sign in to the AWS Management Console and open the AWS Backup console
  2. In the left navigation pane, select Backup vaults
  3. Click Create backup vault
  4. Enter a name (e.g., <example_resource_name>)
  5. Click Create backup vault

Source Code

Resource Type

AwsBackupBackupVault

References