EBS volume is protected by a backup plan
ec2_ebs_volume_protected_by_backup_plan
EBS volumes are evaluated for coverage by an AWS Backup plan, whether explicitly targeted or included via broad resource selection, confirming scheduled, policy-driven backups exist for the volume.
Risk
Absent backup coverage, volumes face data loss, weakened integrity, and reduced availability. Deletion or corruption-whether accidental or malicious-can leave no recovery path, causing prolonged outages, failed point-in-time restoration, unmet retention needs, and harder incident response.
prowler aws --checks ec2_ebs_volume_protected_by_backup_plan
Recommendation
Include all critical EBS volumes in standardized AWS Backup plans aligned to your RPO/RTO. Use tags for automatic assignment, enable cross-Region/account copies, apply Vault Lock for WORM retention, encrypt with KMS, enforce least-privilege access, and regularly test restores to verify integrity.
Remediation
aws backup create-backup-selection --backup-plan-id <BACKUP_PLAN_ID> --backup-selection '{"SelectionName":"<example_resource_name>","IamRoleArn":"arn:aws:iam::<example_account_id>:role/service-role/AWSBackupDefaultServiceRole","Resources":["arn:aws:ec2:::volume/*"]}'
- In the AWS Backup console, go to Backup plans and click Create backup plan
- Choose Start with a template (any), keep the Default vault, and create the plan
- Open the plan and click Assign resources
- Set Selection name and choose IAM role AWSBackupDefaultServiceRole
- Under Assign resources, choose Include specific resource types and select EBS
- For Resources, select all EBS volumes (or the specific volumes to protect) and click Assign resources
Source Code
Resource Type
AwsEc2Volume