Back to Checks
aws

At least one AWS Backup plan exists

backup_plans_exist
Service: backupSeverity: low
OfficialBuilt-inVerified
Categories:resilience
Resource Type:AwsBackupBackupPlan

AWS Backup is assessed for the existence of at least one backup plan that schedules and retains recovery points for selected resources.

The evaluation determines whether any plan is configured; when none is found-even if backup vaults exist-the absence of a plan is noted.

Prowler logoProwlerprowler-provider-aws

Risk

Without a backup plan, resources lack scheduled recovery points, undermining RPO/RTO.

  • Irrecoverable data after deletion or corruption (integrity)
  • Prolonged outages due to unavailable restores (availability)
  • Inconsistent backups that hinder investigations and controlled recovery

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks backup_plans_exist

Recommendation

Establish and enforce backup plans for critical workloads:

  • Define schedules, retention, and lifecycle to meet RPO/RTO
  • Use tagging to include all required resources by policy
  • Enable cross-Region/account copies and immutability where feasible
  • Apply least privilege to backup roles
  • Regularly test restores and review reports

Remediation

CLI

aws backup create-backup-plan --backup-plan "{\"BackupPlanName\":\"<example_resource_name>\",\"Rules\":[{\"RuleName\":\"<example_resource_name>\",\"TargetBackupVaultName\":\"Default\"}]}"

Terraform

# Terraform: minimal AWS Backup Plan to satisfy the check
resource "aws_backup_plan" "<example_resource_name>" {
  name = "<example_resource_name>"  # Critical: creates the Backup Plan so the check passes

  rule {
    rule_name         = "<example_resource_name>"  # Critical: minimal rule
    target_vault_name = "Default"                  # Critical: required vault
  }
}

NativeIaC

# CloudFormation: create a minimal AWS Backup Plan to pass the check
Resources:
  <example_resource_name>:
    Type: AWS::Backup::BackupPlan
    Properties:
      BackupPlan:
        BackupPlanName: <example_resource_name>  # Critical: ensures at least one Backup Plan exists
        Rules:
          - RuleName: <example_resource_name>     # Critical: minimal required rule
            TargetBackupVault: Default            # Critical: required vault for the rule

Other

1In the AWS Console, go to AWS Backup
2Click Backup plans > Create backup plan
3Choose Build a new plan
4Enter Plan name: <example_resource_name>
5Under Backup rule, set Rule name: <example_resource_name> and Target backup vault: Default
6Click Create plan

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.backup.backup_client import backup_client


class backup_plans_exist(Check):
    def execute(self):
        findings = []
        if backup_client.backup_plans:
            report = Check_Report_AWS(
                metadata=self.metadata(),
                resource=backup_client.backup_plans[0],
            )
            report.status = "PASS"
            report.status_extended = f"At least one Backup Plan exists: {backup_client.backup_plans[0].name}."
            report.resource_id = backup_client.backup_plans[0].name
            findings.append(report)
        elif backup_client.backup_vaults:
            report = Check_Report_AWS(metadata=self.metadata(), resource={})
            report.region = backup_client.region
            report.status = "FAIL"
            report.status_extended = "No Backup Plan exist."
            report.resource_arn = backup_client.backup_plan_arn_template
            report.resource_id = backup_client.audited_account
            report.resource_tags = []
            findings.append(report)
        return findings

References