Back to Checks
aws

AWS Backup recovery point is encrypted at rest

backup_recovery_point_encrypted
Service: backupSeverity: medium
OfficialBuilt-inVerified
Categories:encryption
Resource Type:AwsBackupRecoveryPoint

AWS Backup recovery points are evaluated for encryption at rest using the backup vault's KMS configuration. Items lacking vault-level encryption are highlighted, regardless of the source resource's encryption.

Prowler logoProwlerprowler-provider-aws

Risk

Unencrypted recovery points can be read or copied if vault access is obtained, enabling offline analysis and data theft (confidentiality). Snapshots or restores may be altered (integrity), and unsafe restores can disrupt recovery operations (availability).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks backup_recovery_point_encrypted

Recommendation

Encrypt all recovery points with KMS, preferring customer-managed keys for rotation and control. Apply least privilege to keys and vaults, require encrypted copies across accounts/Regions, and continuously monitor for unencrypted artifacts. Use aws/backup or CMEK consistently.

Remediation

Terraform

# Encrypted AWS Backup Vault
resource "aws_backup_vault" "<example_resource_name>" {
  name        = "<example_resource_name>"
  kms_key_arn = "<kms_key_arn>" # Critical: ensures recovery points in this vault are encrypted at rest
}

NativeIaC

# CloudFormation: Encrypted AWS Backup Vault
Resources:
  <example_resource_name>:
    Type: AWS::Backup::BackupVault
    Properties:
      BackupVaultName: <example_resource_name>
      EncryptionKeyArn: <kms_key_arn>  # Critical: vault uses this KMS key so recovery points stored here are encrypted at rest

Other

1In AWS Backup, go to Backup vaults > Create backup vault
2Enter a name and select a KMS key (aws/backup or a customer-managed key)
3Save the vault
4Go to Backup plans > select your plan > Edit and set the Target backup vault to the encrypted vault > Save
5To remediate existing unencrypted recovery points: Recovery points > select the item > Copy > choose the encrypted vault > Start copy, then delete the original unencrypted recovery point

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.backup.backup_client import backup_client


class backup_recovery_point_encrypted(Check):
    def execute(self):
        findings = []
        for recovery_point in backup_client.recovery_points:
            report = Check_Report_AWS(metadata=self.metadata(), resource=recovery_point)
            report.region = recovery_point.backup_vault_region
            report.status = "FAIL"
            report.status_extended = f"Backup Recovery Point {recovery_point.id} for Backup Vault {recovery_point.backup_vault_name} is not encrypted at rest."
            if recovery_point.encrypted:
                report.status = "PASS"
                report.status_extended = f"Backup Recovery Point {recovery_point.id} for Backup Vault {recovery_point.backup_vault_name} is encrypted at rest."

            findings.append(report)

        return findings

References