Back to Checks
aws

At least one AWS Backup report plan exists

backup_reportplans_exist
Service: backupSeverity: low
OfficialBuilt-inVerified
Categories:logging
Resource Type:AwsBackupBackupPlan

AWS Backup environments with existing backup plans are assessed for the presence of at least one report plan that generates jobs or compliance reports.

Prowler logoProwlerprowler-provider-aws

Risk

Without a report plan, backup failures and missed restores may go unnoticed, harming availability and recovery objectives. Gaps in retention, scheduling, or encryption controls can persist unreported, weakening integrity and auditability across accounts and Regions, increasing the chance of SLA breaches.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks backup_reportplans_exist

Recommendation

Establish and maintain report plans to continuously monitor backup activity and policy adherence.

  • Apply least privilege to report storage
  • Include relevant accounts and Regions for coverage
  • Review reports routinely and alert on anomalies
  • Enforce separation of duties between backup admins and auditors

Remediation

CLI

aws backup create-report-plan --report-plan-name <REPORT_PLAN_NAME> --report-delivery-channel s3BucketName=<S3_BUCKET_NAME>,formats=CSV --report-setting reportTemplate=BACKUP_JOB_REPORT

Terraform

resource "aws_backup_report_plan" "<example_resource_name>" {
  name = "<example_resource_name>" # Critical: creates at least one report plan

  report_delivery_channel {
    s3_bucket_name = "<example_resource_name>" # Critical: destination bucket for reports
    formats        = ["CSV"] # Critical: valid report file format
  }

  report_setting {
    report_template = "BACKUP_JOB_REPORT" # Critical: minimal job report template
  }
}

NativeIaC

Resources:
  <example_resource_name>:
    Type: AWS::Backup::ReportPlan
    Properties:
      ReportPlanName: <example_resource_name> # Critical: creates the report plan required to pass the check
      ReportDeliveryChannel:
        S3BucketName: <example_resource_name> # Critical: destination bucket for reports
        Formats:
          - CSV # Critical: valid report file format
      ReportSetting:
        ReportTemplate: BACKUP_JOB_REPORT # Critical: minimal template to enable job reports

Other

1Open the AWS Backup console and go to Reports
2Click Create report plan
3Select the Backup jobs (job report) template
4Enter a Report plan name and choose an S3 bucket
5Select CSV as the file format
6Click Create report plan

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.backup.backup_client import backup_client


class backup_reportplans_exist(Check):
    def execute(self):
        findings = []
        # We only check report plans if backup plans exist
        if backup_client.backup_plans:
            report = Check_Report_AWS(
                metadata=self.metadata(),
                resource=backup_client.backup_plans[0],
            )
            report.resource_arn = backup_client.report_plan_arn_template
            report.resource_id = backup_client.audited_account
            report.status = "FAIL"
            report.status_extended = "No Backup Report Plan exist."

            if backup_client.backup_report_plans:
                report = Check_Report_AWS(
                    metadata=self.metadata(),
                    resource=backup_client.backup_report_plans[0],
                )
                report.status = "PASS"
                report.status_extended = f"At least one backup report plan exists: {backup_client.backup_report_plans[0].name}."
                report.resource_arn = backup_client.backup_report_plans[0].arn
                report.resource_id = backup_client.backup_report_plans[0].name
                report.region = backup_client.backup_report_plans[0].region

            findings.append(report)
        return findings

References