Back to Checks
aws

AWS Backup vault is encrypted at rest

backup_vaults_encrypted
Service: backupSeverity: medium
OfficialBuilt-inVerified
Categories:encryption
Resource Type:AwsBackupBackupVault

AWS Backup vaults are evaluated for encryption at rest with AWS KMS. The finding highlights vaults without a configured KMS key protecting stored recovery points.

Prowler logoProwlerprowler-provider-aws

Risk

Unencrypted vaults allow recovery points to be read if storage or credentials are compromised, undermining confidentiality and enabling data exfiltration. Missing KMS controls also weaken integrity guarantees and impede forensic auditability during investigations.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks backup_vaults_encrypted

Recommendation

Encrypt every backup vault with customer-managed KMS keys (CMK). Enforce least privilege in key policies, enable rotation, and separate key admins from backup operators. Add defense-in-depth with vault lock and logging. For copies, ensure destination vaults use appropriate KMS keys.

Remediation

Terraform

# Encrypted AWS Backup Vault
resource "aws_backup_vault" "<example_resource_name>" {
  name        = "<example_resource_name>"
  kms_key_arn = "<kms_key_arn>"  # CRITICAL: enables encryption at rest for the vault
}

NativeIaC

# CloudFormation: Encrypted AWS Backup Vault
Resources:
  <example_resource_name>:
    Type: AWS::Backup::BackupVault
    Properties:
      BackupVaultName: <example_resource_name>
      EncryptionKeyArn: <kms_key_arn>  # CRITICAL: sets KMS key to encrypt the vault at rest

Other

1In the AWS Console, go to AWS Backup > Backup vaults
2Click Create backup vault
3Set Name to <example_resource_name>
4Under Encryption key, select a customer managed KMS key (<kms_key_arn>)
5Click Create backup vault
6Update any Backup plans to use the new vault (Plans > select plan > Edit > change Target vault name)
7Delete the old unencrypted vault after it is empty (select vault > Delete backup vault)

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.backup.backup_client import backup_client


class backup_vaults_encrypted(Check):
    def execute(self):
        findings = []
        if backup_client.backup_vaults:
            for backup_vault in backup_client.backup_vaults:
                report = Check_Report_AWS(
                    metadata=self.metadata(), resource=backup_vault
                )
                report.status = "FAIL"
                report.status_extended = (
                    f"Backup Vault {backup_vault.name} is not encrypted at rest."
                )
                if backup_vault.encryption:
                    report.status = "PASS"
                    report.status_extended = (
                        f"Backup Vault {backup_vault.name} is encrypted at rest."
                    )
                findings.append(report)

        return findings

References