Back to Checks
aws

At least one AWS Backup vault exists

backup_vaults_exist
Service: backupSeverity: low
OfficialBuilt-inVerified
Categories:resilience
Resource Type:AwsBackupBackupVault

AWS Backup in the account/region includes at least one backup vault that stores and organizes recovery points for use by backup plans and copies.

Prowler logoProwlerprowler-provider-aws

Risk

Without a vault, recovery points cannot be created or retained in AWS Backup, degrading availability and integrity. Data may be irrecoverable after deletion, ransomware, or misconfiguration, and RPO/RTO targets may be missed during incidents.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks backup_vaults_exist

Recommendation

Create and maintain a backup vault in each required region. Enforce least privilege access, encrypt with KMS CMKs, and enable Vault Lock to prevent tampering. Use lifecycle rules and cross-region/cross-account copies, and regularly test restores for defense in depth.

Remediation

CLI

aws backup create-backup-vault --backup-vault-name <example_resource_name>

Terraform

# Create a Backup Vault
resource "aws_backup_vault" "<example_resource_name>" {
  name = "<example_resource_name>" # Critical: ensures at least one backup vault exists
}

NativeIaC

# CloudFormation: create a Backup Vault
Resources:
  BackupVault:
    Type: AWS::Backup::BackupVault
    Properties:
      VaultName: <example_resource_name>  # Critical: creates a backup vault to satisfy the check

Other

1Sign in to the AWS Management Console and open the AWS Backup console
2In the left navigation pane, select Backup vaults
3Click Create backup vault
4Enter a name (e.g., <example_resource_name>)
5Click Create backup vault

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.backup.backup_client import backup_client


class backup_vaults_exist(Check):
    def execute(self):
        findings = []
        if backup_client.backup_vaults is not None:
            report = Check_Report_AWS(metadata=self.metadata(), resource={})
            report.resource_arn = backup_client.backup_vault_arn_template
            report.resource_id = backup_client.audited_account
            report.region = backup_client.region
            report.resource_tags = []
            report.status = "FAIL"
            report.status_extended = "No Backup Vault exist."
            if backup_client.backup_vaults:
                report = Check_Report_AWS(
                    metadata=self.metadata(),
                    resource=backup_client.backup_vaults[0],
                )
                report.status = "PASS"
                report.status_extended = f"At least one backup vault exists: {backup_client.backup_vaults[0].name}."
            findings.append(report)
        return findings

References