Back to Checks
aws

Region with EBS snapshots has at least one EBS snapshot lifecycle policy defined

dlm_ebs_snapshot_lifecycle_policy_exists
Service: dlmSeverity: medium
OfficialBuilt-inVerified
Categories:forensics-ready
Resource Type:Other

EBS snapshots are expected to be governed by Data Lifecycle Manager (DLM) policies in each Region where snapshots exist.

The evaluation looks for lifecycle policies that automate snapshot creation, retention, and cleanup for those snapshots.

Prowler logoProwlerprowler-provider-aws

Risk

Without automated lifecycle policies, backups become inconsistent and error-prone, reducing availability and weakening recovery objectives. Missing retention rules cause premature deletion or snapshot sprawl, increasing cost and exposing stale data. Lack of cross-Region/account copies limits resilience to regional outages and malicious deletion.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks dlm_ebs_snapshot_lifecycle_policy_exists

Recommendation

Implement DLM lifecycle policies for all volumes that require backup.

  • Schedule creations to meet RPO/RTO
  • Define retention to prevent sprawl and enforce least data exposure
  • Use least privilege roles and separation of duties
  • Copy snapshots to another Region/account for defense in depth
  • Monitor policy health and coverage with tags

Remediation

CLI

aws dlm create-lifecycle-policy --region <region> --execution-role-arn <execution-role-arn> --description "<description>" --state ENABLED --policy-details '{"PolicyType":"EBS_SNAPSHOT_MANAGEMENT","ResourceTypes":["VOLUME"],"TargetTags":[{"Key":"<tag_key>","Value":"<tag_value>"}],"Schedules":[{"CreateRule":{"Interval":24,"IntervalUnit":"HOURS"},"RetainRule":{"Count":1}}]}'

Terraform

# Terraform: minimal EBS snapshot lifecycle policy
resource "aws_dlm_lifecycle_policy" "<example_resource_name>" {
  description        = "<description>"
  execution_role_arn = "<example_resource_arn>"
  state              = "ENABLED" # Critical: enables the policy so it is counted by the check

  policy_details {
    policy_type    = "EBS_SNAPSHOT_MANAGEMENT" # Critical: creates an EBS snapshot lifecycle policy
    resource_types = ["VOLUME"]
    target_tags = {
      "<tag_key>" = "<tag_value>" # Critical: selects target volumes by tag
    }
    schedule {
      create_rule {
        interval      = 24
        interval_unit = "HOURS"
      }
      retain_rule {
        count = 1
      }
    }
  }
}

NativeIaC

# CloudFormation: minimal EBS snapshot lifecycle policy
Resources:
  <example_resource_name>:
    Type: AWS::DLM::LifecyclePolicy
    Properties:
      Description: "<description>"
      ExecutionRoleArn: "<example_resource_arn>"
      State: ENABLED  # Critical: enables the policy so it is counted by the check
      PolicyDetails:
        PolicyType: EBS_SNAPSHOT_MANAGEMENT  # Critical: creates an EBS snapshot lifecycle policy
        ResourceTypes: [VOLUME]
        TargetTags:
          - Key: "<tag_key>"  # Critical: selects target volumes by tag
            Value: "<tag_value>"
        Schedules:
          - CreateRule:
              Interval: 24
              IntervalUnit: HOURS
            RetainRule:
              Count: 1

Other

1In the AWS console, switch to the Region that has EBS snapshots
2Open EC2 > Lifecycle Manager (DLM) > Create lifecycle policy
3Select EBS snapshot policy; Target resource: Volumes
4Add Target tags: Key = <tag_key>, Value = <tag_value>
5Set Schedule: Create every 24 hours; Retain 1 snapshot
6Ensure State is Enabled and click Create policy

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.dlm.dlm_client import dlm_client


class dlm_ebs_snapshot_lifecycle_policy_exists(Check):
    def execute(self):
        findings = []
        for region in dlm_client.lifecycle_policies:
            if (
                region in dlm_client.regions_with_snapshots
                and dlm_client.regions_with_snapshots[region]
            ):
                report = Check_Report_AWS(
                    metadata=self.metadata(),
                    resource=dlm_client.lifecycle_policies,
                )
                report.status = "FAIL"
                report.status_extended = "No EBS Snapshot lifecycle policies found."
                report.region = region
                report.resource_id = dlm_client.audited_account
                report.resource_arn = dlm_client._get_lifecycle_policy_arn_template(
                    region
                )
                if dlm_client.lifecycle_policies[region]:
                    report.status = "PASS"
                    report.status_extended = "EBS snapshot lifecycle policies found."
                findings.append(report)
        return findings

References