AWS Backup vault should have Vault Lock enabled for immutable backups

What it checks

AWS Backup vault: no Vault Lock configuration is associated.

Where it applies

Terraform: aws_backup_vault

CloudFormation: AWS::Backup::BackupVault

How to fix it

1. Add aws_backup_vault_lock_configuration with min_retention_days set to your minimum required retention. After changeable_for_days expires, the lock is permanent and cannot be removed.
2. Plan the changeable_for_days value carefully — once it expires, Vault Lock is permanent (even AWS support cannot remove it).

Frameworks

• SOC 2 CC7.4
• HIPAA 164.312(c)(1)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules