Backup Vault Lock governance mode remains removable

What it checks

Backup Vault Lock governance mode remains removable

Where it applies

Terraform: aws_backup_vault_lock_configuration

CloudFormation: AWS::Backup::BackupVault

How to fix it

1. Confirm whether removable governance protection is intentional. If permanent immutability is required, plan a valid compliance grace period and retention policy before enabling it; the lock becomes irreversible after that period.

Frameworks

• SOC 2 CC7.4

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules