AWS Backup vault should use a CMK for encryption

What it checks

AWS Backup vault: no CMK is set.

Where it applies

Terraform: aws_backup_vault

CloudFormation: AWS::Backup::BackupVault

How to fix it

1. Create a CMK and set kms_key_arn on the backup vault. Note: KMS key cannot be changed after vault creation.

Frameworks

• AWS FSBP Backup.1
• SOC 2 CC6.1
• HIPAA 164.312(a)(2)(iv)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules