AWS Backup recovery points should be encrypted at rest

Checks that the latest AWS Backup recovery point of the protected resource is encrypted at rest; older recovery points are not read. Backups of EBS, EC2, RDS, Aurora, Redshift and other types AWS Backup does not fully manage inherit the source's encryption, so an unencrypted source keeps producing unencrypted recovery points.

service: Backup
severity: Medium
scope: evaluated in every region

How to fix it

Replaces the resource: A recovery point cannot be encrypted after it is made: encrypt the source (for EBS and RDS an encrypted copy), back that up, then delete the unencrypted recovery points.
Can't be undone: A deleted recovery point cannot be restored, so keep each one until a newer encrypted backup covers any restore you might need from it.

In the console

AWS Backup → Backup vaults → the vault → Recovery points

Delete: Each unencrypted recovery point of this resource, once a backup of the encrypted source has replaced it

With the AWS CLI

aws backup delete-recovery-point --backup-vault-name <vault-name> --recovery-point-arn <recovery-point-arn> --region <region>

See which of your accounts this check is failing on.

Book a live scan