All checks
Low
EBS volumes should be in a backup plan
Confirms that each in-use EBS volume is selected by an AWS Backup plan in the same Region (no backup has to have run yet) or already has a recovery point, so its data can be restored after loss or deletion. Snapshots taken by hand or by Data Lifecycle Manager do not count. A resource assignment with both a resource list and a tag list must match both here.
- service
- EC2
- severity
- Low
- scope
- evaluated in every region
How to fix it
In the console
AWS Backup → Backup plans → the plan → Resource assignments → Assign resources
- IAM role
- Default role, or a role allowed to back up EBS volumes
- Define resource selection
- Include specific resource types; Include all resource types needs EBS, or EC2 for its instance, opted in to AWS Backup
- Select resource types
- EBS, with this volume left selected (by default every EBS volume is)
- Refine selection using tags
- Optional; the volume must match every tag condition you add
With the AWS CLI
aws backup create-backup-selection --backup-plan-id <backup-plan-id> --backup-selection '{"SelectionName":"ebs-volumes","IamRoleArn":"<backup-role-arn>","Resources":["arn:aws:ec2:*:*:volume/*"]}' --region <region>With Terraform
resource "aws_backup_selection" "this" {
name = "ebs-volumes"
plan_id = var.backup_plan_id
iam_role_arn = var.backup_role_arn
resources = ["arn:aws:ec2:*:*:volume/*"]
}See which of your accounts this check is failing on.
Book a live scan