Control: 1 AWS Backup recovery points should be encrypted at rest
Description
This control checks if an AWS Backup recovery point is encrypted at rest. The control fails if the recovery point isn't encrypted at rest.
An AWS Backup recovery point refers to a specific copy or snapshot of data that is created as part of a backup process. It represents a particular moment in time when the data was backed up and serves as a restore point in case the original data becomes lost, corrupted, or inaccessible. Encrypting the backup recovery points adds an extra layer of protection against unauthorized access. Encryption is a best practice to protect the confidentiality, integrity, and security of backup data.
Remediation
To encrypt an AWS Backup recovery point, see Encryption for backups in AWS Backup in the AWS Backup Developer Guide.
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.foundational_security_backup_1Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.foundational_security_backup_1 --shareSQL
This control uses a named query:
select recovery_point_arn as resource, case when is_encrypted then 'ok' else 'alarm' end as status, case when is_encrypted then recovery_point_arn || ' encryption enabled.' else recovery_point_arn || ' encryption disabled.' end as reason , region, account_idfrom aws_backup_recovery_point;