Detection: EFS File System Backup Policy Disabled
Overview
Detect when an Amazon Elastic File System (EFS) file system's backup policy was disabled. Disabling a backup policy increases the risk of data loss and prolonged recovery times due to accidental deletions, corruption, or hardware failures. Enabling backup policies ensures data resilience, supports disaster recovery, and aligns with best practices for data protection.
References:
Usage
Run the detection in your terminal:
powerpipe detection run aws_cloudtrail_log_detections.detection.efs_file_system_backup_policy_disabledSnapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe detection run aws_cloudtrail_log_detections.detection.efs_file_system_backup_policy_disabled --shareSQL
This detection uses a named query:
select tp_timestamp as timestamp,string_split(event_source, '.')[1] || ':' || event_name as operation,coalesce(request_parameters ->> 'fileSystemId', request_parameters ->> 'mountTargetId') as resource,user_identity.arn as actor,tp_source_ip as source_ip,tp_index as account_id,aws_region as region,tp_id as source_id,*
from aws_cloudtrail_logwhere event_source = 'elasticfilesystem.amazonaws.com' and event_name = 'PutBackupPolicy' and (request_parameters -> 'backupPolicy' ->> 'status') = 'DISABLED' and error_code is null
order by event_time desc;