From ebd58141125b63f395d047f4953c375213f4afe7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rub=C3=A9n=20De=20la=20Torre=20Vico?= Date: Mon, 13 Oct 2025 14:22:49 +0200 Subject: [PATCH] chore(aws): enhance metadata for `backup` service (#8826) Co-authored-by: HugoPBrito --- prowler/CHANGELOG.md | 3 +- .../backup_plans_exist.metadata.json | 37 +++++++++++-------- ...kup_recovery_point_encrypted.metadata.json | 33 +++++++++++------ .../backup_reportplans_exist.metadata.json | 34 +++++++++-------- .../backup_vaults_encrypted.metadata.json | 37 ++++++++++++------- .../backup_vaults_exist.metadata.json | 34 +++++++++-------- 6 files changed, 107 insertions(+), 71 deletions(-) diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md index 2eaec5e7bd..8272ce15a2 100644 --- a/prowler/CHANGELOG.md +++ b/prowler/CHANGELOG.md @@ -29,6 +29,7 @@ All notable changes to the **Prowler SDK** are documented in this file. - Update AWS AppStream service metadata to new format [(#8789)](https://github.com/prowler-cloud/prowler/pull/8789) - Update AWS API Gateway service metadata to new format [(#8788)](https://github.com/prowler-cloud/prowler/pull/8788) - Update AWS Athena service metadata to new format [(#8790)](https://github.com/prowler-cloud/prowler/pull/8790) +- Update AWS Backup service metadata to new format [(#8826)](https://github.com/prowler-cloud/prowler/pull/8826) - Update AWS CloudFormation service metadata to new format [(#8828)](https://github.com/prowler-cloud/prowler/pull/8828) - Update AWS Lambda service metadata to new format [(#8825)](https://github.com/prowler-cloud/prowler/pull/8825) - Deprecate user authentication for M365 provider [(#8865)](https://github.com/prowler-cloud/prowler/pull/8865) @@ -441,4 +442,4 @@ All notable changes to the **Prowler SDK** are documented in this file. - Handle projects without ID in GCP [(#7496)](https://github.com/prowler-cloud/prowler/pull/7496) - Restore packages location in PyProject [(#7510)](https://github.com/prowler-cloud/prowler/pull/7510) ---- \ No newline at end of file +--- diff --git a/prowler/providers/aws/services/backup/backup_plans_exist/backup_plans_exist.metadata.json b/prowler/providers/aws/services/backup/backup_plans_exist/backup_plans_exist.metadata.json index 9a630c335c..320748069d 100644 --- a/prowler/providers/aws/services/backup/backup_plans_exist/backup_plans_exist.metadata.json +++ b/prowler/providers/aws/services/backup/backup_plans_exist/backup_plans_exist.metadata.json @@ -1,33 +1,40 @@ { "Provider": "aws", "CheckID": "backup_plans_exist", - "CheckTitle": "Ensure that there is at least one AWS Backup plan", + "CheckTitle": "At least one AWS Backup plan exists", "CheckType": [ - "Recover", - "Resilience", - "Backup" + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices" ], "ServiceName": "backup", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:service:region:account-id:backup-plan:backup-plan-id", + "ResourceIdTemplate": "", "Severity": "low", "ResourceType": "AwsBackupBackupPlan", - "Description": "This check ensures that there is at least one backup plan in place.", - "Risk": "Without a backup plan, an organization may be at risk of losing important data due to accidental deletion, system failures, or natural disasters. This can result in significant financial and reputational damage for the organization.", - "RelatedUrl": "https://docs.aws.amazon.com/aws-backup/latest/devguide/about-backup-plans.html", + "Description": "**AWS Backup** is assessed for the existence of at least one **backup plan** that schedules and retains recovery points for selected resources.\n\nThe evaluation determines whether any plan is configured; when none is found-even if backup vaults exist-the absence of a plan is noted.", + "Risk": "Without a backup plan, resources lack scheduled recovery points, undermining RPO/RTO.\n- Irrecoverable data after deletion or corruption (integrity)\n- Prolonged outages due to unavailable restores (availability)\n- Inconsistent backups that hinder investigations and controlled recovery", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://awscli.amazonaws.com/v2/documentation/api/2.0.33/reference/backup/create-backup-plan.html", + "https://docs.aws.amazon.com/aws-backup/latest/devguide/about-backup-plans.html", + "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/backup_plan", + "https://medium.com/@christopheradamson253/backup-strategies-using-aws-backup-1b17b94a7957" + ], "Remediation": { "Code": { - "CLI": "aws backup create-backup-plan --backup-plan --backup-plan-rule ", - "NativeIaC": "", - "Other": "", - "Terraform": "" + "CLI": "aws backup create-backup-plan --backup-plan \"{\\\"BackupPlanName\\\":\\\"\\\",\\\"Rules\\\":[{\\\"RuleName\\\":\\\"\\\",\\\"TargetBackupVaultName\\\":\\\"Default\\\"}]}\"", + "NativeIaC": "```yaml\n# CloudFormation: create a minimal AWS Backup Plan to pass the check\nResources:\n :\n Type: AWS::Backup::BackupPlan\n Properties:\n BackupPlan:\n BackupPlanName: # Critical: ensures at least one Backup Plan exists\n Rules:\n - RuleName: # Critical: minimal required rule\n TargetBackupVault: Default # Critical: required vault for the rule\n```", + "Other": "1. In the AWS Console, go to AWS Backup\n2. Click Backup plans > Create backup plan\n3. Choose Build a new plan\n4. Enter Plan name: \n5. Under Backup rule, set Rule name: and Target backup vault: Default\n6. Click Create plan", + "Terraform": "```hcl\n# Terraform: minimal AWS Backup Plan to satisfy the check\nresource \"aws_backup_plan\" \"\" {\n name = \"\" # Critical: creates the Backup Plan so the check passes\n\n rule {\n rule_name = \"\" # Critical: minimal rule\n target_vault_name = \"Default\" # Critical: required vault\n }\n}\n```" }, "Recommendation": { - "Text": "Use AWS Backup to create backup plans for your critical data and services.", - "Url": "https://docs.aws.amazon.com/aws-backup/latest/devguide/about-backup-plans.html" + "Text": "Establish and enforce **backup plans** for critical workloads:\n- Define schedules, retention, and lifecycle to meet RPO/RTO\n- Use tagging to include all required resources by policy\n- Enable cross-Region/account copies and immutability where feasible\n- Apply least privilege to backup roles\n- Regularly test restores and review reports", + "Url": "https://hub.prowler.com/check/backup_plans_exist" } }, - "Categories": [], + "Categories": [ + "resilience" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/backup/backup_recovery_point_encrypted/backup_recovery_point_encrypted.metadata.json b/prowler/providers/aws/services/backup/backup_recovery_point_encrypted/backup_recovery_point_encrypted.metadata.json index e6eab7dddb..a68e92fe7b 100644 --- a/prowler/providers/aws/services/backup/backup_recovery_point_encrypted/backup_recovery_point_encrypted.metadata.json +++ b/prowler/providers/aws/services/backup/backup_recovery_point_encrypted/backup_recovery_point_encrypted.metadata.json @@ -1,28 +1,37 @@ { "Provider": "aws", "CheckID": "backup_recovery_point_encrypted", - "CheckTitle": "Check if AWS Backup recovery points are encrypted at rest.", + "CheckTitle": "AWS Backup recovery point is encrypted at rest", "CheckType": [ - "Software and Configuration Checks/AWS Security Best Practices" + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Effects/Data Exposure" ], "ServiceName": "backup", "SubServiceName": "", - "ResourceIdTemplate": "arn:aws:backup:region:account-id:recovery-point/recovery-point-id", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "AwsBackupRecoveryPoint", - "Description": "This control checks if an AWS Backup recovery point is encrypted at rest. The control fails if the recovery point isn't encrypted at rest.", - "Risk": "Without encryption at rest, AWS Backup recovery points are vulnerable to unauthorized access, which could compromise the confidentiality and integrity of the backed-up data.", - "RelatedUrl": "https://docs.aws.amazon.com/aws-backup/latest/devguide/encryption.html", + "Description": "**AWS Backup recovery points** are evaluated for **encryption at rest** using the backup vault's KMS configuration. Items lacking vault-level encryption are highlighted, regardless of the source resource's encryption.", + "Risk": "Unencrypted recovery points can be read or copied if vault access is obtained, enabling offline analysis and data theft (**confidentiality**). Snapshots or restores may be altered (**integrity**), and unsafe restores can disrupt recovery operations (**availability**).", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/securityhub/latest/userguide/backup-controls.html#backup-1", + "https://readmedium.com/how-would-you-desgin-a-solution-for-autmated-backup-and-recovery-of-data-and-services-in-aws-311662f5a43e", + "https://docs.aws.amazon.com/aws-backup/latest/devguide/encryption.html", + "https://medium.com/cloud-devops-security-ai-career-talk/how-would-you-desgin-a-solution-for-autmated-backup-and-recovery-of-data-and-services-in-aws-311662f5a43e", + "https://github.com/turbot/steampipe-mod-aws-compliance/issues/598" + ], "Remediation": { "Code": { - "CLI": "aws backup update-backup-vault --backup-vault-name --encryption-key-arn ", - "NativeIaC": "", - "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/backup-controls.html#backup-1", - "Terraform": "" + "CLI": "", + "NativeIaC": "```yaml\n# CloudFormation: Encrypted AWS Backup Vault\nResources:\n :\n Type: AWS::Backup::BackupVault\n Properties:\n BackupVaultName: \n EncryptionKeyArn: # Critical: vault uses this KMS key so recovery points stored here are encrypted at rest\n```", + "Other": "1. In AWS Backup, go to Backup vaults > Create backup vault\n2. Enter a name and select a KMS key (aws/backup or a customer-managed key)\n3. Save the vault\n4. Go to Backup plans > select your plan > Edit and set the Target backup vault to the encrypted vault > Save\n5. To remediate existing unencrypted recovery points: Recovery points > select the item > Copy > choose the encrypted vault > Start copy, then delete the original unencrypted recovery point", + "Terraform": "```hcl\n# Encrypted AWS Backup Vault\nresource \"aws_backup_vault\" \"\" {\n name = \"\"\n kms_key_arn = \"\" # Critical: ensures recovery points in this vault are encrypted at rest\n}\n```" }, "Recommendation": { - "Text": "Ensure that AWS Backup recovery points are encrypted at rest by using an AWS KMS key when creating backups.", - "Url": "https://docs.aws.amazon.com/aws-backup/latest/devguide/encryption.html" + "Text": "Encrypt all recovery points with **KMS**, preferring **customer-managed keys** for rotation and control. Apply **least privilege** to keys and vaults, require encrypted copies across accounts/Regions, and continuously monitor for unencrypted artifacts. Use `aws/backup` or `CMEK` consistently.", + "Url": "https://hub.prowler.com/check/backup_recovery_point_encrypted" } }, "Categories": [ diff --git a/prowler/providers/aws/services/backup/backup_reportplans_exist/backup_reportplans_exist.metadata.json b/prowler/providers/aws/services/backup/backup_reportplans_exist/backup_reportplans_exist.metadata.json index c600682e1d..c6dd3244f1 100644 --- a/prowler/providers/aws/services/backup/backup_reportplans_exist/backup_reportplans_exist.metadata.json +++ b/prowler/providers/aws/services/backup/backup_reportplans_exist/backup_reportplans_exist.metadata.json @@ -1,33 +1,37 @@ { "Provider": "aws", "CheckID": "backup_reportplans_exist", - "CheckTitle": "Ensure that there is at least one AWS Backup report plan", + "CheckTitle": "At least one AWS Backup report plan exists", "CheckType": [ - "Recover", - "Resilience", - "Backup" + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices" ], "ServiceName": "backup", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:service:region:account-id:backup-report-plan:backup-report-plan-id", + "ResourceIdTemplate": "", "Severity": "low", "ResourceType": "AwsBackupBackupPlan", - "Description": "This check ensures that there is at least one backup report plan in place.", - "Risk": "Without a backup report plan, an organization may lack visibility into the success or failure of backup operations.", - "RelatedUrl": "https://docs.aws.amazon.com/aws-backup/latest/devguide/create-report-plan-console.html", + "Description": "**AWS Backup** environments with existing backup plans are assessed for the presence of at least one **report plan** that generates `jobs` or `compliance` reports.", + "Risk": "Without a report plan, backup failures and missed restores may go unnoticed, harming **availability** and recovery objectives. Gaps in retention, scheduling, or encryption controls can persist unreported, weakening **integrity** and auditability across accounts and Regions, increasing the chance of SLA breaches.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/aws-backup/latest/devguide/create-report-plan-console.html" + ], "Remediation": { "Code": { - "CLI": "aws backup create-report-plan --report-plan-name --report-delivery-channel --report-setting ", - "NativeIaC": "", - "Other": "", - "Terraform": "" + "CLI": "aws backup create-report-plan --report-plan-name --report-delivery-channel s3BucketName=,formats=CSV --report-setting reportTemplate=BACKUP_JOB_REPORT", + "NativeIaC": "```yaml\nResources:\n :\n Type: AWS::Backup::ReportPlan\n Properties:\n ReportPlanName: # Critical: creates the report plan required to pass the check\n ReportDeliveryChannel:\n S3BucketName: # Critical: destination bucket for reports\n Formats:\n - CSV # Critical: valid report file format\n ReportSetting:\n ReportTemplate: BACKUP_JOB_REPORT # Critical: minimal template to enable job reports\n```", + "Other": "1. Open the AWS Backup console and go to Reports\n2. Click Create report plan\n3. Select the Backup jobs (job report) template\n4. Enter a Report plan name and choose an S3 bucket\n5. Select CSV as the file format\n6. Click Create report plan", + "Terraform": "```hcl\nresource \"aws_backup_report_plan\" \"\" {\n name = \"\" # Critical: creates at least one report plan\n\n report_delivery_channel {\n s3_bucket_name = \"\" # Critical: destination bucket for reports\n formats = [\"CSV\"] # Critical: valid report file format\n }\n\n report_setting {\n report_template = \"BACKUP_JOB_REPORT\" # Critical: minimal job report template\n }\n}\n```" }, "Recommendation": { - "Text": "Use AWS Backup to create backup report plans that provide visibility into the success or failure of backup operations.", - "Url": "https://docs.aws.amazon.com/aws-backup/latest/devguide/create-report-plan-console.html" + "Text": "Establish and maintain **report plans** to continuously monitor backup activity and policy adherence.\n- Apply least privilege to report storage\n- Include relevant accounts and Regions for coverage\n- Review reports routinely and alert on anomalies\n- Enforce separation of duties between backup admins and auditors", + "Url": "https://hub.prowler.com/check/backup_reportplans_exist" } }, - "Categories": [], + "Categories": [ + "logging" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/backup/backup_vaults_encrypted/backup_vaults_encrypted.metadata.json b/prowler/providers/aws/services/backup/backup_vaults_encrypted/backup_vaults_encrypted.metadata.json index 7a77b8e543..4b1f412b8f 100644 --- a/prowler/providers/aws/services/backup/backup_vaults_encrypted/backup_vaults_encrypted.metadata.json +++ b/prowler/providers/aws/services/backup/backup_vaults_encrypted/backup_vaults_encrypted.metadata.json @@ -1,31 +1,42 @@ { "Provider": "aws", "CheckID": "backup_vaults_encrypted", - "CheckTitle": "Ensure that AWS Backup vaults are encrypted with AWS KMS", + "CheckTitle": "AWS Backup vault is encrypted at rest", "CheckType": [ - "Software and Configuration Checks/AWS Security Best Practices" + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/NIST 800-53 Controls (USA)", + "Software and Configuration Checks/Industry and Regulatory Standards/NIST CSF Controls (USA)", + "Software and Configuration Checks/Industry and Regulatory Standards/PCI-DSS", + "Software and Configuration Checks/Industry and Regulatory Standards/ISO 27001 Controls", + "Software and Configuration Checks/Industry and Regulatory Standards/HIPAA Controls (USA)" ], "ServiceName": "backup", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:service:region:account-id:backup-vault:backup-vault-id", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "AwsBackupBackupVault", - "Description": "This check ensures that AWS Backup vaults are encrypted with AWS KMS.", - "Risk": "Without encryption using AWS KMS, an organization's backup data may be at risk of unauthorized access, which can lead to data breaches and other security incidents.", - "RelatedUrl": "https://docs.aws.amazon.com/aws-backup/latest/devguide/encryption.html", + "Description": "**AWS Backup vaults** are evaluated for **encryption at rest** with **AWS KMS**. The finding highlights vaults without a configured KMS key protecting stored recovery points.", + "Risk": "Unencrypted vaults allow recovery points to be read if storage or credentials are compromised, undermining **confidentiality** and enabling data exfiltration. Missing KMS controls also weaken **integrity** guarantees and impede forensic **auditability** during investigations.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/aws-backup/latest/devguide/encryption.html", + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/Athena/encrypted-with-cmk.html" + ], "Remediation": { "Code": { - "CLI": "aws backup update-backup-vault --backup-vault-name --encryption-key-arn ", - "NativeIaC": "", - "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/Athena/encrypted-with-cmk.html", - "Terraform": "" + "CLI": "", + "NativeIaC": "```yaml\n# CloudFormation: Encrypted AWS Backup Vault\nResources:\n :\n Type: AWS::Backup::BackupVault\n Properties:\n BackupVaultName: \n EncryptionKeyArn: # CRITICAL: sets KMS key to encrypt the vault at rest\n```", + "Other": "1. In the AWS Console, go to AWS Backup > Backup vaults\n2. Click Create backup vault\n3. Set Name to \n4. Under Encryption key, select a customer managed KMS key ()\n5. Click Create backup vault\n6. Update any Backup plans to use the new vault (Plans > select plan > Edit > change Target vault name)\n7. Delete the old unencrypted vault after it is empty (select vault > Delete backup vault)", + "Terraform": "```hcl\n# Encrypted AWS Backup Vault\nresource \"aws_backup_vault\" \"\" {\n name = \"\"\n kms_key_arn = \"\" # CRITICAL: enables encryption at rest for the vault\n}\n```" }, "Recommendation": { - "Text": "Use AWS KMS to encrypt your AWS Backup vaults and backup data.", - "Url": "https://docs.aws.amazon.com/aws-backup/latest/devguide/encryption.html" + "Text": "Encrypt every backup vault with **customer-managed KMS keys** (`CMK`). Enforce **least privilege** in key policies, enable rotation, and separate key admins from backup operators. Add **defense-in-depth** with vault lock and logging. *For copies*, ensure destination vaults use appropriate KMS keys.", + "Url": "https://hub.prowler.com/check/backup_vaults_encrypted" } }, - "Categories": [], + "Categories": [ + "encryption" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/backup/backup_vaults_exist/backup_vaults_exist.metadata.json b/prowler/providers/aws/services/backup/backup_vaults_exist/backup_vaults_exist.metadata.json index 2828d212c8..96a28997d0 100644 --- a/prowler/providers/aws/services/backup/backup_vaults_exist/backup_vaults_exist.metadata.json +++ b/prowler/providers/aws/services/backup/backup_vaults_exist/backup_vaults_exist.metadata.json @@ -1,33 +1,37 @@ { "Provider": "aws", "CheckID": "backup_vaults_exist", - "CheckTitle": "Ensure AWS Backup vaults exist", + "CheckTitle": "At least one AWS Backup vault exists", "CheckType": [ - "Recover", - "Resilience", - "Backup" + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices" ], "ServiceName": "backup", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:service:region:account-id:backup-vault:backup-vault-id", + "ResourceIdTemplate": "", "Severity": "low", "ResourceType": "AwsBackupBackupVault", - "Description": "This check ensures that AWS Backup vaults exist to provide a secure and durable storage location for backup data.", - "Risk": "Without an AWS Backup vault, an organization's critical data may be at risk of being lost in the event of an accidental deletion, system failures, or natural disasters.", - "RelatedUrl": "https://docs.aws.amazon.com/aws-backup/latest/devguide/vaults.html", + "Description": "**AWS Backup** in the account/region includes at least one **backup vault** that stores and organizes recovery points for use by backup plans and copies.", + "Risk": "Without a vault, recovery points cannot be created or retained in AWS Backup, degrading **availability** and **integrity**. Data may be irrecoverable after deletion, ransomware, or misconfiguration, and RPO/RTO targets may be missed during incidents.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/aws-backup/latest/devguide/vaults.html" + ], "Remediation": { "Code": { - "CLI": "aws backup create-backup-vault --backup-vault-name ", - "NativeIaC": "", - "Other": "", - "Terraform": "" + "CLI": "aws backup create-backup-vault --backup-vault-name ", + "NativeIaC": "```yaml\n# CloudFormation: create a Backup Vault\nResources:\n BackupVault:\n Type: AWS::Backup::BackupVault\n Properties:\n VaultName: # Critical: creates a backup vault to satisfy the check\n```", + "Other": "1. Sign in to the AWS Management Console and open the AWS Backup console\n2. In the left navigation pane, select Backup vaults\n3. Click Create backup vault\n4. Enter a name (e.g., )\n5. Click Create backup vault", + "Terraform": "```hcl\n# Create a Backup Vault\nresource \"aws_backup_vault\" \"\" {\n name = \"\" # Critical: ensures at least one backup vault exists\n}\n```" }, "Recommendation": { - "Text": "Use AWS Backup to create backup vaults for your critical data and services.", - "Url": "https://docs.aws.amazon.com/aws-backup/latest/devguide/vaults.html" + "Text": "Create and maintain a **backup vault** in each required region. Enforce **least privilege** access, encrypt with **KMS CMKs**, and enable **Vault Lock** to prevent tampering. Use lifecycle rules and cross-region/cross-account copies, and regularly test restores for **defense in depth**.", + "Url": "https://hub.prowler.com/check/backup_vaults_exist" } }, - "Categories": [], + "Categories": [ + "resilience" + ], "DependsOn": [], "RelatedTo": [], "Notes": ""