Description

Detects AWS Backup vaults that don't explicitly deny the deletion of recovery points through their access policies. This poses a security risk as it could allow unauthorized deletion of backup recovery points, potentially compromising your backup retention and disaster recovery capabilities.

Detection Strategy

• Reports a vulnerability when an AWS Backup vault has no access policy configured

• Reports a vulnerability when a Backup vault's access policy lacks a 'Deny' statement for the 'backup:DeleteRecoveryPoint' action that applies to all principals ('*' or {'AWS': '*'})

• Checks each Backup vault in the specified AWS region to ensure recovery points are protected from deletion through explicit deny policies