Check Details

• Resource: EC2 Volume
• Check: Enable EBS volume backup
• Risk: Data loss due to missing or outdated backups

Remediation via AWS Console

1. Log in to the AWS Management Console and open the Amazon EC2 console.
2. In the left navigation pane, click Volumes under Elastic Block Store.
3. Select the EBS volume that does not have backup enabled.
4. Create a manual snapshot:
   • Click Actions → Create snapshot
   • Add a description
   • Click Create snapshot
   
5. Open the AWS Backup console.
6. Choose Backup plans and click Create backup plan.
7. Add the EBS volume as a resource assignment.
8. Save the configuration.

Remediation via AWS CLI

1. Log in to the AWS Management Console and click the CloudShell icon (>_) in the top-right corner.
2. Create a snapshot of the EBS volume:

   
   
   aws ec2 create-snapshot --volume-id <volume-id> --description "EBS backup snapshot"
   

3. Create a backup vault:

   
   
   aws backup create-backup-vault --backup-vault-name Default
   

4. Create a backup plan:

   
   
   aws backup create-backup-plan \
   --backup-plan '{
   "BackupPlanName": "EBS-Daily-Backup",
   "Rules": [{
   "RuleName": "DailyBackup",
   "TargetBackupVaultName": "Default",
   "ScheduleExpression": "cron(0 12 * * ? *)",
   "Lifecycle": {
   "DeleteAfterDays": 30
   }
   }]
   }'
   

5. Assign the EBS volume to the backup plan:

   
   
   aws backup create-backup-selection \
   --backup-plan-id <backup-plan-id> \
   --backup-selection '{
   "SelectionName": "EBSVolumeSelection",
   "IamRoleArn": "arn:aws:iam::<aws-account-id>:role/service-role/AWSBackupDefaultServiceRole",
   "Resources": [
   "arn:aws:ec2:<region>:<aws-account-id>:volume/<volume-id>"
   ]
   }'
   

Replace <backup-plan-id>, <aws-account-id>, <volume-id>, and <region> with actual values.