How are my backups and copies encrypted in AWS Backup?

Resolution

In AWS Backup, encryption depends on the resource types and their integration with the service. The encryption type depends on whether the resource you're backing up has full AWS Backup management. To see the resource types that support full AWS Backup management, see Feature availability by resource.

Backup encryption

Resources that support full AWS Backup management

Your resource's backup encrypts with the target backup vault's AWS Key Management Service (AWS KMS) managed keys. This applies regardless of the source service's AWS KMS key.

Resources that don't support full AWS Backup management

Your resource's backup encrypts with the source service's AWS KMS key. If a resource is unencrypted at the source, then the backup for that resource is also unencrypted in the backup vault.

For more information, see Encryption for backups in AWS Backup.

Copy encryption

Encryption for copies and cross-Region copies for resources that support full AWS Backup management

AWS Backup encrypts copies even when the backup isn't encrypted. AWS Backup encrypts copies with the target vault's AWS KMS key.

Cross-Region copies for resources that don't support full AWS Backup management

Cross-Region copies encrypt with the destination resource's AWS Region default AWS managed AWS KMS key.

Cross-Region copies don't encrypt with the AWS KMS managed key of AWS Backup.

For example, your destination default vault uses the aws/backup key in the US East (Ohio) Region. You perform a cross-Region copy of an Amazon Elastic Block Store (Amazon EBS) snapshot. The cross-Region snapshot copies to the destination default vault. Then, the snapshot copy encrypts with the aws/ebs key in the US East (Ohio) Region.

Cross-account copy for resources that support full AWS Backup management

Cross-account copies encrypt with the target vault's AWS KMS key.

Cross-account copy for resources that don't support full AWS Backup management

You can't copy backups across accounts that use an AWS KMS managed key.

You can copy backups across accounts that are in a custom vault with a customer managed AWS KMS key.

For more information, see How can I copy AWS Backups across AWS accounts?

Related information

Copy a backup

Key policies in AWS KMS