AWS Backup Vault Deleted or Vault Lock Removed

Last updated 2 months ago on 2026-06-19

Created 2 months ago on 2026-06-19

About

Identifies deletion of an AWS Backup vault or removal of its Vault Lock configuration via DeleteBackupVault or DeleteBackupVaultLockConfiguration. A backup vault stores recovery points, and Vault Lock enforces WORM (write-once, read-many) immutability that prevents recovery points from being deleted before their retention expires. Removing the lock defeats the primary control designed to stop ransomware from destroying backups, and deleting the vault removes the backup container entirely. Both actions are strong anti-recovery signals and are rare in normal operations.

Tags

Domain: CloudData Source: AWSData Source: Amazon Web ServicesData Source: AWS BackupUse Case: Threat DetectionTactic: ImpactTactic: Defense EvasionLanguage: kuery

Severity

high

Risk Score

MITRE ATT&CK™

Impact (TA0040)(external, opens in a new tab or window)

↳ Inhibit System Recovery (T1490)(external, opens in a new tab or window)

Defense Evasion (TA0005)(external, opens in a new tab or window)

↳ Impair Defenses (T1562)(external, opens in a new tab or window)

False Positive Examples

Platform or infrastructure-as-code teams may delete empty or deprecated vaults during decommissioning, or adjust Vault Lock during a planned governance change (note that compliance-mode locks cannot be removed). Verify the principal in "aws.cloudtrail.user_identity.arn" and confirm the change aligns with an approved request. Known administration roles can be excluded after validation.

License

Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type: Query (Kibana Query Language)
Integration Pack: Prebuilt Security Detection Rules
Index Patterns: logs-aws.cloudtrail-*
Related Integrations: aws(external, opens in a new tab or window)
Query

✄𐘗text code block:
✄𐘗data_stream.dataset: "aws.cloudtrail"
    and event.provider: "backup.amazonaws.com"
    and event.action: ("DeleteBackupVault" or "DeleteBackupVaultLockConfiguration")
    and event.outcome: "success"
    and not aws.cloudtrail.user_identity.type: "AWSService"

Install detection rules in Elastic Security

Detect AWS Backup Vault Deleted or Vault Lock Removed in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).