# AWS Config compliance results proving system data is backed up on a defined schedule — RDS automated backups enabled with a minimum retention, and AWS Backup plans meeting a minimum frequency and retention

> FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14
> Canonical page: /collect/config-data-backup-enabled

Recipe id: `config-data-backup-enabled` · cadence continuous · partial

> **Authored opinion.** AWS overlay v3.0.0, written
> against dataset 2026.07.14.01. The upstream
> FedRAMP rules name none of these tools; this mapping is ours.

## What it proves

- KSI `KSI-RPL-ABO`
- control `cp-9`

## Collection

Kind: `config-rule`

```sh
# db-instance-backup-enabled
aws configservice get-compliance-details-by-config-rule --config-rule-name db-instance-backup-enabled --compliance-types NON_COMPLIANT
# backup-plan-min-frequency-and-min-retention-check
aws configservice get-compliance-details-by-config-rule --config-rule-name backup-plan-min-frequency-and-min-retention-check --compliance-types NON_COMPLIANT
# configuration-recorder-status
aws configservice describe-configuration-recorder-status
# db-instance-backup-enabled-evaluation-status
aws configservice describe-config-rule-evaluation-status --config-rule-names db-instance-backup-enabled
# backup-plan-min-frequency-and-min-retention-check-evaluation-status
aws configservice describe-config-rule-evaluation-status --config-rule-names backup-plan-min-frequency-and-min-retention-check
# describe-regions
aws ec2 describe-regions --query 'Regions[].RegionName' --output text
# list-accounts
aws organizations list-accounts --query 'Accounts[].Id' --output text
```

## Expected output

Two EvaluationResults arrays; empty NON_COMPLIANT sets mean every RDS DB instance has automated backups within your backupRetentionMinimum and every AWS Backup plan meets requiredFrequencyValue/requiredRetentionDays. Managed rule identifiers: DB_INSTANCE_BACKUP_ENABLED, BACKUP_PLAN_MIN_FREQUENCY_AND_MIN_RETENTION_CHECK Plus describe-configuration-recorder-status showing recording=true and, per rule, describe-config-rule-evaluation-status showing FirstEvaluationStarted=true with a LastSuccessfulEvaluationTime — the proof the empty set was produced by a check that ran.

## Assertions

- {"field":"db-instance-backup-enabled.EvaluationResults","op":"count_eq","value":0,"controls":["cp-9"],"description":"Every RDS DB instance has automated backups meeting your retention minimum."}
- {"field":"backup-plan-min-frequency-and-min-retention-check.EvaluationResults","op":"count_eq","value":0,"controls":["cp-9"],"description":"Every AWS Backup plan meets your required frequency and retention."}
- {"field":"configuration-recorder-status.ConfigurationRecordersStatus[].recording","op":"eq","value":true,"controls":["cp-9"],"description":"The configuration recorder is on — without it an empty NON_COMPLIANT set is indistinguishable from a recorder that never ran."}
- {"field":"db-instance-backup-enabled-evaluation-status.ConfigRulesEvaluationStatus[].FirstEvaluationStarted","op":"eq","value":true,"controls":["cp-9"],"description":"db-instance-backup-enabled has evaluated at least once; a deployed-but-never-evaluated rule also returns an empty result."}
- {"field":"db-instance-backup-enabled-evaluation-status.ConfigRulesEvaluationStatus[].LastSuccessfulEvaluationTime","op":"exists","controls":["cp-9"],"description":"db-instance-backup-enabled has a successful evaluation on record."}
- {"field":"backup-plan-min-frequency-and-min-retention-check-evaluation-status.ConfigRulesEvaluationStatus[].FirstEvaluationStarted","op":"eq","value":true,"controls":["cp-9"],"description":"backup-plan-min-frequency-and-min-retention-check has evaluated at least once; a deployed-but-never-evaluated rule also returns an empty result."}
- {"field":"backup-plan-min-frequency-and-min-retention-check-evaluation-status.ConfigRulesEvaluationStatus[].LastSuccessfulEvaluationTime","op":"exists","controls":["cp-9"],"description":"backup-plan-min-frequency-and-min-retention-check has a successful evaluation on record."}

## GovCloud

AWS Config, RDS, and AWS Backup are available in AWS GovCloud (US); DB and backup-plan ARNs use partition arn:aws-us-gov

## Notes

Set db-instance-backup-enabled's backupRetentionMinimum and backup-plan's requiredFrequencyValue/requiredFrequencyUnit/requiredRetentionDays to your CP-09 policy (defaults are 1/days and 35 days). These two cover RDS and AWS Backup-managed resources; for the other stores you run, add dynamodb-pitr-enabled, elasticache-redis-cluster-automatic-backup-check, and s3 versioning/replication as applicable. Backup existence is telemetry; the restore test that proves recoverability is CP-10's separate exercise — do not present a backup config as a successful restore. The frequency and retention that carry CP-09's organization-defined values live in the rule parameters, not in the output, so a human confirms they match the SSP; system documentation under CP-09(c) is never AWS telemetry.

## References

- {"title":"AWS Config managed rule: db-instance-backup-enabled","url":"https://docs.aws.amazon.com/config/latest/developerguide/db-instance-backup-enabled.html"}
- {"title":"AWS Config managed rule: backup-plan-min-frequency-and-min-retention-check","url":"https://docs.aws.amazon.com/config/latest/developerguide/backup-plan-min-frequency-and-min-retention-check.html"}