AWS Backup Audit Manager — Compliance Reporting for MCP Server Data Protection

Audit Manager vs AWS Audit Manager

There are two separate services with similar names: AWS Backup Audit Manager (described here) and AWS Audit Manager (a broader compliance assessment service). They are different services. AWS Backup Audit Manager is focused exclusively on backup compliance — backup frequency, encryption, retention, and resource coverage. AWS Audit Manager is a broader audit management tool that can gather evidence from many services. For backup compliance specifically, AWS Backup Audit Manager is the right choice because it has pre-built controls that understand backup-specific concepts (recovery point metadata, vault encryption, backup job frequency).

Key backup controls for MCP servers

AWS Backup Audit Manager provides 14 built-in controls. For MCP servers, these five are the most critical:

Creating a backup framework

AWS Backup Audit Manager frameworks are created via the console, CLI, or CloudFormation. Use CLI for repeatability:

aws backup create-framework \
  --framework-name "alivemcp-backup-compliance" \
  --framework-controls '[
    {
      "ControlName": "BACKUP_PLAN_MIN_FREQUENCY_AND_MIN_RETENTION_CHECK",
      "ControlInputParameters": [
        {"ParameterName": "requiredFrequencyUnit", "ParameterValue": "days"},
        {"ParameterName": "requiredFrequencyValue", "ParameterValue": "1"},
        {"ParameterName": "requiredRetentionDays", "ParameterValue": "35"}
      ],
      "ControlScope": {
        "Tags": {"Backup": "true"}
      }
    },
    {
      "ControlName": "BACKUP_RECOVERY_POINT_ENCRYPTED",
      "ControlScope": {
        "ComplianceResourceTypes": ["DynamoDB", "EFS", "RDS", "EBS"]
      }
    },
    {
      "ControlName": "BACKUP_RESOURCES_PROTECTED_BY_BACKUP_PLAN",
      "ControlInputParameters": [
        {"ParameterName": "resourceType", "ParameterValue": "DynamoDB,EFS,RDS"}
      ],
      "ControlScope": {
        "Tags": {"Backup": "true"}
      }
    },
    {
      "ControlName": "BACKUP_RECOVERY_POINT_MINIMUM_RETENTION_CHECK",
      "ControlInputParameters": [
        {"ParameterName": "requiredRetentionDays", "ParameterValue": "35"}
      ]
    },
    {
      "ControlName": "BACKUP_LAST_RECOVERY_POINT_CREATED",
      "ControlInputParameters": [
        {"ParameterName": "recoveryPointAgeUnit", "ParameterValue": "hours"},
        {"ParameterName": "recoveryPointAgeValue", "ParameterValue": "26"}
      ],
      "ControlScope": {
        "Tags": {"Backup": "true"}
      }
    }
  ]'

The ControlScope limits which resources the control evaluates. Using Tags: {"Backup": "true"} is consistent with the resource selection tag in your backup plan — only tagged resources are evaluated, so you don't get false compliance failures for scratch tables that are intentionally unprotected.

Setting recoveryPointAgeValue: 26 hours (not 24) gives a 2-hour buffer for backup jobs that start at exactly 24 hours but take time to complete. A strict 24-hour window would trigger false negatives for backup jobs that complete at hour 25.

CloudFormation / CDK deployment

AWS Backup Audit Manager is exposed via CloudFormation as AWS::Backup::Framework:

// CDK using CloudFormation L1 construct
import { CfnFramework } from 'aws-cdk-lib/aws-backup';

new CfnFramework(this, 'BackupComplianceFramework', {
  frameworkName: 'alivemcp-backup-compliance',
  frameworkControls: [
    {
      controlName: 'BACKUP_PLAN_MIN_FREQUENCY_AND_MIN_RETENTION_CHECK',
      controlInputParameters: [
        { parameterName: 'requiredFrequencyUnit', parameterValue: 'days' },
        { parameterName: 'requiredFrequencyValue', parameterValue: '1' },
        { parameterName: 'requiredRetentionDays', parameterValue: '35' },
      ],
      controlScope: { tags: [{ key: 'Backup', value: 'true' }] },
    },
    {
      controlName: 'BACKUP_RECOVERY_POINT_ENCRYPTED',
      controlScope: {
        complianceResourceTypes: ['DynamoDB', 'EFS', 'RDS', 'EBS'],
      },
    },
    {
      controlName: 'BACKUP_RESOURCES_PROTECTED_BY_BACKUP_PLAN',
      controlInputParameters: [
        { parameterName: 'resourceType', parameterValue: 'DynamoDB,EFS,RDS' },
      ],
      controlScope: { tags: [{ key: 'Backup', value: 'true' }] },
    },
    {
      controlName: 'BACKUP_RECOVERY_POINT_MINIMUM_RETENTION_CHECK',
      controlInputParameters: [
        { parameterName: 'requiredRetentionDays', parameterValue: '35' },
      ],
    },
    {
      controlName: 'BACKUP_LAST_RECOVERY_POINT_CREATED',
      controlInputParameters: [
        { parameterName: 'recoveryPointAgeUnit', parameterValue: 'hours' },
        { parameterName: 'recoveryPointAgeValue', parameterValue: '26' },
      ],
      controlScope: { tags: [{ key: 'Backup', value: 'true' }] },
    },
  ],
});

Enabling daily compliance reports

AWS Backup Audit Manager can export daily compliance reports to S3 in CSV or JSON format. Create a report plan to enable this:

aws backup create-report-plan \
  --report-plan-name "alivemcp-daily-compliance-report" \
  --report-delivery-channel '{
    "S3BucketName": "alivemcp-compliance-reports",
    "S3KeyPrefix": "backup/",
    "Formats": ["CSV", "JSON"]
  }' \
  --report-setting '{
    "ReportTemplate": "BACKUP_JOB_REPORT",
    "FrameworkArns": [
      "arn:aws:backup:us-east-1:123456789012:framework/alivemcp-backup-compliance"
    ]
  }' \
  --report-plan-tags '{"Env": "prod", "Team": "platform"}'

AWS Backup generates reports once per day at approximately 05:00 UTC. The report covers the previous 24 hours. Available report templates:

For SOC 2 audit evidence, the most useful templates are RESOURCE_COMPLIANCE_REPORT (shows each DynamoDB table's compliance status for each control) and BACKUP_JOB_REPORT (shows backup jobs completed during the audit period). Request both for the audit period (typically 6 or 12 months).

Querying compliance status via CLI

To answer security questionnaire questions like "are all production databases covered by a backup plan?" in real-time:

# List all controls in the framework and their compliance status
aws backup list-framework-controls \
  --framework-name alivemcp-backup-compliance \
  --query 'FrameworkControls[*].{Control:ControlName,Status:ControlStatus}'

# List non-compliant resources for a specific control
aws backup list-compliance-results \
  --framework-name alivemcp-backup-compliance \
  --query 'Results[?ComplianceType==`NON_COMPLIANT`].{Resource:ResourceArn,Control:ControlName,Reason:ResultDetail}'

# Get aggregate compliance summary
aws backup describe-framework \
  --framework-name alivemcp-backup-compliance \
  --query '{Status:DeploymentStatus,ComplianceStatus:FrameworkStatus}'

Automatic remediation for non-compliant resources

AWS Backup Audit Manager uses AWS Config rules under the hood to evaluate controls. Each control maps to a managed Config rule (for example, BACKUP_PLAN_MIN_FREQUENCY_AND_MIN_RETENTION_CHECK maps to backup-plan-min-frequency-and-min-retention-check). You can attach an SSM Automation remediation action to the Config rule so that when a resource goes non-compliant, it is automatically tagged Backup=true (adding it to the backup plan selection):

# Find the Config rule backing the BACKUP_RESOURCES_PROTECTED_BY_BACKUP_PLAN control
aws configservice describe-config-rules \
  --query 'ConfigRules[?contains(ConfigRuleName,`backup-resources-protected`)]'

# Add an SSM Automation remediation for auto-tagging unprotected resources
aws configservice put-remediation-configurations --cli-input-json '{
  "RemediationConfigurations": [{
    "ConfigRuleName": "backup-resources-protected-by-backup-plan",
    "TargetType": "SSM_DOCUMENT",
    "TargetId": "AWS-AddTagsToResource",
    "Parameters": {
      "ResourceArn": {
        "ResourceValue": { "Value": "RESOURCE_ID" }
      },
      "Tags": {
        "StaticValue": { "Values": ["{\"Backup\":\"true\"}"] }
      }
    },
    "Automatic": true,
    "MaximumAutomaticAttempts": 3,
    "RetryAttemptSeconds": 60
  }]
}'

Automatic remediation is an aggressive stance — it tags every unprotected resource without review. For a startup MCP server team, manual remediation (review weekly Config compliance report, add Backup=true tag to new resources) is often safer until your tagging conventions are stable.

Mapping controls to audit frameworks

AWS Backup Audit Manager controls map to these compliance framework requirements:

When submitting evidence for SOC 2 Type II, attach the RESOURCE_COMPLIANCE_REPORT exports for each month of the audit period. Auditors will look for consistent COMPLIANT status across all reporting months — a single non-compliant month requires a management response explaining the gap and the remediation taken.

Common failures