# BackupVaultProps

Properties for a BackupVault.

Extends: BackupVaultProps
Used as props by: BackupVault

- Source: [`aws-backup/lib/vault.ts`](https://github.com/aws/aws-cdk/blob/v2.277.0/packages/aws-cdk-lib/aws-backup/lib/vault.ts#L44)
- Type last changed: v2.224.0 · 13 Nov 2025

## Example

```ts
const myKey = kms.Key.fromKeyArn(this, 'MyKey', 'aaa');
const myTopic = sns.Topic.fromTopicArn(this, 'MyTopic', 'bbb');

const vault = new backup.BackupVault(this, 'Vault', {
  encryptionKey: myKey, // Custom encryption key
  notificationTopic: myTopic, // Send all vault events to this SNS topic
});
```

## Properties

- `accessPolicy`: [PolicyDocument](/cdk/api/v2/docs/aws-cdk-lib.aws_iam.PolicyDocument.html) — A resource-based policy that is used to manage access permissions on the backup vault.

  **Default:** access is not restricted

- `backupVaultName`: string — The name of a logical container where backups are stored.

  **Default:** A CDK generated name

  Backup vaults
  are identified by names that are unique to the account used to create
  them and the AWS Region where they are created.

- `blockRecoveryPointDeletion`: boolean = false — Whether to add statements to the vault access policy that prevents anyone from deleting a recovery point.

- `encryptionKey`: [IKeyRef](/cdk/api/v2/docs/aws-cdk-lib.interfaces.aws_kms.IKeyRef.html) — The server-side encryption key to use to protect your backups.

  **Default:** an Amazon managed KMS key

- `lockConfiguration`: [LockConfiguration](/cdk/api/v2/docs/aws-cdk-lib.aws_backup.LockConfiguration.html) — Configuration for AWS Backup Vault Lock.

  **Default:** AWS Backup Vault Lock is disabled

- `notificationEvents`: [BackupVaultEvents](/cdk/api/v2/docs/aws-cdk-lib.aws_backup.BackupVaultEvents.html)[] — The vault events to send.

  **Default:** all vault events if `notificationTopic` is defined

- `notificationTopic`: [ITopic](/cdk/api/v2/docs/aws-cdk-lib.aws_sns.ITopic.html) — A SNS topic to send vault events to.

  **Default:** no notifications

- `removalPolicy`: [RemovalPolicy](/cdk/api/v2/docs/aws-cdk-lib.RemovalPolicy.html) = RemovalPolicy.RETAIN — The removal policy to apply to the vault.

  Note that removing a vault
  that contains recovery points will fail.