Status: IN
Each AWS Backup vault requires an AWS KMS encryption key at creation time; some backups are encrypted by the vault's KMS key while others are encrypted by their source AWS service.
Source: entries/2026/03/12/aws-backup-latest-devguide-vaultshtml.md