A company stores and manages documents in an Amazon Elastic File System (Amazon EFS) file system. The file system is encrypted with an AWS Key Management Service (AWS KMS) key. The file system is…

To meet an RPO of 100 minutes, a new AWS Backup plan is required because the default backup plan typically has a daily schedule, which is too infrequent. Creating a new backup plan allows for specifying a more frequent backup schedule (e.g., hourly). This new backup plan must be associated with an IAM role that has explicit permissions to access the Amazon EFS file system and the AWS KMS key used for its encryption, ensuring successful backups and restores.

While creating a new backup plan is correct, updating the KMS key policy to specifically allow AWSServiceRoleForBackup is not ideal for a new custom plan; instead, a dedicated IAM role for the new plan should be created and granted specific KMS permissions.

Using the existing default backup plan will not meet the 100-minute RPO requirement, as default plans typically run daily.

Using the existing default backup plan will not meet the 100-minute RPO requirement, and the KMS policy update is incomplete without specifying the principal.