Skip to content
PuglieseWeb Engineering HandbookSystemDox Pages

AWS Backup

AWS Backup is a managed service that applies one backup policy across many AWS services, replacing the per-service scripts and schedules that otherwise accumulate. It covers EC2 instances and EBS volumes, S3, EFS, all four FSx file system types, RDS and Aurora, DynamoDB, DocumentDB, Neptune, Redshift, Storage Gateway volumes, CloudFormation stacks, SAP HANA on EC2 and EKS clusters, among others.

How it is organised

Section titled “How it is organised”
  • A backup plan defines the schedule, the retention and the lifecycle — including transition to a lower-cost cold tier — for a group of resources. Resources are assigned to a plan directly or by tag, which is how a plan scales without being edited every time something is created.
  • A backup vault holds the resulting recovery points. Vaults carry their own KMS encryption and a resource-based access policy, so the backups are protected separately from the resources they came from. A vault keeps its recovery points even after the source volume or instance is deleted.
  • AWS Backup Vault Lock enforces a write-once-read-many model: once locked, nobody — including the account that created it — can delete a recovery point or shorten its retention.
  • Backups are stored incrementally for the resource types that support it: the first is a full copy, later ones capture only changes.

Across Regions and accounts

Section titled “Across Regions and accounts”

Backups can be copied to other Regions on demand or as part of a plan, which is how a business-continuity requirement to hold copies away from production data is met.

With AWS Organizations in place, backup policies apply across every account in the organisation, and copies can be fanned in to a single isolated repository account and fanned back out. That combination — a separate account, a locked vault and a copy in a second Region — is the usual shape of a backup design that is meant to survive a compromised production account.

Auditing

Section titled “Auditing”

AWS Backup Audit Manager tracks backup activity against controls defined for the organisation, reports resources that fall outside them, and produces daily evidence reports. AWS Backup also emits events to EventBridge, metrics to CloudWatch, notifications to SNS and API calls to CloudTrail.

One caveat worth stating plainly: AWS Backup only governs backups taken through AWS Backup. Snapshots created by hand or by another tool are invisible to its policies and its compliance reports.