AWS Backup

What it is

AWS Backup is a fully managed service that centralizes and automates backups across AWS services, in the cloud and On-premisesIn data centers or offices that you run yourself, rather than in the cloud. Hybrid architectures connect on-premises systems to AWS, for example through AWS Direct Connect or a VPN.Glossary entry. Instead of scripting snapshots service by service, you define backup plans once, assign resources to them, and see every backup job, copy, and restore in one console. Backups that you take outside AWS Backup (for example, a manual EBS snapshot) aren't governed by it.

Supported resources include EC2 instances, EBS volumes, S3 buckets, RDS and Aurora, DynamoDB, EFS, all four FSx types, DocumentDB, Neptune, Redshift Serverless, Timestream, Storage Gateway volumes, EKS, CloudFormation stacks, SAP HANA on EC2, Windows VSS-consistent backups, and VMware VM (Virtual machine)A software computer that runs its own operating system on shared physical hardware, kept apart from other VMs by a hypervisor. An EC2 instance is a VM, except bare metal instances.Glossary entry on premises or in VMware Cloud on AWS (through the Backup gateway software). Not every feature applies to every resource; check the feature availability table.

Choose AWS Backup when a question asks for one place to manage backups across several services or accounts, backups that meet a compliance requirement, or protection against deletion and ransomware.

Concepts

Backup plan: a policy made of backup rules. Each rule sets:
- Frequency (every hour, every 12 hours, daily, weekly, monthly, or a cron expression) and a backup window (by default, start within 8 hours and complete within 7 days).
- Lifecycle: when to move backups to cold storage and when to expire (delete) them.
- The target vault, and optional copies to vaults in other AWS RegionA separate geographic area where AWS runs its services, such as us-east-1 in Northern Virginia, made up of several Availability Zones. Most resources live in one Region; you choose Regions for latency, data residency, and the services you need.Glossary entry or accounts.
- Optional continuous backup for PITR (Point-in-time recovery)Restoring a database to its state at a chosen moment within a retention period, using continuous backups. Amazon RDS, Amazon Aurora, Amazon DynamoDB, and AWS Backup support it.Glossary entry.
Resource assignment: choose resources by resource type, by ARN (Amazon Resource Name)The unique identifier of an AWS resource, in the form arn:partition:service:region:account-id:resource. IAM policies use ARNs to name the resources they allow or deny.Glossary entry, or by tags (for example, every resource tagged backup=daily). You must also opt in to each service in AWS Backup's settings.
Backup vault: a container that stores and organizes recovery points (backups). You choose a KMS key for the vault, and a vault access policy (resource-based) controls who can use it, for example to deny deleting recovery points.
Recovery point: one backup of one resource, which you restore to a new resource.

An AWS Backup plan. The backup plan, with its frequency and lifecycle rules, selects the resources tagged backup=daily. Their recovery points are stored in a backup vault protected by a KMS key and a vault access policy, and copied to a vault in another Region or account.

Backup types and storage

Incremental snapshot backups: most resources back up incrementally after the first full backup.
Continuous backups for RDS, Aurora, S3, and SAP HANA on EC2 let you restore to any second within the retention period, up to 35 days (point-in-time recovery, PITR). One continuous backup exists per resource, and continuous backups can't move to cold storage.
Cold storage costs less for long retention. Backups must stay in cold storage for at least 90 days, so the total retention must be at least 90 days longer than the "move to cold" setting. Cold storage is available for resources such as EBS, EFS, DynamoDB, Timestream, SAP HANA on EC2, and VMware.
Backup tiering moves older S3 backup data to a lower-cost warm tier, cutting S3 backup storage costs by up to 30%.
Item-level restore brings back a single file, directory, or S3 object instead of the whole resource, and backup search indexes S3 and EBS backups so you can find items before restoring them.

Copies, accounts, and organizations

Cross-Region copies, on demand or in a backup plan, meet requirements to keep backups a distance from production. The first copy to a Region is full; later copies are incremental when the service supports it.
Cross-account copies let you "fan in" backups to a central backup account. Both accounts must be in the same AWS Organizations organization.
Backup policies in AWS Organizations apply backup plans to accounts across the organization from the management account (or a delegated administrator), with cross-account monitoring of jobs.

Protecting the backups themselves

AWS Backup Vault Lock makes a vault WORM (Write once, read many)A storage model in which data can be written once and then cannot be changed or deleted for a set period, often to meet record-keeping rules. Amazon S3 Object Lock and AWS Backup Vault Lock provide it.Glossary entry: nobody, including the root user, can delete recovery points early or shorten their retention.
- Governance mode: users with enough IAM permissions can remove the lock.
- Compliance mode: after a grace time of at least 3 days (72 hours), the vault and its lock become immutable, and nobody, not even AWS, can change or delete them while they hold recovery points.
Logically air-gapped vaults store backups in an account owned by AWS Backup, are always locked in compliance mode, and can be shared with other accounts (through AWS RAM, even across organizations) for fast recovery after an account compromise. They can integrate with multi-party approval to recover even if the owning account is inaccessible.
Legal holds stop selected backups being deleted, regardless of their lifecycle, until the hold is removed.
Malware protection scans recovery points with Amazon GuardDuty Malware Protection, as part of backup plans or on demand.

Security, resilience, performance, and cost

Security

Encryption with AWS KMS: for resources with full AWS Backup management, backups use the vault's key, independently of the source; for others, encryption follows the source service. Copies are re-encrypted with the destination vault's key.
AWS Backup uses an IAM role to create and restore backups; vault access policies and Vault Lock prevent tampering with recovery points.

Resilience

Combine cross-Region and cross-account copies with Vault Lock or a logically air-gapped vault so that a compromised production account or a Regional outage can't remove every copy.
Restore testing runs scheduled test restores of selected backups, optionally validates the restored resources, then deletes them, so you can prove that backups work and measure restore times.

Cost

Pay for backup storage (per GB-month, warm or cold, by resource type), restores (per GB), cross-Region data transfer, and features such as Audit Manager backup evaluations, restore testing, and malware scans. There is no minimum fee.
Save by moving long-kept backups to cold storage, using backup tiering for S3, and expiring backups you no longer need.

Monitoring

The AWS Backup console and cross-account monitoring show jobs; EventBridge, SNS notifications, and CloudWatch metrics report job states; CloudTrail records API (Application programming interface)A defined way for one program to ask another for data or actions, such as a set of HTTPS requests and responses. Every AWS service is controlled through its API, which the console, the CLI, and the SDKs call for you.Glossary entry calls.
AWS Backup Audit Manager evaluates frameworks of controls (for example, "every resource is in a backup plan" or "backups are encrypted") using AWS Config, and produces daily compliance reports.

AWS Backup or a service's own backups?

If the requirement is	Choose
One policy for many services and accounts	AWS Backup backup plans and Organizations backup policies
Backups nobody can delete before a date	Vault Lock in compliance mode
Recover even if the production account is compromised	Logically air-gapped vault, or cross-account copies
Restore a database or bucket to a precise second	Continuous backup with PITR (up to 35 days)
Prove to auditors that backups exist and are encrypted	AWS Backup Audit Manager
Only EBS snapshots for one account, on a schedule	Amazon Data Lifecycle Manager, or AWS Backup
Keep years of backups at the lowest cost	Lifecycle to cold storage

Reverse mindmap: when the question points here

Is it AWS Backup?

Yes, when the question says
- Centralize backups across EBS, RDS, DynamoDB, EFS, FSx leads to AWS Backup
- Back up every resource with a tag leads to Backup plan with tag assignment
- Same backup policy in every account leads to Organizations backup policies
- Back up on-premises VMware VMs leads to AWS Backup with Backup gateway
Protect the backups
- Backups can't be deleted, even by root leads to Vault Lock compliance mode
- Survive a compromised account leads to Logically air-gapped vault
- Copy backups to another Region leads to Cross-Region copy rule
- Keep a backup for litigation leads to Legal hold
- Check backups for malware leads to GuardDuty Malware Protection
Recover and prove
- Restore to an exact second leads to Continuous backup and PITR
- Restore one file or object leads to Item-level restore
- Prove backups restore correctly leads to Restore testing
- Compliance report on backup controls leads to Backup Audit Manager
Reduce cost
- Long retention at low cost leads to Move to cold storage, 90-day minimum

Key takeaways

AWS Backup centralizes backups across many AWS services and VMware with backup plans, rules, and tag-based assignment.
Vaults store recovery points with KMS encryption and access policies; Vault Lock (compliance mode, at least 72 hours of grace time) makes them immutable.
Continuous backups give point-in-time recovery for RDS, Aurora, S3, and SAP HANA for up to 35 days.
Cold storage needs at least 90 days; copies go to other Regions and to accounts in the same organization.
Logically air-gapped vaults, legal holds, malware scans, restore testing, and Audit Manager protect and prove your backups.