Backup and Restore

AWS Backup is a centralized backup service that automates data protection across AWS services. It supports EBS, EC2, RDS, DynamoDB, EFS, FSx, and Storage Gateway from a single console.

Backup vaults are containers for backups. Create vaults for different purposes: production-vault for critical data, compliance-vault for regulated data, dev-vault for test environments. Apply encryption keys (KMS) and access policies to each vault. Vaults can be shared across accounts using AWS Organizations.

Backup plans define when and how backups are taken. A plan includes rules that specify: the backup frequency (daily, weekly), the time window (3:00-5:00 AM UTC), the retention period (35 days, 12 months), and the lifecycle (transition to cold storage after 30 days, delete after 365 days). Assign resources to plans using tags or resource ARNs.

Backup policies are organization-wide templates. An organization admin creates a policy (for example, all accounts must back up RDS daily for 35 days) and attaches it to OUs or accounts. Resources in those accounts automatically inherit the policy. This ensures consistent backup across the organization without individual account configuration.

Resource assignment uses tags or conditions. A backup plan rule might assign all resources tagged Environment=production to the plan. New resources tagged Environment=production are automatically included. This tag-based approach scales with dynamic infrastructure.

Recovery: AWS Backup provides point-in-time recovery (PITR) for supported services. Restore an RDS database to any point in the last 35 days. Restore an EBS volume from a specific backup. Restore an entire EC2 instance including its attached volumes. Recovery is initiated from the backup vault and creates new resources.

Backup audit vault logs all backup and restore activities. Enable in the backup vault to track who created, restored, or deleted backups. This is required for compliance frameworks like SOC 2, HIPAA, and PCI DSS.

EC2 AMI snapshots capture the entire instance state including the root volume and attached EBS volumes. Create AMIs before major changes (deployments, upgrades) as rollback points. Store AMIs across regions for DR. Automate AMI creation with AWS Backup or Lambda triggered by CloudWatch Events.

EBS snapshots capture point-in-time copies of EBS volumes. Snapshots are incremental (only changed blocks are copied to S3, reducing cost and time). Create snapshots before risky operations: database upgrades, application deployments, or infrastructure changes. Snapshot lifecycle policies automatically delete old snapshots.

RDS automated backups enable point-in-time recovery. RDS retains automated backups for a configurable period (1 to 35 days). When enabled, RDS performs daily snapshots and captures transaction logs. Restore to any second within the retention window. Automated backups are deleted when the RDS instance is deleted unless a final snapshot is taken.

RDS manual snapshots are permanent until explicitly deleted. Create manual snapshots before major changes. Unlike automated backups, manual snapshots persist independently of the RDS instance. Share snapshots across accounts for DR or testing.

DynamoDB on-demand backup creates full table backups instantly. On-demand backups have no performance impact and are available immediately. Restore to a new table in the same or different account. On-demand backups are retained until explicitly deleted.

Snapshot best practices: Tag all snapshots with Environment, BackupType, and RetentionDate. Use lifecycle policies to automatically clean up expired snapshots. Copy critical snapshots to another region for DR. Encrypt snapshots using KMS customer-managed keys for compliance.

Retention policies balance cost against recovery requirements and compliance. Too short risks missing data recovery needs; too long wastes storage costs. Design retention based on use case:

Operational backups (30-90 days): Daily backups with 30-day retention for operational recovery. A developer accidentally deletes a table on Monday; restore from Friday's backup. Weekly backups with 90-day retention for catching less recent issues.

Compliance backups (1-7 years): Financial records, healthcare data, and government contracts often require specific retention periods. SOC 2 may require 1 year; HIPAA requires 6 years; PCI DSS requires 1 year. Tag compliance backups separately and apply longer retention.

Archive backups (indefinite or very long): Legal holds, intellectual property, or regulatory requirements may demand indefinite retention. Transition to Glacier Deep Archive for cost-effective long-term storage. A 1TB backup in S3 Standard costs $23/month; the same backup in Glacier Deep Archive costs $1/month.

Cross-account backup creates backups in a dedicated backup account. This isolates backup data from production accounts, preventing accidental deletion. An organization backup account receives backups from all member accounts. Apply strict access policies: only the backup team can restore; no one can delete.

Cross-account architecture: Member accounts send backups to a central backup vault in the backup account using AWS Organizations backup policies. The backup account applies its own KMS keys for encryption. Restore operations require cross-account IAM roles. This provides an air gap between production and backup data.

Backup validation: Verify that backups can actually be restored. AWS Backup supports restore testing: schedule automated restore tests that create temporary resources from backups, verify data integrity, then clean up. Failed tests trigger alerts. This catches backup corruption before you need to recover.