AWS Backup Plans and Policies

AWS Backup is a centralized, fully managed service that enables you to define backup policies (backup plans) and apply them to AWS resources across multiple services and accounts. Before AWS Backup, each service (RDS, EBS, DynamoDB, etc.) had its own backup mechanisms, leading to inconsistent schedules, retention policies, and monitoring. AWS Backup unifies these into a single service, providing a single place to manage backups, automate scheduling, enforce compliance, and restore data.

AWS Backup operates through a combination of backup plans, backup vaults, and backup policies. A backup plan defines the schedule, lifecycle, and backup window for creating recovery points. When you assign resources (e.g., EC2 instances, RDS databases) to a backup plan, AWS Backup triggers backup jobs according to the schedule. Each backup job creates a recovery point (a snapshot or backup) in a backup vault. The vault is a logical container that stores recovery points, and it can be encrypted with AWS KMS keys. Lifecycle rules automatically transition recovery points from a warm tier (standard storage) to a cold tier (Amazon S3 Glacier) after a specified number of days, and then expire them after a retention period. Backup policies (AWS Organizations-based) allow you to deploy backup plans across multiple accounts in an organization, enforcing compliance at scale.

- Backup Plan: Contains one or more backup rules. Each rule specifies: - Schedule: Can be hourly, daily, weekly, or custom cron expression. Default: daily at 5:00 AM UTC. - Lifecycle: Transition to cold storage after N days (default: 30 days, min 0), expire after M days (default: 35 days, min 1). - Backup Vault: The vault where recovery points are stored. You can create multiple vaults (e.g., per environment). - Backup Window: The time window during which the backup job must start (e.g., 1 hour). Default: 8 hours. - IAM Role: The role that AWS Backup assumes to create backups. You must provide an IAM role with appropriate permissions. - Backup Vault: Stores recovery points. Can have a vault lock (compliance or governance mode) to prevent deletion. Default: no lock. - Backup Policy: An SCP-like policy applied via AWS Organizations to enforce backup plans on member accounts. - Recovery Point: A snapshot or backup of a resource. Stored in the vault. Can be encrypted. - Default Values:

To create a backup plan using AWS CLI:

aws backup create-backup-plan --backup-plan file://plan.json

Example plan.json:

{
  "BackupPlanName": "Daily-30DayRetention",
  "Rules": [
    {
      "RuleName": "DailyBackup",
      "TargetBackupVaultName": "MyVault",
      "ScheduleExpression": "cron(0 5 * * ? *)",
      "StartWindowMinutes": 60,
      "CompletionWindowMinutes": 120,
      "Lifecycle": {
        "DeleteAfterDays": 30
      }
    }
  ]
}

To assign resources to a backup plan:

aws backup create-backup-plan --backup-plan-arn arn:aws:backup:region:account:backup-plan:plan-id --resources arn:aws:ec2:region:account:volume/vol-xxx

To list backup jobs:

aws backup list-backup-jobs --by-state COMPLETED

To restore a recovery point:

aws backup start-restore-job --recovery-point-arn arn:aws:backup:region:account:recovery-point:point-id --metadata file://metadata.json

AWS Backup provides a unified backup solution across AWS services. Understanding backup plans, vaults, lifecycle policies, and IAM permissions is critical for the SOA-C02 exam. Pay special attention to default values, cross-account/cross-region backup, vault lock, and common failure modes.

In a large enterprise with hundreds of EC2 instances, RDS databases, and EFS file systems across multiple AWS accounts, managing backups manually is impossible. AWS Backup centralizes backup management. For example, a financial services company uses AWS Backup to enforce a 35-day retention policy on all production databases. They create a backup plan with a daily schedule and a lifecycle that transitions recovery points to cold storage after 30 days. They assign the plan to all RDS instances using a tag Environment=Production. The backup vault is encrypted with a KMS key managed by the security team. They also enable vault lock in compliance mode to prevent any deletion of recovery points before the retention period expires, satisfying regulatory requirements. Another scenario: a SaaS provider uses cross-region backup to replicate recovery points to a secondary region for disaster recovery. They configure a copy action in the backup rule to copy recovery points to a vault in another region. The source vault must allow cross-region copies via a vault access policy. They also use AWS Organizations backup policies to deploy the same backup plan to all member accounts, ensuring consistent backup coverage. Common issues include: backup jobs failing due to insufficient IAM permissions (e.g., missing ec2:CreateSnapshot), backup window too small for large databases (e.g., a 1 TB RDS instance may take hours to back up), and cold storage restores taking too long (up to 12 hours for Glacier). To troubleshoot, engineers check CloudWatch logs and backup job status, and adjust the backup window or IAM role as needed.