---
title: AWS Backup Pricing: Warm Storage, Cold Tier 90-Day Minimum, and the Cross-Region Double Bill
description: AWS Backup bills per service-specific rate — EFS warm at $0.05/GB-month, DynamoDB continuous backup at $0.20/GB-month, cold storage at $0.0125/GB-month with a 90-day minimum retention penalty. Cross-region copies double the storage line plus $0.02/GB transfer. Backup Audit Manager bills per control per resource and quietly accumulates.
url: https://www.factualminds.com/blog/aws-backup-pricing-vaults-cross-region-restores/
datePublished: 2026-06-13T00:00:00.000Z
dateModified: 2026-06-13T00:00:00.000Z
author: palaniappan-p
category: Cost Optimization & FinOps
tags: aws-backup, backup-pricing, aws-pricing, cost-optimization, finops, data-protection
---

# AWS Backup Pricing: Warm Storage, Cold Tier 90-Day Minimum, and the Cross-Region Double Bill

> AWS Backup bills per service-specific rate — EFS warm at $0.05/GB-month, DynamoDB continuous backup at $0.20/GB-month, cold storage at $0.0125/GB-month with a 90-day minimum retention penalty. Cross-region copies double the storage line plus $0.02/GB transfer. Backup Audit Manager bills per control per resource and quietly accumulates.

import PricingHeroStats from '~/components/blog/PricingHeroStats.astro';
import PricingDimensionTable from '~/components/blog/PricingDimensionTable.astro';
import BillSurpriseCallout from '~/components/blog/BillSurpriseCallout.astro';
import PricingDecisionCard from '~/components/blog/PricingDecisionCard.astro';

AWS Backup is the orchestration layer that wraps every AWS storage and database service into a unified backup model with backup plans, vaults, and lifecycle policies. The bill is structured oddly: most line items appear under the underlying service rate sheet (EBS snapshots, RDS snapshots) rather than under AWS Backup, while the AWS Backup-native features — continuous backup for DynamoDB, cold storage tier, cross-region copies, Backup Audit Manager — appear as a separate "AWS Backup" line in Cost Explorer. Optimizing the bill requires looking at both lines together.

<PricingHeroStats
  stats={[
    { value: '$0.05', label: 'Warm / GB-month (EFS)', note: 'Service-specific; native snapshot rates' },
    { value: '$0.0125', label: 'Cold / GB-month', note: '75% cheaper; 90-day minimum retention' },
    { value: '$0.20', label: 'DynamoDB PITR / GB-month', note: 'Continuous backup; 2× on-demand rate' },
    { value: '$0.60', label: 'Audit Manager / control / resource', note: 'Scales with frameworks × resources' },
  ]}
  caption="us-east-1 list prices, June 2026. Verify against the AWS Backup pricing page for your region."
/>

This post is the bill story. For the operational architecture — backup plans, vault design, restore testing, IAM for backup operators — see our [AWS Backup strategies guide](/blog/aws-backup-strategies-automated-data-protection/).

## The Seven AWS Backup Billing Dimensions

<PricingDimensionTable
  title="AWS Backup pricing breakdown — us-east-1, June 2026"
  intro="Each underlying service has its own backup rate. The cold-tier minimum and cross-region copy are the most consequential bill amplifiers."
  region="us-east-1"
  dimensions={[
    {
      name: 'EFS warm storage',
      unitPrice: '$0.05 / GB-month',
      example: '500 GB EFS backed up',
      monthly: '$25',
      note: 'Recovery point storage',
      highlight: true,
    },
    {
      name: 'DynamoDB on-demand backup',
      unitPrice: '$0.10 / GB-month warm + $0.30/GB restore',
      example: '200 GB table, daily backup',
      monthly: '$20 + restore',
      note: 'Per-backup snapshot economics',
    },
    {
      name: 'DynamoDB continuous backup (PITR)',
      unitPrice: '$0.20 / GB-month of source table',
      example: '200 GB table',
      monthly: '$40',
      note: '2× on-demand rate; full PITR convenience',
      highlight: true,
    },
    {
      name: 'EBS snapshots',
      unitPrice: '$0.05 / GB-month',
      example: 'Daily snapshots, 1 TB volume',
      monthly: 'Incremental — see EBS post',
      note: 'Native EBS pricing; passthrough',
    },
    {
      name: 'RDS / Aurora snapshots',
      unitPrice: '$0.05 / GB-month (above free tier)',
      example: '500 GB RDS instance',
      monthly: '~$25',
      note: 'Free up to provisioned storage size',
    },
    {
      name: 'S3 backup (Object Lock vault)',
      unitPrice: '$0.05 / GB-month',
      example: '100 GB compliance retention',
      monthly: '$5',
      note: 'Vault Lock for WORM compliance',
    },
    {
      name: 'Cold storage tier',
      unitPrice: '$0.0125 / GB-month',
      example: '5 TB long-tail retention',
      monthly: '$62.50',
      note: '90-day minimum; supported services only',
      highlight: true,
    },
    {
      name: 'Cross-region copy transfer',
      unitPrice: '$0.02 / GB',
      example: '500 GB / month copied',
      monthly: '$10',
      note: 'Plus destination-region storage',
      highlight: true,
    },
    {
      name: 'Cross-account copy',
      unitPrice: 'Free transfer',
      example: 'Backup to security account',
      monthly: 'Only destination storage',
      note: 'No inter-account transfer fee',
    },
    {
      name: 'Backup Audit Manager',
      unitPrice: '$0.60 / control evaluation / resource',
      example: '10 controls × 200 resources',
      monthly: '$1,200',
      note: 'Custom frameworks reduce scope',
    },
    {
      name: 'Restore (per service)',
      unitPrice: 'Service-dependent',
      example: 'DynamoDB $0.15/GB restored',
      monthly: 'Variable by recovery',
      note: 'Free for many services; verify per service',
    },
  ]}
  footnote="The 'AWS Backup' line in Cost Explorer captures continuous backup, cold storage, cross-region, and Audit Manager. Native snapshot costs (EBS, RDS, etc.) appear under those services."
/>

## The Cold-Tier 90-Day Minimum Trap

Cold storage at $0.0125/GB-month is 75% cheaper than warm storage at $0.05/GB-month — but with a 90-day minimum storage commitment. If a recovery point is deleted or transitioned out before 90 days in cold, you pay the remaining days as if it had stayed.

The implication: only transition recovery points to cold when the retention exceeds 90 days. A 30-day-retained backup transitioned immediately to cold pays the equivalent of 90 days at cold rates — more expensive than just staying in warm storage for 30 days.

The right backup plan lifecycle for typical workloads:

- **First 14–30 days**: warm storage. Covers operational restore needs (most restores happen within the first week of the incident).
- **Beyond 30 days**: transition to cold for long-tail retention.
- **Beyond 7 years**: depending on compliance, transition out via lifecycle rules or move to S3 Glacier Deep Archive via a custom workflow.

<BillSurpriseCallout
  variant="trap"
  title="Backup plan with 14-day retention configured to transition to cold immediately"
  amount="3× the warm-only cost"
>
  The 90-day minimum penalty means the cold transition wastes money. Either remove the cold transition step or extend
  the retention beyond 90 days. The Backup plan editor in the AWS console doesn't warn about this; the bill arrives at
  month-end.
</BillSurpriseCallout>

## Cross-Region Copy: Double Storage + Transfer

Cross-region copy is the canonical disaster-recovery pattern: snapshot in the primary region, copy to a secondary region, retain in both. The bill triples (or more):

- **Source region storage**: standard per-GB-month rate.
- **Destination region storage**: same per-GB-month rate, charged independently.
- **Inter-region data transfer**: $0.02/GB on every byte copied (incremental copies still bill on the changed-block size).

For a 500 GB workload with a 35-day retention and daily backup copies to one secondary region:

- Source-region warm storage: ~$25/month (incremental)
- Destination-region warm storage: ~$25/month
- Cross-region transfer: ~500 GB/month × $0.02 = ~$10/month (after initial seed)
- Total: ~$60/month vs ~$25 for source-region-only

For multi-region DR with two secondary regions, the math triples again. Right-size the secondary-region set to documented DR targets, not "all regions we operate in."

## DynamoDB Continuous Backup: Convenience Premium

DynamoDB Continuous Backup (Point-in-Time Recovery, PITR) bills $0.20/GB-month based on the size of the source table. This is 2× the on-demand backup warm storage rate ($0.10/GB-month) but provides per-second recoverability over the last 35 days.

The break-even is operational. PITR is correct when:

- The business requires per-second recovery granularity (financial transactions, ordered event sourcing).
- The team prefers fully-managed PITR over operating a daily backup schedule.
- Restore exercises are frequent enough that the on-demand restore fees ($0.15/GB on DynamoDB) would exceed the PITR premium.

For cost-sensitive workloads with predictable backup windows, on-demand backups at $0.10/GB-month warm storage with $0.30/GB restore (rarely invoked) are roughly half the price.

## Backup Audit Manager: Per-Control × Per-Resource

Backup Audit Manager evaluates backup configurations against compliance frameworks (PCI, HIPAA, SOC2, custom) and reports drift. It bills $0.60 per control evaluation per resource per month — a multiplicative line that scales with both framework complexity and protected resource count.

The waste pattern: enabling the prebuilt frameworks wholesale when only a subset applies. A custom framework with 5 controls evaluated on 200 resources is $600/month; enabling the full prebuilt HIPAA framework with 25 controls on the same 200 resources is $3,000/month. Build custom frameworks scoped to the specific controls you actually report against.

<BillSurpriseCallout
  variant="trap"
  title="Backup Audit Manager with prebuilt frameworks at full breadth"
  amount="$1K–$10K/month per environment"
>
  Audit which controls are actually used in compliance reporting. Disable the unused ones. Build a custom framework with
  only the load-bearing controls. The audit value is preserved; the bill drops proportionally to the unused-control
  share.
</BillSurpriseCallout>

## The Vault Architecture Decision

Backup vaults are containers for recovery points with access control (vault policies), encryption (KMS key per vault), and optional Vault Lock for WORM compliance. Vaults themselves have no per-vault charge — the storage of recovery points in the vault is what bills.

The architecture choices:

1. **Single vault per account/region.** Operationally simple, single IAM policy surface.
2. **Vault per workload tier.** Production vault, dev vault, etc. Enables granular retention policies and access control.
3. **Cross-account compliance vault.** Production backups copied to a dedicated security account with restrictive Vault Lock — the canonical pattern for regulated workloads.
4. **Vault per data sensitivity class.** PII vault, PHI vault, etc. with KMS keys scoped to the sensitivity class.

The cost differential is small (no per-vault charge); the operational and compliance differential is significant. For most production deployments, the cross-account compliance vault is the right pattern.

## When to Use AWS Backup vs Service-Native Backups

<PricingDecisionCard
  headline="AWS Backup for unified policy across services; service-native backups for single-service workloads or extreme cost sensitivity."
  useWhen={[
    'Multi-service workloads where unified backup policy, retention, and lifecycle matter operationally',
    'Compliance-regulated workloads requiring Vault Lock for WORM retention',
    'Cross-account backup architecture for security segregation',
    'DynamoDB continuous backup (PITR) when per-second recovery granularity is required',
    'Cold-tier transitions for long-tail retention (>90 days)',
    'Cross-region DR with managed lifecycle and policy enforcement',
  ]}
  avoidWhen={[
    'Single-service workloads (just EBS, or just RDS) where the native snapshot lifecycle covers the use case at lower complexity',
    'Cold-tier transitions on retention periods under 90 days — pay the minimum penalty',
    'Cross-region copies to regions with no DR consumer',
    'Audit Manager prebuilt frameworks at full breadth when only a subset applies',
    'DynamoDB PITR for workloads where daily on-demand backups would suffice (and save 50%)',
  ]}
  footnote="AWS Backup's value is unified policy across services. If the policy is simple and the service set is small, native snapshots may be cheaper."
/>

## A 30-Day AWS Backup Bill Cleanup Plan

**Week 1 — Lifecycle audit.** Find every backup plan with cold-tier transitions. Verify each has retention >90 days. Remove cold transitions on shorter-retention plans.

**Week 2 — Cross-region scope.** List every cross-region copy rule. Map destination regions to actual DR targets. Remove copy rules to regions with no DR runbook.

**Week 3 — DynamoDB PITR vs on-demand.** Audit DynamoDB tables with PITR enabled. Evaluate whether per-second recoverability is operationally required. Switch tables where on-demand daily backup would suffice.

**Week 4 — Audit Manager scope.** List frameworks and their evaluated controls. Build custom frameworks scoped to actually-reported controls. Disable broad prebuilt frameworks where the custom replacement covers the use case.

## What This Post Doesn't Cover

- **Cross-Region DR runbook design** — operational architecture covered in our [AWS Backup strategies guide](/blog/aws-backup-strategies-automated-data-protection/).
- **Service-native snapshot pricing for EBS, RDS, etc. in depth** — covered in the respective service pricing posts.
- **Storage Gateway backup integration** — separate use case with hybrid pricing implications.
- **Backup for hybrid / on-premises workloads** via Storage Gateway and Backup Gateway — covered in hybrid-architecture content.

## If You Only Do One Thing This Week

Audit your backup plans for cold-tier transitions on retention periods under 90 days. Run `aws backup list-backup-plans` followed by `aws backup get-backup-plan --backup-plan-id <id>` for each plan; check the `Lifecycle.MoveToColdStorageAfterDays` and `Lifecycle.DeleteAfterDays` fields. If `DeleteAfterDays - MoveToColdStorageAfterDays < 90`, the cold transition costs more than staying warm. Remove the cold transition step or extend the retention. The change is one IaC edit per plan and immediately stops the 90-day minimum penalty from accumulating.

For the broader operational architecture — vault design, restore testing, IAM for backup operators — the [AWS Backup strategies guide](/blog/aws-backup-strategies-automated-data-protection/) covers the design side.

## FAQ

### Why is DynamoDB backup more expensive than EBS or EFS backup?
DynamoDB backup pricing reflects the service architecture. On-demand DynamoDB backups are billed at $0.10/GB-month warm storage with $0.30/GB restore fees; continuous backups (PITR — point-in-time recovery) bill $0.20/GB-month of source table data. EFS warm backup is $0.05/GB-month and RDS/Aurora snapshots pass through at the native EBS snapshot rate of $0.05/GB-month. The DynamoDB premium pays for the operational simplicity of fully-managed PITR; for cost-sensitive workloads with predictable backup windows, on-demand backups are roughly half the price of continuous backups for the same effective recovery point.

### What is the 90-day minimum retention penalty on cold storage?
AWS Backup Vault cold storage at $0.0125/GB-month (75% cheaper than warm storage at $0.05/GB-month) requires a 90-day minimum storage commitment. Recovery points deleted or transitioned out before 90 days bill the remaining days as if they had stayed for the full 90. This is similar to S3 Glacier pricing structure. The implication: only transition to cold storage with retention plans that exceed 90 days. Transitioning a 30-day-retained backup to cold storage immediately is a billing trap — you pay the 90-day equivalent without getting the saving.

### How does cross-region backup copy pricing work?
Cross-region backup copy charges three lines: the inter-region data transfer at $0.02/GB, the destination region recovery point storage at the standard warm/cold rates, and (for some services) a small per-recovery-point copy fee. A 500 GB recovery point copied from us-east-1 to us-west-2 costs $10 for the transfer plus the destination-region storage as it accrues. Multi-destination DR (copying to two or more secondary regions) multiplies linearly. Right-size the cross-region replica set to the regions that actually serve as DR targets, not "every region we have a foothold in."

### Is cross-account backup copy free?
Yes — AWS Backup cross-account copies do not incur inter-account transfer fees. The destination account pays the standard recovery point storage rates; the source account pays the standard source-side storage and operational charges. This makes cross-account backup vaults the right pattern for compliance segregation: production backups copied to a dedicated security/compliance account with restrictive IAM and Vault Lock policies. The compliance benefits (separate blast radius, immutability via Vault Lock) come at no per-copy transfer cost.

### What does Backup Audit Manager actually cost?
Backup Audit Manager bills $0.60 per control evaluation per resource per month. A typical framework with 10 controls evaluated on 200 resources costs $1,200/month. Frameworks scale with both control count and protected resource count. The waste pattern is enabling broad frameworks (the prebuilt PCI / HIPAA / SOC2 frameworks) when only a subset of controls applies to your workload. Build a custom framework with only the controls you actually report against; the bill drops proportionally.

### How do retention policies affect the warm-to-cold transition economics?
Warm storage at $0.05/GB-month is 4× more expensive than cold at $0.0125/GB-month. For backups retained beyond 90 days, transitioning to cold storage saves 75% on storage from the transition date forward. A backup with 7-year retention transitioned to cold after 30 days saves roughly $3.50 per GB over the lifecycle compared to staying warm. The right policy for most use cases: 14–30 days warm (covers operational restore needs), then transition to cold for the long-tail retention. Set this at the backup plan level, not per-resource, to apply consistently.

### Why does the bill show backup costs under the underlying service rather than under AWS Backup?
AWS Backup bill items typically appear under the underlying service rate sheet (EBS snapshots, RDS snapshots, etc.) rather than as a single "AWS Backup" line. This is because AWS Backup is largely orchestration on top of the native snapshot mechanisms for each service. The exceptions are AWS Backup-native features (continuous backup for DynamoDB, vault storage with cold-tier transitions, Backup Audit Manager, cross-region copies) which appear under "AWS Backup" in the Cost Explorer. For comprehensive backup cost analysis, filter by both the service-native snapshot lines AND the AWS Backup line.

---

*Source: https://www.factualminds.com/blog/aws-backup-pricing-vaults-cross-region-restores/*