Why is DynamoDB backup more expensive than EBS or EFS backup?

DynamoDB backup pricing reflects the service architecture. On-demand DynamoDB backups are billed at $0.10/GB-month warm storage with $0.30/GB restore fees; continuous backups (PITR — point-in-time recovery) bill $0.20/GB-month of source table data. EFS warm backup is $0.05/GB-month and RDS/Aurora snapshots pass through at the native EBS snapshot rate of $0.05/GB-month. The DynamoDB premium pays for the operational simplicity of fully-managed PITR; for cost-sensitive workloads with predictable backup windows, on-demand backups are roughly half the price of continuous backups for the same effective recovery point.

What is the 90-day minimum retention penalty on cold storage?

AWS Backup Vault cold storage at $0.0125/GB-month (75% cheaper than warm storage at $0.05/GB-month) requires a 90-day minimum storage commitment. Recovery points deleted or transitioned out before 90 days bill the remaining days as if they had stayed for the full 90. This is similar to S3 Glacier pricing structure. The implication: only transition to cold storage with retention plans that exceed 90 days. Transitioning a 30-day-retained backup to cold storage immediately is a billing trap — you pay the 90-day equivalent without getting the saving.

How does cross-region backup copy pricing work?

Cross-region backup copy charges three lines: the inter-region data transfer at $0.02/GB, the destination region recovery point storage at the standard warm/cold rates, and (for some services) a small per-recovery-point copy fee. A 500 GB recovery point copied from us-east-1 to us-west-2 costs $10 for the transfer plus the destination-region storage as it accrues. Multi-destination DR (copying to two or more secondary regions) multiplies linearly. Right-size the cross-region replica set to the regions that actually serve as DR targets, not "every region we have a foothold in."

Is cross-account backup copy free?

Yes — AWS Backup cross-account copies do not incur inter-account transfer fees. The destination account pays the standard recovery point storage rates; the source account pays the standard source-side storage and operational charges. This makes cross-account backup vaults the right pattern for compliance segregation: production backups copied to a dedicated security/compliance account with restrictive IAM and Vault Lock policies. The compliance benefits (separate blast radius, immutability via Vault Lock) come at no per-copy transfer cost.

What does Backup Audit Manager actually cost?

Backup Audit Manager bills $0.60 per control evaluation per resource per month. A typical framework with 10 controls evaluated on 200 resources costs $1,200/month. Frameworks scale with both control count and protected resource count. The waste pattern is enabling broad frameworks (the prebuilt PCI / HIPAA / SOC2 frameworks) when only a subset of controls applies to your workload. Build a custom framework with only the controls you actually report against; the bill drops proportionally.

How do retention policies affect the warm-to-cold transition economics?

Warm storage at $0.05/GB-month is 4× more expensive than cold at $0.0125/GB-month. For backups retained beyond 90 days, transitioning to cold storage saves 75% on storage from the transition date forward. A backup with 7-year retention transitioned to cold after 30 days saves roughly $3.50 per GB over the lifecycle compared to staying warm. The right policy for most use cases: 14–30 days warm (covers operational restore needs), then transition to cold for the long-tail retention. Set this at the backup plan level, not per-resource, to apply consistently.

Why does the bill show backup costs under the underlying service rather than under AWS Backup?

AWS Backup bill items typically appear under the underlying service rate sheet (EBS snapshots, RDS snapshots, etc.) rather than as a single "AWS Backup" line. This is because AWS Backup is largely orchestration on top of the native snapshot mechanisms for each service. The exceptions are AWS Backup-native features (continuous backup for DynamoDB, vault storage with cold-tier transitions, Backup Audit Manager, cross-region copies) which appear under "AWS Backup" in the Cost Explorer. For comprehensive backup cost analysis, filter by both the service-native snapshot lines AND the AWS Backup line.

AWS Backup Pricing: Warm, Cold, Cross-Region, Audit Manager

AWS Backup is the orchestration layer that wraps every AWS storage and database service into a unified backup model with backup plans, vaults, and lifecycle policies. The bill is structured oddly: most line items appear under the underlying service rate sheet (EBS snapshots, RDS snapshots) rather than under AWS Backup, while the AWS Backup-native features — continuous backup for DynamoDB, cold storage tier, cross-region copies, Backup Audit Manager — appear as a separate “AWS Backup” line in Cost Explorer. Optimizing the bill requires looking at both lines together.

This post is the bill story. For the operational architecture — backup plans, vault design, restore testing, IAM for backup operators — see our AWS Backup strategies guide.

The Seven AWS Backup Billing Dimensions

AWS Backup pricing breakdown — us-east-1, June 2026

Prices in us-east-1

Each underlying service has its own backup rate. The cold-tier minimum and cross-region copy are the most consequential bill amplifiers.

Dimension	Unit price	Example workload	Monthly cost
EFS warm storage Recovery point storage	$0.05 / GB-month	500 GB EFS backed up	$25
DynamoDB on-demand backup Per-backup snapshot economics	$0.10 / GB-month warm + $0.30/GB restore	200 GB table, daily backup	$20 + restore
DynamoDB continuous backup (PITR) 2× on-demand rate; full PITR convenience	$0.20 / GB-month of source table	200 GB table	$40
EBS snapshots Native EBS pricing; passthrough	$0.05 / GB-month	Daily snapshots, 1 TB volume	Incremental — see EBS post
RDS / Aurora snapshots Free up to provisioned storage size	$0.05 / GB-month (above free tier)	500 GB RDS instance	~$25
S3 backup (Object Lock vault) Vault Lock for WORM compliance	$0.05 / GB-month	100 GB compliance retention	$5
Cold storage tier 90-day minimum; supported services only	$0.0125 / GB-month	5 TB long-tail retention	$62.50
Cross-region copy transfer Plus destination-region storage	$0.02 / GB	500 GB / month copied	$10
Cross-account copy No inter-account transfer fee	Free transfer	Backup to security account	Only destination storage
Backup Audit Manager Custom frameworks reduce scope	$0.60 / control evaluation / resource	10 controls × 200 resources	$1,200
Restore (per service) Free for many services; verify per service	Service-dependent	DynamoDB $0.15/GB restored	Variable by recovery

EFS warm storage

$25

Recovery point storage

Unit price: $0.05 / GB-month
Example workload: 500 GB EFS backed up

DynamoDB on-demand backup

$20 + restore

Per-backup snapshot economics

Unit price: $0.10 / GB-month warm + $0.30/GB restore
Example workload: 200 GB table, daily backup

DynamoDB continuous backup (PITR)

$40

2× on-demand rate; full PITR convenience

Unit price: $0.20 / GB-month of source table
Example workload: 200 GB table

EBS snapshots

Incremental — see EBS post

Native EBS pricing; passthrough

Unit price: $0.05 / GB-month
Example workload: Daily snapshots, 1 TB volume

RDS / Aurora snapshots

~$25

Free up to provisioned storage size

Unit price: $0.05 / GB-month (above free tier)
Example workload: 500 GB RDS instance

S3 backup (Object Lock vault)

Vault Lock for WORM compliance

Unit price: $0.05 / GB-month
Example workload: 100 GB compliance retention

Cold storage tier

$62.50

90-day minimum; supported services only

Unit price: $0.0125 / GB-month
Example workload: 5 TB long-tail retention

Cross-region copy transfer

$10

Plus destination-region storage

Unit price: $0.02 / GB
Example workload: 500 GB / month copied

Cross-account copy

Only destination storage

No inter-account transfer fee

Unit price: Free transfer
Example workload: Backup to security account

Backup Audit Manager

$1,200

Custom frameworks reduce scope

Unit price: $0.60 / control evaluation / resource
Example workload: 10 controls × 200 resources

Restore (per service)

Variable by recovery

Free for many services; verify per service

Unit price: Service-dependent
Example workload: DynamoDB $0.15/GB restored

The 'AWS Backup' line in Cost Explorer captures continuous backup, cold storage, cross-region, and Audit Manager. Native snapshot costs (EBS, RDS, etc.) appear under those services.

The Cold-Tier 90-Day Minimum Trap

Cold storage at $0.0125/GB-month is 75% cheaper than warm storage at $0.05/GB-month — but with a 90-day minimum storage commitment. If a recovery point is deleted or transitioned out before 90 days in cold, you pay the remaining days as if it had stayed.

The implication: only transition recovery points to cold when the retention exceeds 90 days. A 30-day-retained backup transitioned immediately to cold pays the equivalent of 90 days at cold rates — more expensive than just staying in warm storage for 30 days.

The right backup plan lifecycle for typical workloads:

First 14–30 days: warm storage. Covers operational restore needs (most restores happen within the first week of the incident).
Beyond 30 days: transition to cold for long-tail retention.
Beyond 7 years: depending on compliance, transition out via lifecycle rules or move to S3 Glacier Deep Archive via a custom workflow.

Cross-Region Copy: Double Storage + Transfer

Cross-region copy is the canonical disaster-recovery pattern: snapshot in the primary region, copy to a secondary region, retain in both. The bill triples (or more):

Source region storage: standard per-GB-month rate.
Destination region storage: same per-GB-month rate, charged independently.
Inter-region data transfer: $0.02/GB on every byte copied (incremental copies still bill on the changed-block size).

For a 500 GB workload with a 35-day retention and daily backup copies to one secondary region:

Source-region warm storage: ~$25/month (incremental)
Destination-region warm storage: ~$25/month
Cross-region transfer: ~500 GB/month × $0.02 = ~$10/month (after initial seed)
Total: ~$60/month vs ~$25 for source-region-only

For multi-region DR with two secondary regions, the math triples again. Right-size the secondary-region set to documented DR targets, not “all regions we operate in.”

DynamoDB Continuous Backup: Convenience Premium

DynamoDB Continuous Backup (Point-in-Time Recovery, PITR) bills $0.20/GB-month based on the size of the source table. This is 2× the on-demand backup warm storage rate ($0.10/GB-month) but provides per-second recoverability over the last 35 days.

The break-even is operational. PITR is correct when:

The business requires per-second recovery granularity (financial transactions, ordered event sourcing).
The team prefers fully-managed PITR over operating a daily backup schedule.
Restore exercises are frequent enough that the on-demand restore fees ($0.15/GB on DynamoDB) would exceed the PITR premium.

For cost-sensitive workloads with predictable backup windows, on-demand backups at $0.10/GB-month warm storage with $0.30/GB restore (rarely invoked) are roughly half the price.

Backup Audit Manager: Per-Control × Per-Resource

Backup Audit Manager evaluates backup configurations against compliance frameworks (PCI, HIPAA, SOC2, custom) and reports drift. It bills $0.60 per control evaluation per resource per month — a multiplicative line that scales with both framework complexity and protected resource count.

The waste pattern: enabling the prebuilt frameworks wholesale when only a subset applies. A custom framework with 5 controls evaluated on 200 resources is $600/month; enabling the full prebuilt HIPAA framework with 25 controls on the same 200 resources is $3,000/month. Build custom frameworks scoped to the specific controls you actually report against.

The Vault Architecture Decision

Backup vaults are containers for recovery points with access control (vault policies), encryption (KMS key per vault), and optional Vault Lock for WORM compliance. Vaults themselves have no per-vault charge — the storage of recovery points in the vault is what bills.

The architecture choices:

Single vault per account/region. Operationally simple, single IAM policy surface.
Vault per workload tier. Production vault, dev vault, etc. Enables granular retention policies and access control.
Cross-account compliance vault. Production backups copied to a dedicated security account with restrictive Vault Lock — the canonical pattern for regulated workloads.
Vault per data sensitivity class. PII vault, PHI vault, etc. with KMS keys scoped to the sensitivity class.

The cost differential is small (no per-vault charge); the operational and compliance differential is significant. For most production deployments, the cross-account compliance vault is the right pattern.

When to Use AWS Backup vs Service-Native Backups

AWS Backup for unified policy across services; service-native backups for single-service workloads or extreme cost sensitivity.

Use when

Multi-service workloads where unified backup policy, retention, and lifecycle matter operationally
Compliance-regulated workloads requiring Vault Lock for WORM retention
Cross-account backup architecture for security segregation
DynamoDB continuous backup (PITR) when per-second recovery granularity is required
Cold-tier transitions for long-tail retention (>90 days)
Cross-region DR with managed lifecycle and policy enforcement

Avoid when

Single-service workloads (just EBS, or just RDS) where the native snapshot lifecycle covers the use case at lower complexity
Cold-tier transitions on retention periods under 90 days — pay the minimum penalty
Cross-region copies to regions with no DR consumer
Audit Manager prebuilt frameworks at full breadth when only a subset applies
DynamoDB PITR for workloads where daily on-demand backups would suffice (and save 50%)

AWS Backup's value is unified policy across services. If the policy is simple and the service set is small, native snapshots may be cheaper.

A 30-Day AWS Backup Bill Cleanup Plan

Week 1 — Lifecycle audit. Find every backup plan with cold-tier transitions. Verify each has retention >90 days. Remove cold transitions on shorter-retention plans.

Week 2 — Cross-region scope. List every cross-region copy rule. Map destination regions to actual DR targets. Remove copy rules to regions with no DR runbook.

Week 3 — DynamoDB PITR vs on-demand. Audit DynamoDB tables with PITR enabled. Evaluate whether per-second recoverability is operationally required. Switch tables where on-demand daily backup would suffice.

Week 4 — Audit Manager scope. List frameworks and their evaluated controls. Build custom frameworks scoped to actually-reported controls. Disable broad prebuilt frameworks where the custom replacement covers the use case.

What This Post Doesn’t Cover

Cross-Region DR runbook design — operational architecture covered in our AWS Backup strategies guide.
Service-native snapshot pricing for EBS, RDS, etc. in depth — covered in the respective service pricing posts.
Storage Gateway backup integration — separate use case with hybrid pricing implications.
Backup for hybrid / on-premises workloads via Storage Gateway and Backup Gateway — covered in hybrid-architecture content.

If You Only Do One Thing This Week

Audit your backup plans for cold-tier transitions on retention periods under 90 days. Run aws backup list-backup-plans followed by aws backup get-backup-plan --backup-plan-id <id> for each plan; check the Lifecycle.MoveToColdStorageAfterDays and Lifecycle.DeleteAfterDays fields. If DeleteAfterDays - MoveToColdStorageAfterDays < 90, the cold transition costs more than staying warm. Remove the cold transition step or extend the retention. The change is one IaC edit per plan and immediately stops the 90-day minimum penalty from accumulating.

For the broader operational architecture — vault design, restore testing, IAM for backup operators — the AWS Backup strategies guide covers the design side.

AWS Backup Pricing: Warm Storage, Cold Tier 90-Day Minimum, and the Cross-Region Double Bill

The Seven AWS Backup Billing Dimensions