AWS Backup Strategies: Automated Data Protection

Data loss is permanent. A deleted database, a corrupted S3 bucket, a ransomware attack — without backups, recovery is impossible. Per-service snapshots (RDS, EBS, DynamoDB PITR) without a central plan produce inconsistent policies, missed resources, and untested restores.

As of July 19, 2026, AWS Backup remains the control plane for plans, vaults, copies, and restore testing. Treat Vault Lock, logically air-gapped vaults (immutable copies in a service-owned account, optional CMK, RAM share / Multi-party approval for recovery when the source account is compromised), and primary backups into air-gapped vaults as first-class options for ransomware-resistant designs — verify current resource support in the logically air-gapped vault guide.

From a real engagement shape — Mid-market healthcare SaaS, ~40 RDS/Aurora instances + 2 TB EBS, prior “nightly snapshots in the prod account.” First restore GameDay: 4.5 hours to a usable DB vs a 2-hour RTO on paper. Fix: separate-account vault + Vault Lock compliance + monthly automated restore tests for Tier-1. Second GameDay: 68 minutes measured restore for the primary OLTP cluster.

Reproduce this — Vault + restore checklist: examples/architecture-blog-2026/backup/restore-test-and-vault-checklist.md

AWS Backup Overview

Supported Services

AWS Backup supports centralized backup for:

How AWS Backup Works

Backup Plan (schedule + retention + lifecycle)
  → Backup Rule (frequency, time window)
    → Resource Assignment (tags, ARNs, or all resources)
      → Backup Vault (encrypted storage for backups)
        → Optional: Cross-Region copy
        → Optional: Cross-account copy

A backup plan defines what, when, and how long. Resource assignments determine which resources are backed up. Backup vaults store the backups with encryption and access policies.

Backup Plans

Designing Backup Plans

Create backup plans based on data criticality and recovery requirements:

Tier 1 — Critical (databases, financial data):

Backup Plan: Critical-Data
  Rule 1: Hourly backup (every 1 hour)
    Retention: 24 hours
    Start window: 1 hour
    Completion window: 2 hours
  Rule 2: Daily backup (1:00 AM UTC)
    Retention: 30 days
    Lifecycle: Move to cold storage after 7 days
  Rule 3: Monthly backup (1st of each month)
    Retention: 1 year
    Lifecycle: Move to cold storage after 30 days
  Cross-Region copy: us-west-2 (retention: 30 days)

Tier 2 — Important (application state, user uploads):

Backup Plan: Important-Data
  Rule 1: Daily backup (2:00 AM UTC)
    Retention: 14 days
  Rule 2: Weekly backup (Sunday)
    Retention: 90 days
    Lifecycle: Move to cold storage after 14 days

Tier 3 — Standard (development, non-critical):

Backup Plan: Standard-Data
  Rule 1: Daily backup (3:00 AM UTC)
    Retention: 7 days

Resource Assignment

Assign resources to backup plans using tags — not individual ARNs:

Resource Assignment:
  Selection: Tag-based
  Tag key: BackupTier
  Tag values: ["critical", "important", "standard"]

Tag-based assignment means new resources automatically get the right backup plan when tagged correctly. ARN-based assignment requires manual updates every time a resource is created or replaced.

Tagging standard:

RPO and RTO Alignment

Backup frequency determines your RPO (Recovery Point Objective) — the maximum data loss you accept:

RTO (Recovery Time Objective) — How quickly you can restore from backup:

Match backup strategy to business requirements. A financial application with a 1-hour RPO needs hourly backups. A development environment with a 24-hour RPO needs only daily backups.

Backup Vaults

Vault Architecture

Backup vaults are encrypted containers for backup data:

Primary Vault (us-east-1)
  Encryption: AWS KMS (customer-managed key)
  Access policy: Production account only
  Lock: Compliance mode (retention cannot be shortened)

DR Vault (us-west-2)
  Encryption: AWS KMS (separate key in us-west-2)
  Access policy: Production account only
  Receives: Cross-Region copies from primary vault

Audit Vault (Audit Account)
  Encryption: AWS KMS (audit account key)
  Access policy: Audit account only (immutable)
  Receives: Cross-account copies for compliance

Vault Lock and logically air-gapped vaults

Vault Lock prevents backup deletion and lifecycle changes that violate the lock — even by administrators or root (in compliance mode):

Governance mode: Blocks most users; authorized admins can still override. Operational protection.

Compliance mode: Blocks everyone, including root, after the cooling-off period. Retention cannot be shortened; lock cannot be removed. Use for regulatory WORM-style retention (HIPAA, SEC 17a-4, FINRA patterns).

Vault Lock (Compliance mode):
  Minimum retention: 365 days
  Maximum retention: 2555 days (7 years)
  Changeable lock: After 72-hour cooling-off period, lock becomes immutable

For stronger isolation, use a logically air-gapped vault: recovery points live in an AWS Backup service-owned account with Vault Lock compliance by default, optional customer-managed keys, and restore/share via RAM plus Multi-party approval when the vault-owning account is compromised (air-gapped vault guide). Primary backups can land directly in air-gapped vaults where supported — fewer copies, still isolated.

Ransomware protection: Compliance Vault Lock + separate-account or air-gapped copies beat “snapshots in the prod account with IAM hope.”

Encryption

Every backup vault is encrypted with KMS:

• AWS managed key — Simplest, no key management overhead
• Customer managed key — Required for cross-account access, compliance, and independent access control

Cross-Region copies use a KMS key in the destination Region. You must create a key in each target Region.

Cross-Region and Cross-Account Backup

Cross-Region Copies

Protect against Regional failures:

Primary (us-east-1) → Backup → Copy to us-west-2
  → Primary Region failure
    → Restore from us-west-2 backup
      → Application runs in us-west-2

Configure in the backup plan:

Backup Rule: Daily
  Copy action:
    Destination vault: arn:aws:backup:us-west-2:123456789:backup-vault:dr-vault
    Lifecycle: Delete after 30 days

Cross-Region copies complete asynchronously. For large databases, the initial copy may take hours. Subsequent incremental copies are faster.

Cross-Account Copies

Protect against account compromise:

Workload Account (123456789)
  → Backup vault → Copy to Backup Account (987654321)
    → Account 123456789 compromised
      → Backups in 987654321 are unaffected
        → Restore to a clean account

AWS Organizations integration: Use AWS Backup with Organizations to manage backup policies across all accounts from a central management account.

Delegated administrator: Designate a backup account as the delegated administrator. This account manages backup policies for the organization without requiring management account access.

Service-Specific Patterns

RDS and Aurora

RDS automated backups (managed by RDS, not AWS Backup):

• Retention: 1-35 days
• Point-in-time recovery: Any second within the retention window
• Cross-Region read replicas for DR

AWS Backup for RDS:

• Longer retention (beyond 35 days)
• Cross-account copies
• Centralized management with other services
• Vault lock for compliance

Recommendation: Use RDS automated backups for operational recovery (point-in-time restore within 35 days). Use AWS Backup for compliance retention and cross-account protection.

DynamoDB

DynamoDB PITR (Point-in-Time Recovery):

• Continuous backups retained for 35 days
• Restore to any second within the 35-day window
• No performance impact during backup

AWS Backup for DynamoDB:

• On-demand backups for longer retention
• Cross-Region and cross-account copies
• Tag-based resource assignment

Enable PITR on every production DynamoDB table. It costs $0.20/GB/month and provides second-level recovery granularity.

S3

S3 versioning is the first line of defense — deleted or overwritten objects are retained as non-current versions. Combined with lifecycle rules, versioning provides built-in object-level recovery.

AWS Backup for S3:

• Continuous backups (PITR for S3)
• Point-in-time restore to any second
• Cross-Region and cross-account copies
• Granular restore (individual objects or full bucket)

S3 Object Lock prevents deletion for a specified retention period — similar to vault lock but at the object level. Use for compliance data that must be retained unmodified.

EBS

EBS snapshots are incremental — each snapshot stores only changed blocks since the previous snapshot. First snapshot captures the full volume; subsequent snapshots are fast and cost-efficient.

AWS Backup for EBS:

• Scheduled snapshots via backup plans
• Cross-Region copies for DR
• Tag-based lifecycle management
• Automated cleanup of expired snapshots

Testing Backups

Restore Testing

Backups that have not been tested are not backups. AWS Backup provides automated restore testing:

Restore Test Plan:
  Schedule: Monthly
  Resources: All critical-tier backups
  Validation:
    - Restore completes successfully
    - Restored resource is accessible
    - Data integrity check (row count, checksum)
  Cleanup: Delete restored resources after validation

Testing Cadence

Document restore procedures. When a disaster occurs, the team should follow a documented runbook — not figure out the restore process under pressure. Include specific commands, expected durations, and validation steps.

Monitoring

Backup Monitoring

Set CloudWatch alarms for backup health:

AWS Backup Audit Manager

Audit Manager generates compliance reports for backup policies:

• Backup frequency compliance — Are all resources being backed up per policy?
• Retention compliance — Are backups retained for the required duration?
• Cross-Region compliance — Are backups copied to the required Regions?
• Encryption compliance — Are all vaults encrypted with the required key type?
• Vault lock compliance — Are compliance vaults properly locked?

Generate reports for auditors — Audit Manager creates evidence that your backup practices meet regulatory requirements (HIPAA, SOC 2, PCI DSS).

Cost Optimization

Backup Pricing

Reducing Costs

• Lifecycle to cold storage — Move backups older than 7-30 days to cold storage (50% cheaper). Cold storage has a minimum 90-day retention.
• Right-size retention — Do not retain daily backups for a year when weekly backups suffice. Use the tiered approach: frequent short-term + infrequent long-term.
• Exclude non-critical resources — Development databases, temporary volumes, and test environments may not need backup. Use the BackupExclude: true tag.
• Clean up orphaned snapshots — Snapshots from deleted resources continue incurring charges. Use AWS Backup lifecycle rules or manual cleanup.

Cost Example

Production environment with 10 RDS databases (500 GB total), 20 EBS volumes (1 TB total), 5 DynamoDB tables (200 GB total):

Daily backups, 30-day retention, cold storage after 7 days:
  EBS: 1,000 GB × $0.05 = $50/month (warm) + cold storage
  RDS: 500 GB × $0.095 = $47.50/month
  DynamoDB: 200 GB × $0.10 = $20/month
  DynamoDB PITR: 200 GB × $0.20 = $40/month
  Cross-Region copy: ~$34/month (data transfer)
  Total: ~$190/month for complete data protection

Common Mistakes

Mistake 1: No Backup Testing

Creating backup plans but never testing restores. When a disaster occurs, the team discovers that backups are corrupted, incomplete, or the restore process takes longer than the RTO allows. Test restores monthly for critical data.

Mistake 2: Same-Account Backups Only

Storing backups in the same account as production data. If the account is compromised (ransomware, credential theft), both the data and its backups are at risk. Copy backups to a separate account with vault lock.

Mistake 3: No Vault Lock for Compliance

Relying on IAM policies to prevent backup deletion. IAM policies can be modified by administrators. Vault lock in compliance mode provides immutable retention that cannot be overridden by anyone — required for regulatory compliance.

Mistake 4: Missing Resources

Resources without the backup tag are not backed up. Use AWS Config rules to detect untagged resources and AWS Backup Audit Manager to verify all required resources have backup coverage.

Mistake 5: Ignoring Backup Job Failures

Backup jobs fail silently without monitoring. A database that has not been backed up for weeks is a disaster waiting to happen. Set CloudWatch alarms on backup job failures — every failure requires investigation.

What This Post Doesn’t Cover

• Per-engine continuous backup nuances (Aurora backtrack vs Backup PITR) — confirm engine docs.
• On-premises / Storage Gateway edge cases — separate design.
• Exact air-gapped vault service matrix month-to-month — use the current AWS Backup support table.

What to Do This Week

1. List Tier-1 resources; confirm each has a plan assignment (tag or ARN).
2. Enable Vault Lock (or air-gapped vault) for the copy that must survive account compromise.
3. Schedule one automated restore test; record measured RTO against the SLA.

Contact us for backup + DR architecture review.