# AWS Backup restore-test + vault checklist (July 2026)

Verify resource coverage and vault types against [AWS Backup docs](https://docs.aws.amazon.com/aws-backup/latest/devguide/whatisbackup.html). Pricing and service support change — re-check before audits.

## Vault posture

- [ ] Production vaults encrypted (CMK where policy requires)
- [ ] **Vault Lock** — governance vs **compliance** mode chosen deliberately; grace period understood
- [ ] Critical copies in a **separate account** (ransomware / credential blast radius)
- [ ] Consider **logically air-gapped vault** for immutable copies (service-owned account, Vault Lock compliance by default; CMK optional; RAM share / Multi-party approval for recovery when source account is compromised)
- [ ] Cross-Region copy rule for Tier-1 plans (or primary backup directly to LAG vault where supported)

## Restore testing (non-negotiable)

| Tier      | Automated restore test | Full DR GameDay |
| --------- | ---------------------- | --------------- |
| Critical  | Monthly                | Quarterly       |
| Important | Quarterly              | Annually        |
| Standard  | Annually               | Optional        |

For each critical resource class (RDS/Aurora, DynamoDB, EBS, EFS/FSx, S3):

1. Restore into isolated account/VPC
2. Validate accessibility + integrity check (row count / checksum / app smoke)
3. Record wall-clock RTO vs SLA
4. Destroy restored resources (lifecycle / cleanup job)

## Monday-morning smoke

```bash
# Failed jobs last 7 days (adjust account/region)
aws backup list-backup-jobs --by-state FAILED --region us-east-1 \
  --max-results 20 --query 'BackupJobs[].{Id:BackupJobId,Resource:ResourceArn,Created:CreationDate}'
```

## What “done” looks like

- [ ] CloudWatch alarm on backup job FAILED / EXPIRED
- [ ] Audit Manager (or equivalent) report for frequency + vault lock
- [ ] Runbook with commands, owners, and expected restore duration