What is AWS Backup? - AWS Backup

What is AWS Backup?

AWS Backup is a fully-managed service that makes it easy to centralize and automate data protection across AWS services, in the cloud, and on premises. Using this service, you can configure backup policies and monitor activity for your AWS resources in one place. It allows you to automate and consolidate backup tasks that were previously performed service-by-service, and removes the need to create custom scripts and manual processes. With a few clicks in the AWS Backup console, you can automate your data protection policies and schedules.

AWS Backup does not govern backups you take in your AWS environment outside of AWS Backup. Therefore, if you want a centralized, end-to-end solution for business and regulatory compliance requirements, start using AWS Backup today.

Supported AWS resources and third-party applications

The following are AWS resources and third-party applications that you can back up and restore using AWS Backup.

Supported resource Supported resource type
Amazon Elastic Compute Cloud (Amazon EC2) Amazon EC2 instances (excluding instance store-backed AMIs)
Amazon Simple Storage Service (Amazon S3) Amazon S3 data
Amazon Elastic Block Store (Amazon EBS) Amazon EBS volumes
Amazon DynamoDB Amazon DynamoDB tables
Amazon Relational Database Service (Amazon RDS) Amazon RDS database instances (including all database engines); Multi-Availability Zone clusters
Amazon Aurora Aurora clusters
Amazon Elastic File System (Amazon EFS) Amazon EFS file systems
FSx for Lustre FSx for Lustre file systems
FSx for Windows File Server FSx for Windows File Server file systems
Amazon FSx for NetApp ONTAP FSx for ONTAP file systems
Amazon FSx for OpenZFS FSx for OpenZFS file systems
AWS Storage Gateway (Volume Gateway) AWS Storage Gateway volumes
Amazon DocumentDB Amazon DocumentDB clusters
Amazon Neptune Amazon Neptune clusters
Amazon Redshift Amazon Redshift clusters
Amazon Timestream Amazon Timestream tables
VMware Cloud™ on AWS VMware Cloud™ virtual machines on AWS
VMware Cloud™ on AWS Outposts VMware Cloud™ virtual machines on AWS Outposts
AWS CloudFormation AWS CloudFormation stacks
SAP HANA databases SAP HANA databases on Amazon EC2 instances

Features available for all supported resources

AWS Backup features are offered according to resource and AWS Region. The following sections and tables can help you determine feature availability.

AWS Backup offers the following features for its supported AWS services, as well as for supported third-party applications. Support for a feature or service should not be assumed unless explicitly mentioned.

Feature availability by resource

To use AWS Backup with a supported AWS service in a particular Region, the service must be available in the Region. To determine service availability in a Region, view the service's endpoints in the AWS General Reference.

AWS Backup supports Cross-Region backup Cross-account backup AWS Backup Audit Manager Incremental backup Continuous backup and point-in-time restore (PITR) Full AWS Backup management Lifecycle to cold storage Item-level restore‡ Restore testing
Amazon EC2
Amazon S3
Amazon EBS
Amazon RDS single instance ✓* ✓* ✓**
Amazon RDS cluster ✓* ✓* ✓**
Amazon Aurora ✓* ✓*
Amazon EFS
FSx for Lustre
FSx for Windows File Server
FSx for ONTAP ✓†
FSx for OpenZFS
AWS Storage Gateway
Amazon DocumentDB ✓* ✓*
Amazon Neptune ✓* ✓*
Amazon Redshift
Timestream
Windows VSS
Virtual machines
AWS CloudFormation templates ✓' ✓'
Amazon DynamoDB
DynamoDB with AWS Backup advanced features
SAP HANA databases on Amazon EC2 instances

Some resource types have both continuous backup capability and cross-Region and cross-account copy available. When a cross-Region or cross-account copy of a continuous backup is made, the copied recovery point (backup) becomes a snapshot (periodic) backup. PITR (Point-in-Time Restore) is not available for these copies.

* RDS, Aurora, DocumentDB, and Neptune do not support a single copy action that performs both cross-Region AND cross-account backup. You can choose one or the other. You can also use a AWS Lambda script to listen for the completion of your first copy, perform your second copy, then delete the first copy. RDS multi availability zone (Multi-AZ) database instances can be copied, but Multi-AZ clusters do not currently support cross-Region or cross-account copy. See Cross-Region copy considerations with specific resources for further information.

** See RDS multi-availability zone backups for Regions where Backup Audit Manager support is available.

† AWS Backup Audit Manager supports this resource across all controls except cross-account copy and cross-Region copy.

‡ The "item" in an item-level restore varies depending on the supported resource. For example, a file system item is a file or directory, whereas an S3 item is an S3 object. A VMware item is a disk. For more information, see the Restoring a backup section for the supported resource.

' In CloudFormation stack backups, nested resources retain their source resources' features. However, resources within the stack do not retain Point-in-Time Restore (PITR) functionality (such as S3 and RDS). Properties within the matrix above apply just to CloudFormation templates and not to the resources within the stack.

Feature availability by AWS Region

AWS Backup is available in all the following AWS Regions. AWS Backup features are available in all these Regions unless otherwise noted in the following table.

AWS Backup supports Cross-Region backup Cross-account management Cross-account backup AWS Backup Audit Manager and Jobs dashboard Restore testing
US East (N. Virginia)
US East (Ohio)
US West (N. California)
US West (Oregon)
Africa (Cape Town)
Asia Pacific (Hong Kong)
Asia Pacific (Hyderabad)
Asia Pacific (Jakarta)
Asia Pacific (Melbourne)
Asia Pacific (Mumbai)
Asia Pacific (Osaka)
Asia Pacific (Seoul)
Asia Pacific (Singapore)
Asia Pacific (Sydney)
Asia Pacific (Tokyo)
Canada (Central)
Canada West (Calgary) ✓ (except Amazon S3)
China (Beijing)
China (Ningxia)
Europe (Frankfurt)
Europe (Ireland)
Europe (London)
Europe (Milan)
Europe (Paris)
Europe (Spain)
Europe (Stockholm)
Europe (Zurich)
Israel (Tel Aviv)
Middle East (Bahrain)
Middle East (UAE)
South America (São Paulo)
AWS GovCloud (US-East)
AWS GovCloud (US-West)

China (Beijing) and China (Ningxia) support cross-Region copy from one of these two Regions to the other. Cross-Region copy is not supported from these Regions to other Regions or into these Regions. Cross-account copy is not supported for these Regions.

Jobs dashboard is not currently available in AWS GovCloud (US-East) and AWS GovCloud (US-West). Jobs dashboard aggregation is only available in Regions which support cross-account management and AWS Backup Audit Manager.

Amazon EBS cold storage archive tier is not available in is not currently available in China (Beijing), China (Ningxia), AWS GovCloud (US-East) and AWS GovCloud (US-West) Regions.

Supported services by AWS Region

AWS Backup supports Aurora, DynamoDB, DynamoDB with AWS Backup advanced features, Amazon EBS, Amazon EC2, Amazon EFS, Amazon Redshift, and Amazon RDS in all supported Regions.

The following Regions support the indicated services:

Region and service Amazon FSx SAP HANA on EC2 instances Amazon S3 Storage Gateway Amazon Timestream VMware
US East (N. Virginia)
US East (Ohio)
US West (N. California) Windows; Lustre; ONTAP
US West (Oregon) Windows; Lustre; ONTAP
Africa (Cape Town) Windows; Lustre; ONTAP ✓ (no cross-account/cross-Region copy)
Asia Pacific (Hong Kong) ✓ (no cross-account/cross-Region copy)
Asia Pacific (Hyderabad) Windows; Lustre; ONTAP ✓ (no cross-account/cross-Region copy)
Asia Pacific (Jakarta) Windows; Lustre; ONTAP
Asia Pacific (Melbourne) Windows; Lustre; ONTAP ✓ (no cross-account/cross-Region copy)
Asia Pacific (Mumbai)
Asia Pacific (Osaka) Windows; Lustre ✓ (no cross-account/cross-Region copy)
Asia Pacific (Seoul)
Asia Pacific (Singapore)
Asia Pacific (Sydney)
Asia Pacific (Tokyo)
Canada (Central)
Canada West (Calgary)
China (Beijing) Windows; Lustre ✓ (no cross-account copy)
China (Ningxia) Windows; Lustre ✓ (no cross-account copy)
Europe (Frankfurt)
Europe (Ireland)
Europe (London)
Europe (Milan) Windows; Lustre; ONTAP ✓ (no cross-account/cross-Region copy)
Europe (Paris) Windows; Lustre; ONTAP
Europe (Spain) Windows; Lustre; ONTAP ✓ (no cross-account/cross-Region copy)
Europe (Stockholm)
Europe (Zurich) Windows; Lustre; ONTAP ✓ (no cross-account/cross-Region copy)
Israel (Tel Aviv) Windows; Lustre; ONTAP ✓ (no cross-account/cross-Region copy)
Middle East (Bahrain) Windows; Lustre; ONTAP ✓ (no cross-account/cross-Region copy)
Middle East (UAE) ✓ (no cross-account/cross-Region copy)
South America (São Paulo)
AWS GovCloud (US-West) Windows; Lustre; ONTAP ✓ (no cross-account/cross-Region copy)
AWS GovCloud (US-East) Windows; Lustre; ONTAP ✓ (no cross-account/cross-Region copy)

A check under Amazon FSx indicates that FSx for Windows File Server, FSx for Lustre, FSx for ONTAP, and FSx for OpenZFS are all supported in that Region by AWS Backup; otherwise, the supported configurations will be listed.

Feature overview

AWS Backup provides many features and capabilities, including:

Centralized backup management

AWS Backup provides a centralized backup console, a set of backup APIs, and the AWS Command Line Interface (AWS CLI) to manage backups across the AWS services that your applications use. With AWS Backup, you can centrally manage backup policies that meet your backup requirements. You can then apply them to your AWS resources across AWS services, enabling you to back up your application data in a consistent and compliant manner. The AWS Backup centralized backup console offers a consolidated view of your backups and backup activity logs, making it easier to audit your backups and ensure compliance.

Policy-based backup

With AWS Backup, you can create backup policies known as backup plans. Use these backup plans to define your backup requirements and then apply them to the AWS resources that you want to protect across the AWS services that you use. You can create separate backup plans that each meet specific business and regulatory compliance requirements. This helps ensure that each AWS resource is backed up according to your requirements. Backup plans make it easy to enforce your backup strategy across your organization and across your applications in a scalable manner.

For all the configuration options for backup plans, see Backup plan options and configuration.

Tag-based backup policies

You can use AWS Backup to apply backup plans to your AWS resources in a wide variety of ways, including tagging them. Tagging makes it easier to implement your backup strategy across all your applications and to ensure that all your AWS resources are backed up and protected. AWS tags are a great way to organize and classify your AWS resources. Integration with AWS tags enables you to quickly apply a backup plan to a group of AWS resources, so that they are backed up in a consistent and compliant manner.

For all the ways you can assign your resources to backup plans, see Assigning resources to a backup plan.

Lifecycle management policies

AWS Backup enables you to meet compliance requirements while minimizing backup storage costs by storing backups in a low-cost cold storage tier (backups to cold storage are full backups). You can configure lifecycle policies that automatically transition backups from warm storage to cold storage according to a schedule that you define.

For a list of resources which can be transitioned to cold storage, see Feature availability by resource. For steps to turn on cold storage in your backup plan, see Lifecycle and storage tiers.

Cross-Region backup

Using AWS Backup, you can copy backups to multiple different AWS Regions on demand or automatically as part of a scheduled backup plan. Cross-Region backup is particularly valuable if you have business continuity or compliance requirements to store backups a minimum distance away from your production data. For more information, see Creating backup copies across AWS Regions.

Cross-account management and cross-account backup

You can use AWS Backup to manage your backups across all AWS accounts inside your AWS Organizations structure. With cross-account management, you can automatically use backup policies to apply backup plans across the AWS accounts within your organization. This makes compliance and data protection efficient at scale and reduces operational overhead. It also helps eliminate manually duplicating backup plans across individual accounts. For more information, see Managing AWS Backup resources across multiple AWS accounts.

You can also copy backups to multiple different AWS accounts inside your AWS Organizations management structure. This way, you can "fan in" backups to a single repository account, then "fan out" backups for greater resilience. Creating backup copies across AWS accounts.

Before you can use the cross-account management and cross-account backup features, you must have an existing organization structure configured in AWS Organizations. An organizational unit (OU) is a group of accounts that can be managed as a single entity. AWS Organizations is a list of accounts that can be grouped into organizational units and managed as a single entity.

Auditing and reporting with AWS Backup Audit Manager

AWS Backup Audit Manager helps you simplify data governance and compliance management of your backups across AWS. AWS Backup Audit Manager provides built-in, customizable controls that you can align with your organizational requirements. You can also use these controls to automatically track your backup activities and resources.

AWS Backup Audit Manager can help you locate specific activities and resources that are not yet compliant with the controls that you defined. It also generates daily reports that you can use to demonstrate evidence of compliance with your controls over time.

To include your backup compliance alongside your overall compliance posture, you can automatically import AWS Backup Audit Manager findings into AWS Audit Manager.

Incremental backups

AWS Backup efficiently stores your periodic backups incrementally. The first backup of an AWS resource backs up a full copy of your data. For each successive incremental backup, only the changes to your AWS resources are backed up. Incremental backups enable you to benefit from the data protection of frequent backups while minimizing storage costs (backups to cold storage are full backups).

For a list of which resources support incremental backups, see Feature availability by resource.

Full AWS Backup management

Some resource types support full AWS Backup management. The benefits of full AWS Backup management include:

  • Independent encryption. AWS Backup automatically encrypts your backups with the KMS key of your AWS Backup vault, instead of using the same encryption key as your source resource. This increases your layers of defense. See Encryption for backups in AWS Backup for more information.

  • awsbackup Amazon Resource Names (ARNs). Backup ARNs begin with arn:aws:backup instead of arn:aws:source-resource. This allows you to create access policies that apply specifically to backups and not the source resources. See Access control for more information.

  • Centralized backup billing and Cost Explorer cost allocation tags.. Charges for AWS Backup (including storage, data transfers, restores, and early deletion) appear under "Backup" in your Amazon Web Services bill, instead of appearing under each supported resource. You can also use Cost Explorer cost allocation tags to track and optimize your backup costs. See Metering, costs, and billing for more information.

To see which resource types are eligible for full AWS Backup management, see Feature availability by resource.

Backup activity monitoring

AWS Backup provides a dashboard that makes it simple to audit backup and restore activity across AWS services. With just a few clicks on the AWS Backup console, you can view the status of recent backup jobs. You can also restore jobs across AWS services to ensure that your AWS resources are properly protected.

AWS Backup integrates with Amazon CloudWatch and Amazon EventBridge. CloudWatch allows you to track metrics and create alarms. EventBridge allows you to view and monitor AWS Backup events. For more information, see Monitoring AWS Backup events using EventBridge and Monitoring AWS Backup metrics with CloudWatch.

AWS Backup integrates with AWS CloudTrail. CloudTrail gives you a consolidated view of backup activity logs that make it quick and easy to audit how your resources are backed up. AWS Backup also integrates with Amazon Simple Notification Service (Amazon SNS), providing you with backup activity notifications, such as when a backup succeeds or a restore has been initiated. For more information, see Logging AWS Backup API calls with CloudTrail and Using Amazon SNS to track AWS Backup events.

Secure your data in backup vaults

The content of each AWS Backup backup is immutable, meaning that no one can alter that content. AWS Backup further secures your backups in backup vaults, which separates them safely from their source instances. For example, your vault will retain your Amazon EC2 and Amazon EBS backups according to the lifecycle policy you choose, even if you delete the source Amazon EC2 instance and Amazon EBS volumes.

Backup vaults offer encryption and resource-based access policies that let you define who has access to your backups. You can define access policies for a backup vault that define who has access to the backups within that vault and what actions they can take. This provides a simple and secure way to control access to your backups across AWS services. To review AWS and customer managed policies for AWS Backup, see Managed policies for AWS Backup.

You can use AWS Backup Vault Lock to prevent anyone (including you) from deleting backups or altering their retention period. AWS Backup Vault Lock helps you enforce a write-once-read-many (WORM) model and add another layer of defense to your defense in depth. To get started, see AWS Backup Vault Lock.

Support for compliance obligations

AWS Backup helps you meet your global compliance obligations. AWS Backup is in scope of the following AWS compliance programs:

Getting started

To learn more about AWS Backup, we recommend that you start with Getting started with AWS Backup.