# AWS Backup Construct Library

AWS Backup is a fully managed backup service that makes it easy to centralize and automate the
backup of data across AWS services in the cloud and on premises. Using AWS Backup, you can
configure backup policies and monitor backup activity for your AWS resources in one place.

## Backup plan and selection

In AWS Backup, a *backup plan* is a policy expression that defines when and how you want to back up
 your AWS resources, such as Amazon DynamoDB tables or Amazon Elastic File System (Amazon EFS) file
 systems. You can assign resources to backup plans, and AWS Backup automatically backs up and retains
 backups for those resources according to the backup plan. You can create multiple backup plans if you
 have workloads with different backup requirements.

This module provides ready-made backup plans (similar to the console experience):

```ts
// Daily, weekly and monthly with 5 year retention
const plan = backup.BackupPlan.dailyWeeklyMonthly5YearRetention(this, 'Plan');
```

Assigning resources to a plan can be done with `addSelection()`:

```ts
declare const plan: backup.BackupPlan;
declare const vpc: ec2.Vpc;
const myTable = dynamodb.Table.fromTableName(this, 'Table', 'myTableName');
const myDatabaseInstance = new rds.DatabaseInstance(this, 'DatabaseInstance', {
  engine: rds.DatabaseInstanceEngine.mysql({ version: rds.MysqlEngineVersion.VER_8_0_26 }),
  vpc,
});
const myDatabaseCluster = new rds.DatabaseCluster(this, 'DatabaseCluster', {
  engine: rds.DatabaseClusterEngine.auroraMysql({ version: rds.AuroraMysqlEngineVersion.VER_2_08_1 }),
  credentials: rds.Credentials.fromGeneratedSecret('clusteradmin'),
  instanceProps: {
    vpc,
  },
});
const myServerlessCluster = new rds.ServerlessCluster(this, 'ServerlessCluster', {
  engine: rds.DatabaseClusterEngine.AURORA_POSTGRESQL,
  parameterGroup: rds.ParameterGroup.fromParameterGroupName(this, 'ParameterGroup', 'default.aurora-postgresql11'),
  vpc,
});
const myCoolConstruct = new Construct(this, 'MyCoolConstruct');

plan.addSelection('Selection', {
  resources: [
    backup.BackupResource.fromDynamoDbTable(myTable), // A DynamoDB table
    backup.BackupResource.fromRdsDatabaseInstance(myDatabaseInstance), // A RDS instance
    backup.BackupResource.fromRdsDatabaseCluster(myDatabaseCluster), // A RDS database cluster
    backup.BackupResource.fromRdsServerlessCluster(myServerlessCluster), // An Aurora Serverless cluster
    backup.BackupResource.fromTag('stage', 'prod'), // All resources that are tagged stage=prod in the region/account
    backup.BackupResource.fromConstruct(myCoolConstruct), // All backupable resources in `myCoolConstruct`
  ]
})
```

If not specified, a new IAM role with a managed policy for backup will be
created for the selection. The [`BackupSelection`](/v2/docs/aws-cdk-lib.aws_backup.BackupSelection) implements `IGrantable`.

To disable the plan from assigning the default `AWSBackupServiceRolePolicyForBackup` backup policy use the `disableDefaultBackupPolicy` property.

This is useful if you want to avoid granting unnecessary permissions to the role.

```ts
declare const plan: backup.BackupPlan;

const role = new iam.Role(this, 'BackupRole', {
  assumedBy: new iam.ServicePrincipal('backup.amazonaws.com'),
});
// Assign S3-specific backup policy
role.addManagedPolicy(iam.ManagedPolicy.fromAwsManagedPolicyName('AWSBackupServiceRolePolicyForS3Backup'));

plan.addSelection('Selection', {
  resources: [
    backup.BackupResource.fromTag('stage', 'prod'),
  ],
  role,
  disableDefaultBackupPolicy: true,
});
```

To add rules to a plan, use `addRule()`:

```ts
import { TimeZone } from 'aws-cdk-lib';
declare const plan: backup.BackupPlan;
plan.addRule(new backup.BackupPlanRule({
  completionWindow: Duration.hours(2),
  startWindow: Duration.hours(1),
  scheduleExpression: events.Schedule.cron({ // Only cron expressions are supported
    day: '15',
    hour: '3',
    minute: '30',
  }),
  scheduleExpressionTimezone: TimeZone.ETC_UTC,
  moveToColdStorageAfter: Duration.days(30),
}));
```

Continuous backup and point-in-time restores (PITR) can be configured.
Property `deleteAfter` defines the retention period for the backup. It is mandatory if PITR is enabled.
If no value is specified, the retention period is set to 35 days which is the maximum retention period supported by PITR.
Property `moveToColdStorageAfter` must not be specified because PITR does not support this option.
This example defines an AWS Backup rule with PITR and a retention period set to 14 days:

```ts
declare const plan: backup.BackupPlan;
plan.addRule(new backup.BackupPlanRule({
  enableContinuousBackup: true,
  deleteAfter: Duration.days(14),
}));
```

Rules can also specify to copy recovery points to another Backup Vault using `copyActions`. Copied recovery points can
optionally have `moveToColdStorageAfter` and `deleteAfter` configured.

```ts
declare const plan: backup.BackupPlan;
declare const secondaryVault: backup.BackupVault;
plan.addRule(new backup.BackupPlanRule({
  copyActions: [{
    destinationBackupVault: secondaryVault,
    moveToColdStorageAfter: Duration.days(30),
    deleteAfter: Duration.days(120),
  }]
}));
```

You can assign your own metadata to the resources that are associated with the rule when restored from backup using `recoveryPointTags`. Each tag is a key-value pair.

```ts
declare const plan: backup.BackupPlan;
plan.addRule(new backup.BackupPlanRule({
  recoveryPointTags: {
    key: 'value',
  },
}));
```

You can enable Backup indexes for specific resource types in the rule by using `indexActions`.
Each rule can have at most one index action, and its `resourceTypes` must list at least one
resource type to index.

```ts
declare const plan: backup.BackupPlan;
plan.addRule(new backup.BackupPlanRule({
  indexActions: [{
      resourceTypes: [backup.IndexActionResourceType.S3],
  }],
}));
```

Ready-made rules are also available:

```ts
declare const plan: backup.BackupPlan;
plan.addRule(backup.BackupPlanRule.daily());
plan.addRule(backup.BackupPlanRule.weekly());
```

By default a new [vault](#Backup-vault) is created when creating a plan.
It is also possible to specify a vault either at the plan level or at the
rule level.

```ts
const myVault = backup.BackupVault.fromBackupVaultName(this, 'Vault1', 'myVault');
const otherVault = backup.BackupVault.fromBackupVaultName(this, 'Vault2', 'otherVault');

const plan = backup.BackupPlan.daily35DayRetention(this, 'Plan', myVault); // Use `myVault` for all plan rules
plan.addRule(backup.BackupPlanRule.monthly1Year(otherVault)); // Use `otherVault` for this specific rule
```

You can [backup](https://docs.aws.amazon.com/aws-backup/latest/devguide/windows-backups.html)
VSS-enabled Windows applications running on Amazon EC2 instances by setting the `windowsVss`
parameter to `true`. If the application has VSS writer registered with Windows VSS,
then AWS Backup creates a snapshot that will be consistent for that application.

```ts
const plan = new backup.BackupPlan(this, 'Plan', {
  windowsVss: true,
});
```

## Backup vault

In AWS Backup, a *backup vault* is a container that you organize your backups in. You can use backup
vaults to set the AWS Key Management Service (AWS KMS) encryption key that is used to encrypt backups
in the backup vault and to control access to the backups in the backup vault. If you require different
encryption keys or access policies for different groups of backups, you can optionally create multiple
backup vaults.

```ts
const myKey = kms.Key.fromKeyArn(this, 'MyKey', 'aaa');
const myTopic = sns.Topic.fromTopicArn(this, 'MyTopic', 'bbb');

const vault = new backup.BackupVault(this, 'Vault', {
  encryptionKey: myKey, // Custom encryption key
  notificationTopic: myTopic, // Send all vault events to this SNS topic
});
```

A vault has a default `RemovalPolicy` set to `RETAIN`. Note that removing a vault
that contains recovery points will fail.

You can assign policies to backup vaults and the resources they contain. Assigning policies allows
you to do things like grant access to users to create backup plans and on-demand backups, but limit
their ability to delete recovery points after they're created.

Use the `accessPolicy` property to create a backup vault policy:

```ts
const vault = new backup.BackupVault(this, 'Vault', {
  accessPolicy: new iam.PolicyDocument({
    statements: [
      new iam.PolicyStatement({
        effect: iam.Effect.DENY,
        principals: [new iam.AnyPrincipal()],
        actions: ['backup:DeleteRecoveryPoint'],
        resources: ['*'],
        conditions: {
          StringNotLike: {
            'aws:userId': [
              'user1',
              'user2',
            ],
          },
        },
      }),
    ],
  }),
})
```

Alternativately statements can be added to the vault policy using `addToAccessPolicy()`.

Use the `blockRecoveryPointDeletion` property or the `blockRecoveryPointDeletion()` method to add
a statement to the vault access policy that prevents recovery point deletions in your vault:

```ts
new backup.BackupVault(this, 'Vault', {
  blockRecoveryPointDeletion: true,
});

declare const backupVault: backup.BackupVault;
backupVault.blockRecoveryPointDeletion();
```

By default access is not restricted.

Use the `lockConfiguration` property to enable [AWS Backup Vault Lock](https://docs.aws.amazon.com/aws-backup/latest/devguide/vault-lock.html):

```ts
new backup.BackupVault(this, 'Vault', {
  lockConfiguration: {
    minRetention: Duration.days(30),
  },
});
```

## Importing existing backup vault

To import an existing backup vault into your CDK application, use the `BackupVault.fromBackupVaultArn` or `BackupVault.fromBackupVaultName`
static method. Here is an example of giving an IAM Role permission to start a backup job:

```ts
const importedVault = backup.BackupVault.fromBackupVaultName(this, 'Vault', 'myVaultName');

const role = new iam.Role(this, 'Access Role', { assumedBy: new iam.ServicePrincipal('lambda.amazonaws.com') });

importedVault.grant(role, 'backup:StartBackupJob');
```

## Types

| Name | Kind | Summary |
| --- | --- | --- |
| [`BackupPlan`](/v2/docs/aws-cdk-lib.aws_backup.BackupPlan) | Construct (L2) | A backup plan. |
| [`BackupSelection`](/v2/docs/aws-cdk-lib.aws_backup.BackupSelection) | Construct (L2) | A backup selection. |
| [`BackupVault`](/v2/docs/aws-cdk-lib.aws_backup.BackupVault) | Construct (L2) | A backup vault. |
| [`CfnBackupPlan`](/v2/docs/aws-cdk-lib.aws_backup.CfnBackupPlan) | Construct (L1) | Contains an optional backup plan display name and an array of `BackupRule` objects, each of which specifies a backup rule. |
| [`CfnBackupSelection`](/v2/docs/aws-cdk-lib.aws_backup.CfnBackupSelection) | Construct (L1) | Specifies a set of resources to assign to a backup plan. |
| [`CfnBackupVault`](/v2/docs/aws-cdk-lib.aws_backup.CfnBackupVault) | Construct (L1) | Creates a logical container where backups are stored. |
| [`CfnFramework`](/v2/docs/aws-cdk-lib.aws_backup.CfnFramework) | Construct (L1) | Creates a framework with one or more controls. |
| [`CfnLegalHold`](/v2/docs/aws-cdk-lib.aws_backup.CfnLegalHold) | Construct (L1) | Creates a legal hold on recovery points (backups). |
| [`CfnLogicallyAirGappedBackupVault`](/v2/docs/aws-cdk-lib.aws_backup.CfnLogicallyAirGappedBackupVault) | Construct (L1) | Creates a logical container to where backups may be copied. |
| [`CfnReportPlan`](/v2/docs/aws-cdk-lib.aws_backup.CfnReportPlan) | Construct (L1) | Creates a report plan. |
| [`CfnRestoreTestingPlan`](/v2/docs/aws-cdk-lib.aws_backup.CfnRestoreTestingPlan) | Construct (L1) | Creates a restore testing plan. |
| [`CfnRestoreTestingSelection`](/v2/docs/aws-cdk-lib.aws_backup.CfnRestoreTestingSelection) | Construct (L1) | This request can be sent after CreateRestoreTestingPlan request returns successfully. |
| [`CfnTieringConfiguration`](/v2/docs/aws-cdk-lib.aws_backup.CfnTieringConfiguration) | Construct (L1) | Resource Type definition for AWS::Backup::TieringConfiguration. |
| [`BackupPlanCopyActionProps`](/v2/docs/aws-cdk-lib.aws_backup.BackupPlanCopyActionProps) | Struct | Properties for a BackupPlanCopyAction. |
| [`BackupPlanIndexActionProps`](/v2/docs/aws-cdk-lib.aws_backup.BackupPlanIndexActionProps) | Struct | Properties for a BackupPlanIndexAction. |
| [`BackupPlanProps`](/v2/docs/aws-cdk-lib.aws_backup.BackupPlanProps) | Struct | Properties for a BackupPlan. |
| [`BackupPlanRule`](/v2/docs/aws-cdk-lib.aws_backup.BackupPlanRule) | Class | A backup plan rule. |
| [`BackupPlanRuleProps`](/v2/docs/aws-cdk-lib.aws_backup.BackupPlanRuleProps) | Struct | Properties for a BackupPlanRule. |
| [`BackupResource`](/v2/docs/aws-cdk-lib.aws_backup.BackupResource) | Class | A resource to backup. |
| [`BackupSelectionOptions`](/v2/docs/aws-cdk-lib.aws_backup.BackupSelectionOptions) | Struct | Options for a BackupSelection. |
| [`BackupSelectionProps`](/v2/docs/aws-cdk-lib.aws_backup.BackupSelectionProps) | Struct | Properties for a BackupSelection. |
| [`BackupVaultEvents`](/v2/docs/aws-cdk-lib.aws_backup.BackupVaultEvents) | Enum | Backup vault events. |
| [`BackupVaultProps`](/v2/docs/aws-cdk-lib.aws_backup.BackupVaultProps) | Struct | Properties for a BackupVault. |
| [`CfnBackupPlan.AdvancedBackupSettingResourceTypeProperty`](/v2/docs/aws-cdk-lib.aws_backup.CfnBackupPlan.AdvancedBackupSettingResourceTypeProperty) | Struct | Specifies an object containing resource type and backup options. |
| [`CfnBackupPlan.BackupPlanResourceTypeProperty`](/v2/docs/aws-cdk-lib.aws_backup.CfnBackupPlan.BackupPlanResourceTypeProperty) | Struct | Specifies an object containing properties used to create a backup plan. |
| [`CfnBackupPlan.BackupRuleResourceTypeProperty`](/v2/docs/aws-cdk-lib.aws_backup.CfnBackupPlan.BackupRuleResourceTypeProperty) | Struct | Specifies an object containing properties used to schedule a task to back up a selection of resources. |
| [`CfnBackupPlan.CopyActionResourceTypeProperty`](/v2/docs/aws-cdk-lib.aws_backup.CfnBackupPlan.CopyActionResourceTypeProperty) | Struct | Copies backups created by a backup rule to another vault. |
| [`CfnBackupPlan.IndexActionsResourceTypeProperty`](/v2/docs/aws-cdk-lib.aws_backup.CfnBackupPlan.IndexActionsResourceTypeProperty) | Struct | Specifies index actions. |
| [`CfnBackupPlan.LifecycleResourceTypeProperty`](/v2/docs/aws-cdk-lib.aws_backup.CfnBackupPlan.LifecycleResourceTypeProperty) | Struct | Specifies an object containing an array of `Transition` objects that determine how long in days before a recovery point transitions to cold storage or is deleted. |
| [`CfnBackupPlan.ScanActionResourceTypeProperty`](/v2/docs/aws-cdk-lib.aws_backup.CfnBackupPlan.ScanActionResourceTypeProperty) | Struct |  |
| [`CfnBackupPlan.ScanSettingResourceTypeProperty`](/v2/docs/aws-cdk-lib.aws_backup.CfnBackupPlan.ScanSettingResourceTypeProperty) | Struct |  |
| [`CfnBackupPlanProps`](/v2/docs/aws-cdk-lib.aws_backup.CfnBackupPlanProps) | Struct | Properties for defining a `CfnBackupPlan`. |
| [`CfnBackupSelection.BackupSelectionResourceTypeProperty`](/v2/docs/aws-cdk-lib.aws_backup.CfnBackupSelection.BackupSelectionResourceTypeProperty) | Struct | Specifies an object containing properties used to assign a set of resources to a backup plan. |
| [`CfnBackupSelection.ConditionParameterProperty`](/v2/docs/aws-cdk-lib.aws_backup.CfnBackupSelection.ConditionParameterProperty) | Struct | Includes information about tags you define to assign tagged resources to a backup plan. |
| [`CfnBackupSelection.ConditionResourceTypeProperty`](/v2/docs/aws-cdk-lib.aws_backup.CfnBackupSelection.ConditionResourceTypeProperty) | Struct | Specifies an object that contains an array of triplets made up of a condition type (such as `STRINGEQUALS` ), a key, and a value. |
| [`CfnBackupSelection.ConditionsProperty`](/v2/docs/aws-cdk-lib.aws_backup.CfnBackupSelection.ConditionsProperty) | Struct | Contains information about which resources to include or exclude from a backup plan using their tags. |
| [`CfnBackupSelectionProps`](/v2/docs/aws-cdk-lib.aws_backup.CfnBackupSelectionProps) | Struct | Properties for defining a `CfnBackupSelection`. |
| [`CfnBackupVault.LockConfigurationTypeProperty`](/v2/docs/aws-cdk-lib.aws_backup.CfnBackupVault.LockConfigurationTypeProperty) | Struct | The `LockConfigurationType` property type specifies configuration for [AWS Backup Vault Lock](https://docs.aws.amazon.com/aws-backup/latest/devguide/vault-lock.html) . |
| [`CfnBackupVault.NotificationObjectTypeProperty`](/v2/docs/aws-cdk-lib.aws_backup.CfnBackupVault.NotificationObjectTypeProperty) | Struct | Specifies an object containing SNS event notification properties for the target backup vault. |
| [`CfnBackupVaultProps`](/v2/docs/aws-cdk-lib.aws_backup.CfnBackupVaultProps) | Struct | Properties for defining a `CfnBackupVault`. |
| [`CfnFramework.ControlInputParameterProperty`](/v2/docs/aws-cdk-lib.aws_backup.CfnFramework.ControlInputParameterProperty) | Struct | The parameters for a control. |
| [`CfnFramework.ControlScopeProperty`](/v2/docs/aws-cdk-lib.aws_backup.CfnFramework.ControlScopeProperty) | Struct | A framework consists of one or more controls. |
| [`CfnFramework.FrameworkControlProperty`](/v2/docs/aws-cdk-lib.aws_backup.CfnFramework.FrameworkControlProperty) | Struct | Contains detailed information about all of the controls of a framework. |
| [`CfnFrameworkProps`](/v2/docs/aws-cdk-lib.aws_backup.CfnFrameworkProps) | Struct | Properties for defining a `CfnFramework`. |
| [`CfnLegalHold.DateRangeProperty`](/v2/docs/aws-cdk-lib.aws_backup.CfnLegalHold.DateRangeProperty) | Struct | A date range for filtering recovery points. |
| [`CfnLegalHold.RecoveryPointSelectionProperty`](/v2/docs/aws-cdk-lib.aws_backup.CfnLegalHold.RecoveryPointSelectionProperty) | Struct | The criteria to assign a set of resources, such as resource types or backup vaults. |
| [`CfnLegalHold.TagsItemsProperty`](/v2/docs/aws-cdk-lib.aws_backup.CfnLegalHold.TagsItemsProperty) | Struct |  |
| [`CfnLegalHoldProps`](/v2/docs/aws-cdk-lib.aws_backup.CfnLegalHoldProps) | Struct | Properties for defining a `CfnLegalHold`. |
| [`CfnLogicallyAirGappedBackupVault.NotificationObjectTypeProperty`](/v2/docs/aws-cdk-lib.aws_backup.CfnLogicallyAirGappedBackupVault.NotificationObjectTypeProperty) | Struct |  |
| [`CfnLogicallyAirGappedBackupVaultProps`](/v2/docs/aws-cdk-lib.aws_backup.CfnLogicallyAirGappedBackupVaultProps) | Struct | Properties for defining a `CfnLogicallyAirGappedBackupVault`. |
| [`CfnReportPlan.ReportDeliveryChannelProperty`](/v2/docs/aws-cdk-lib.aws_backup.CfnReportPlan.ReportDeliveryChannelProperty) | Struct | Contains information from your report plan about where to deliver your reports, specifically your Amazon S3 bucket name, S3 key prefix, and the formats of your reports. |
| [`CfnReportPlan.ReportSettingProperty`](/v2/docs/aws-cdk-lib.aws_backup.CfnReportPlan.ReportSettingProperty) | Struct | Contains detailed information about a report setting. |
| [`CfnReportPlanProps`](/v2/docs/aws-cdk-lib.aws_backup.CfnReportPlanProps) | Struct | Properties for defining a `CfnReportPlan`. |
| [`CfnRestoreTestingPlan.RestoreTestingRecoveryPointSelectionProperty`](/v2/docs/aws-cdk-lib.aws_backup.CfnRestoreTestingPlan.RestoreTestingRecoveryPointSelectionProperty) | Struct | `RecoveryPointSelection` has five parameters (three required and two optional). |
| [`CfnRestoreTestingPlanProps`](/v2/docs/aws-cdk-lib.aws_backup.CfnRestoreTestingPlanProps) | Struct | Properties for defining a `CfnRestoreTestingPlan`. |
| [`CfnRestoreTestingSelection.KeyValueProperty`](/v2/docs/aws-cdk-lib.aws_backup.CfnRestoreTestingSelection.KeyValueProperty) | Struct | Pair of two related strings. |
| [`CfnRestoreTestingSelection.ProtectedResourceConditionsProperty`](/v2/docs/aws-cdk-lib.aws_backup.CfnRestoreTestingSelection.ProtectedResourceConditionsProperty) | Struct | The conditions that you define for resources in your restore testing plan using tags. |
| [`CfnRestoreTestingSelectionProps`](/v2/docs/aws-cdk-lib.aws_backup.CfnRestoreTestingSelectionProps) | Struct | Properties for defining a `CfnRestoreTestingSelection`. |
| [`CfnTieringConfiguration.ResourceSelectionProperty`](/v2/docs/aws-cdk-lib.aws_backup.CfnTieringConfiguration.ResourceSelectionProperty) | Struct |  |
| [`CfnTieringConfigurationProps`](/v2/docs/aws-cdk-lib.aws_backup.CfnTieringConfigurationProps) | Struct | Properties for defining a `CfnTieringConfiguration`. |
| [`IBackupPlan`](/v2/docs/aws-cdk-lib.aws_backup.IBackupPlan) | Interface | A backup plan. |
| [`IBackupVault`](/v2/docs/aws-cdk-lib.aws_backup.IBackupVault) | Interface | A backup vault. |
| [`IndexActionResourceType`](/v2/docs/aws-cdk-lib.aws_backup.IndexActionResourceType) | Class | The resource type to index. |
| [`LockConfiguration`](/v2/docs/aws-cdk-lib.aws_backup.LockConfiguration) | Struct | Configuration for AWS Backup Vault Lock. |
| [`TagCondition`](/v2/docs/aws-cdk-lib.aws_backup.TagCondition) | Struct | A tag condition. |
| [`TagOperation`](/v2/docs/aws-cdk-lib.aws_backup.TagOperation) | Enum | An operation that is applied to a key-value pair. |