Namespace Amazon.CDK.AWS.Backup

AWS Backup Construct Library

AWS Backup is a fully managed backup service that makes it easy to centralize and automate the backup of data across AWS services in the cloud and on premises. Using AWS Backup, you can configure backup policies and monitor backup activity for your AWS resources in one place.

Backup plan and selection

In AWS Backup, a backup plan is a policy expression that defines when and how you want to back up your AWS resources, such as Amazon DynamoDB tables or Amazon Elastic File System (Amazon EFS) file systems. You can assign resources to backup plans, and AWS Backup automatically backs up and retains backups for those resources according to the backup plan. You can create multiple backup plans if you have workloads with different backup requirements.

This module provides ready-made backup plans (similar to the console experience):

// Daily, weekly and monthly with 5 year retention
var plan = BackupPlan.DailyWeeklyMonthly5YearRetention(this, "Plan");

Assigning resources to a plan can be done with addSelection():

BackupPlan plan;
Vpc vpc;

var myTable = Table.FromTableName(this, "Table", "myTableName");
var myDatabaseInstance = new DatabaseInstance(this, "DatabaseInstance", new DatabaseInstanceProps {
    Engine = DatabaseInstanceEngine.Mysql(new MySqlInstanceEngineProps { Version = MysqlEngineVersion.VER_8_0_26 }),
    Vpc = vpc
});
var myDatabaseCluster = new DatabaseCluster(this, "DatabaseCluster", new DatabaseClusterProps {
    Engine = DatabaseClusterEngine.AuroraMysql(new AuroraMysqlClusterEngineProps { Version = AuroraMysqlEngineVersion.VER_2_08_1 }),
    Credentials = Credentials.FromGeneratedSecret("clusteradmin"),
    InstanceProps = new InstanceProps {
        Vpc = vpc
    }
});
var myServerlessCluster = new ServerlessCluster(this, "ServerlessCluster", new ServerlessClusterProps {
    Engine = DatabaseClusterEngine.AURORA_POSTGRESQL,
    ParameterGroup = ParameterGroup.FromParameterGroupName(this, "ParameterGroup", "default.aurora-postgresql11"),
    Vpc = vpc
});
var myCoolConstruct = new Construct(this, "MyCoolConstruct");

plan.AddSelection("Selection", new BackupSelectionOptions {
    Resources = new [] { BackupResource.FromDynamoDbTable(myTable), BackupResource.FromRdsDatabaseInstance(myDatabaseInstance), BackupResource.FromRdsDatabaseCluster(myDatabaseCluster), BackupResource.FromRdsServerlessCluster(myServerlessCluster), BackupResource.FromTag("stage", "prod"), BackupResource.FromConstruct(myCoolConstruct) }
});

If not specified, a new IAM role with a managed policy for backup will be created for the selection. The BackupSelection implements IGrantable.

To disable the plan from assigning the default AWSBackupServiceRolePolicyForBackup backup policy use the disableDefaultBackupPolicy property.

This is useful if you want to avoid granting unnecessary permissions to the role.

BackupPlan plan;


var role = new Role(this, "BackupRole", new RoleProps {
    AssumedBy = new ServicePrincipal("backup.amazonaws.com")
});
// Assign S3-specific backup policy
role.AddManagedPolicy(ManagedPolicy.FromAwsManagedPolicyName("AWSBackupServiceRolePolicyForS3Backup"));

plan.AddSelection("Selection", new BackupSelectionOptions {
    Resources = new [] { BackupResource.FromTag("stage", "prod") },
    Role = role,
    DisableDefaultBackupPolicy = true
});

To add rules to a plan, use addRule():

BackupPlan plan;

plan.AddRule(new BackupPlanRule(new BackupPlanRuleProps {
    CompletionWindow = Duration.Hours(2),
    StartWindow = Duration.Hours(1),
    ScheduleExpression = Schedule.Cron(new CronOptions {  // Only cron expressions are supported
        Day = "15",
        Hour = "3",
        Minute = "30" }),
    MoveToColdStorageAfter = Duration.Days(30)
}));

Continuous backup and point-in-time restores (PITR) can be configured. Property deleteAfter defines the retention period for the backup. It is mandatory if PITR is enabled. If no value is specified, the retention period is set to 35 days which is the maximum retention period supported by PITR. Property moveToColdStorageAfter must not be specified because PITR does not support this option. This example defines an AWS Backup rule with PITR and a retention period set to 14 days:

BackupPlan plan;

plan.AddRule(new BackupPlanRule(new BackupPlanRuleProps {
    EnableContinuousBackup = true,
    DeleteAfter = Duration.Days(14)
}));

Rules can also specify to copy recovery points to another Backup Vault using copyActions. Copied recovery points can optionally have moveToColdStorageAfter and deleteAfter configured.

BackupPlan plan;
BackupVault secondaryVault;

plan.AddRule(new BackupPlanRule(new BackupPlanRuleProps {
    CopyActions = new [] { new BackupPlanCopyActionProps {
        DestinationBackupVault = secondaryVault,
        MoveToColdStorageAfter = Duration.Days(30),
        DeleteAfter = Duration.Days(120)
    } }
}));

You can assign your own metadata to the resources that are associated with the rule when restored from backup using recoveryPointTags. Each tag is a key-value pair.

BackupPlan plan;

plan.AddRule(new BackupPlanRule(new BackupPlanRuleProps {
    RecoveryPointTags = new Dictionary<string, string> {
        { "key", "value" }
    }
}));

Ready-made rules are also available:

BackupPlan plan;

plan.AddRule(BackupPlanRule.Daily());
plan.AddRule(BackupPlanRule.Weekly());

By default a new vault is created when creating a plan. It is also possible to specify a vault either at the plan level or at the rule level.

var myVault = BackupVault.FromBackupVaultName(this, "Vault1", "myVault");
var otherVault = BackupVault.FromBackupVaultName(this, "Vault2", "otherVault");

var plan = BackupPlan.Daily35DayRetention(this, "Plan", myVault); // Use `myVault` for all plan rules
plan.AddRule(BackupPlanRule.Monthly1Year(otherVault));

You can backup VSS-enabled Windows applications running on Amazon EC2 instances by setting the windowsVss parameter to true. If the application has VSS writer registered with Windows VSS, then AWS Backup creates a snapshot that will be consistent for that application.

var plan = new BackupPlan(this, "Plan", new BackupPlanProps {
    WindowsVss = true
});

Backup vault

In AWS Backup, a backup vault is a container that you organize your backups in. You can use backup vaults to set the AWS Key Management Service (AWS KMS) encryption key that is used to encrypt backups in the backup vault and to control access to the backups in the backup vault. If you require different encryption keys or access policies for different groups of backups, you can optionally create multiple backup vaults.

var myKey = Key.FromKeyArn(this, "MyKey", "aaa");
var myTopic = Topic.FromTopicArn(this, "MyTopic", "bbb");

var vault = new BackupVault(this, "Vault", new BackupVaultProps {
    EncryptionKey = myKey,  // Custom encryption key
    NotificationTopic = myTopic
});

A vault has a default RemovalPolicy set to RETAIN. Note that removing a vault that contains recovery points will fail.

You can assign policies to backup vaults and the resources they contain. Assigning policies allows you to do things like grant access to users to create backup plans and on-demand backups, but limit their ability to delete recovery points after they're created.

Use the accessPolicy property to create a backup vault policy:

var vault = new BackupVault(this, "Vault", new BackupVaultProps {
    AccessPolicy = new PolicyDocument(new PolicyDocumentProps {
        Statements = new [] {
            new PolicyStatement(new PolicyStatementProps {
                Effect = Effect.DENY,
                Principals = new [] { new AnyPrincipal() },
                Actions = new [] { "backup:DeleteRecoveryPoint" },
                Resources = new [] { "*" },
                Conditions = new Dictionary<string, object> {
                    { "StringNotLike", new Dictionary<string, string[]> {
                        { "aws:userId", new [] { "user1", "user2" } }
                    } }
                }
            }) }
    })
});

Alternativately statements can be added to the vault policy using addToAccessPolicy().

Use the blockRecoveryPointDeletion property or the blockRecoveryPointDeletion() method to add a statement to the vault access policy that prevents recovery point deletions in your vault:

BackupVault backupVault;
new BackupVault(this, "Vault", new BackupVaultProps {
    BlockRecoveryPointDeletion = true
});
backupVault.BlockRecoveryPointDeletion();

By default access is not restricted.

Use the lockConfiguration property to enable AWS Backup Vault Lock:

new BackupVault(this, "Vault", new BackupVaultProps {
    LockConfiguration = new LockConfiguration {
        MinRetention = Duration.Days(30)
    }
});

Importing existing backup vault

To import an existing backup vault into your CDK application, use the BackupVault.fromBackupVaultArn or BackupVault.fromBackupVaultName static method. Here is an example of giving an IAM Role permission to start a backup job:

var importedVault = BackupVault.FromBackupVaultName(this, "Vault", "myVaultName");

var role = new Role(this, "Access Role", new RoleProps { AssumedBy = new ServicePrincipal("lambda.amazonaws.com") });

importedVault.Grant(role, "backup:StartBackupJob");

Classes

BackupPlan	A backup plan.
BackupPlanCopyActionProps	Properties for a BackupPlanCopyAction.
BackupPlanProps	Properties for a BackupPlan.
BackupPlanRule	A backup plan rule.
BackupPlanRuleProps	Properties for a BackupPlanRule.
BackupResource	A resource to backup.
BackupSelection	A backup selection.
BackupSelectionOptions	Options for a BackupSelection.
BackupSelectionProps	Properties for a BackupSelection.
BackupVault	A backup vault.
BackupVaultEvents	Backup vault events.
BackupVaultProps	Properties for a BackupVault.
CfnBackupPlan	Contains an optional backup plan display name and an array of `BackupRule` objects, each of which specifies a backup rule.
CfnBackupPlan.AdvancedBackupSettingResourceTypeProperty	Specifies an object containing resource type and backup options.
CfnBackupPlan.BackupPlanResourceTypeProperty	Specifies an object containing properties used to create a backup plan.
CfnBackupPlan.BackupRuleResourceTypeProperty	Specifies an object containing properties used to schedule a task to back up a selection of resources.
CfnBackupPlan.CopyActionResourceTypeProperty	Copies backups created by a backup rule to another vault.
CfnBackupPlan.IndexActionsResourceTypeProperty
CfnBackupPlan.LifecycleResourceTypeProperty	Specifies an object containing an array of `Transition` objects that determine how long in days before a recovery point transitions to cold storage or is deleted.
CfnBackupPlanProps	Properties for defining a `CfnBackupPlan`.
CfnBackupSelection	Specifies a set of resources to assign to a backup plan.
CfnBackupSelection.BackupSelectionResourceTypeProperty	Specifies an object containing properties used to assign a set of resources to a backup plan.
CfnBackupSelection.ConditionParameterProperty	Includes information about tags you define to assign tagged resources to a backup plan.
CfnBackupSelection.ConditionResourceTypeProperty	Specifies an object that contains an array of triplets made up of a condition type (such as `STRINGEQUALS` ), a key, and a value.
CfnBackupSelection.ConditionsProperty	Contains information about which resources to include or exclude from a backup plan using their tags.
CfnBackupSelectionProps	Properties for defining a `CfnBackupSelection`.
CfnBackupVault	Creates a logical container where backups are stored.
CfnBackupVault.LockConfigurationTypeProperty	The `LockConfigurationType` property type specifies configuration for AWS Backup Vault Lock .
CfnBackupVault.NotificationObjectTypeProperty	Specifies an object containing SNS event notification properties for the target backup vault.
CfnBackupVaultProps	Properties for defining a `CfnBackupVault`.
CfnFramework	Creates a framework with one or more controls.
CfnFramework.ControlInputParameterProperty	The parameters for a control.
CfnFramework.ControlScopeProperty	A framework consists of one or more controls.
CfnFramework.FrameworkControlProperty	Contains detailed information about all of the controls of a framework.
CfnFrameworkProps	Properties for defining a `CfnFramework`.
CfnLogicallyAirGappedBackupVault	Creates a logical container to where backups may be copied.
CfnLogicallyAirGappedBackupVault.NotificationObjectTypeProperty
CfnLogicallyAirGappedBackupVaultProps	Properties for defining a `CfnLogicallyAirGappedBackupVault`.
CfnReportPlan	Creates a report plan.
CfnReportPlan.ReportDeliveryChannelProperty	Contains information from your report plan about where to deliver your reports, specifically your Amazon S3 bucket name, S3 key prefix, and the formats of your reports.
CfnReportPlan.ReportSettingProperty	Contains detailed information about a report setting.
CfnReportPlanProps	Properties for defining a `CfnReportPlan`.
CfnRestoreTestingPlan	Creates a restore testing plan.
CfnRestoreTestingPlan.RestoreTestingRecoveryPointSelectionProperty	`RecoveryPointSelection` has five parameters (three required and two optional).
CfnRestoreTestingPlanProps	Properties for defining a `CfnRestoreTestingPlan`.
CfnRestoreTestingSelection	This request can be sent after CreateRestoreTestingPlan request returns successfully.
CfnRestoreTestingSelection.KeyValueProperty	Pair of two related strings.
CfnRestoreTestingSelection.ProtectedResourceConditionsProperty	The conditions that you define for resources in your restore testing plan using tags.
CfnRestoreTestingSelectionProps	Properties for defining a `CfnRestoreTestingSelection`.
LockConfiguration	Configuration for AWS Backup Vault Lock.
TagCondition	A tag condition.
TagOperation	An operation that is applied to a key-value pair.

Interfaces

CfnBackupPlan.IAdvancedBackupSettingResourceTypeProperty	Specifies an object containing resource type and backup options.
CfnBackupPlan.IBackupPlanResourceTypeProperty	Specifies an object containing properties used to create a backup plan.
CfnBackupPlan.IBackupRuleResourceTypeProperty	Specifies an object containing properties used to schedule a task to back up a selection of resources.
CfnBackupPlan.ICopyActionResourceTypeProperty	Copies backups created by a backup rule to another vault.
CfnBackupPlan.IIndexActionsResourceTypeProperty
CfnBackupPlan.ILifecycleResourceTypeProperty	Specifies an object containing an array of `Transition` objects that determine how long in days before a recovery point transitions to cold storage or is deleted.
CfnBackupSelection.IBackupSelectionResourceTypeProperty	Specifies an object containing properties used to assign a set of resources to a backup plan.
CfnBackupSelection.IConditionParameterProperty	Includes information about tags you define to assign tagged resources to a backup plan.
CfnBackupSelection.IConditionResourceTypeProperty	Specifies an object that contains an array of triplets made up of a condition type (such as `STRINGEQUALS` ), a key, and a value.
CfnBackupSelection.IConditionsProperty	Contains information about which resources to include or exclude from a backup plan using their tags.
CfnBackupVault.ILockConfigurationTypeProperty	The `LockConfigurationType` property type specifies configuration for AWS Backup Vault Lock .
CfnBackupVault.INotificationObjectTypeProperty	Specifies an object containing SNS event notification properties for the target backup vault.
CfnFramework.IControlInputParameterProperty	The parameters for a control.
CfnFramework.IControlScopeProperty	A framework consists of one or more controls.
CfnFramework.IFrameworkControlProperty	Contains detailed information about all of the controls of a framework.
CfnLogicallyAirGappedBackupVault.INotificationObjectTypeProperty
CfnReportPlan.IReportDeliveryChannelProperty	Contains information from your report plan about where to deliver your reports, specifically your Amazon S3 bucket name, S3 key prefix, and the formats of your reports.
CfnReportPlan.IReportSettingProperty	Contains detailed information about a report setting.
CfnRestoreTestingPlan.IRestoreTestingRecoveryPointSelectionProperty	`RecoveryPointSelection` has five parameters (three required and two optional).
CfnRestoreTestingSelection.IKeyValueProperty	Pair of two related strings.
CfnRestoreTestingSelection.IProtectedResourceConditionsProperty	The conditions that you define for resources in your restore testing plan using tags.
IBackupPlan	A backup plan.
IBackupPlanCopyActionProps	Properties for a BackupPlanCopyAction.
IBackupPlanProps	Properties for a BackupPlan.
IBackupPlanRuleProps	Properties for a BackupPlanRule.
IBackupSelectionOptions	Options for a BackupSelection.
IBackupSelectionProps	Properties for a BackupSelection.
IBackupVault	A backup vault.
IBackupVaultProps	Properties for a BackupVault.
ICfnBackupPlanProps	Properties for defining a `CfnBackupPlan`.
ICfnBackupSelectionProps	Properties for defining a `CfnBackupSelection`.
ICfnBackupVaultProps	Properties for defining a `CfnBackupVault`.
ICfnFrameworkProps	Properties for defining a `CfnFramework`.
ICfnLogicallyAirGappedBackupVaultProps	Properties for defining a `CfnLogicallyAirGappedBackupVault`.
ICfnReportPlanProps	Properties for defining a `CfnReportPlan`.
ICfnRestoreTestingPlanProps	Properties for defining a `CfnRestoreTestingPlan`.
ICfnRestoreTestingSelectionProps	Properties for defining a `CfnRestoreTestingSelection`.
ILockConfiguration	Configuration for AWS Backup Vault Lock.
ITagCondition	A tag condition.