aws-cdk-lib.aws_backup

AWS Backup Construct Library

AWS Backup is a fully managed backup service that makes it easy to centralize and automate the backup of data across AWS services in the cloud and on premises. Using AWS Backup, you can configure backup policies and monitor backup activity for your AWS resources in one place.

Backup plan and selection

In AWS Backup, a backup plan is a policy expression that defines when and how you want to back up your AWS resources, such as Amazon DynamoDB tables or Amazon Elastic File System (Amazon EFS) file systems. You can assign resources to backup plans, and AWS Backup automatically backs up and retains backups for those resources according to the backup plan. You can create multiple backup plans if you have workloads with different backup requirements.

This module provides ready-made backup plans (similar to the console experience):

// Daily, weekly and monthly with 5 year retention
const plan = backup.BackupPlan.dailyWeeklyMonthly5YearRetention(this, 'Plan');

# Daily, weekly and monthly with 5 year retention
plan = backup.BackupPlan.daily_weekly_monthly5_year_retention(self, "Plan")

// Daily, weekly and monthly with 5 year retention
BackupPlan plan = BackupPlan.dailyWeeklyMonthly5YearRetention(this, "Plan");

// Daily, weekly and monthly with 5 year retention
var plan = BackupPlan.DailyWeeklyMonthly5YearRetention(this, "Plan");

// Daily, weekly and monthly with 5 year retention
plan := backup.BackupPlan_DailyWeeklyMonthly5YearRetention(this, jsii.String("Plan"))

Assigning resources to a plan can be done with addSelection():

declare const plan: backup.BackupPlan;
declare const vpc: ec2.Vpc;
const myTable = dynamodb.Table.fromTableName(this, 'Table', 'myTableName');
const myDatabaseInstance = new rds.DatabaseInstance(this, 'DatabaseInstance', {
  engine: rds.DatabaseInstanceEngine.mysql({ version: rds.MysqlEngineVersion.VER_8_0_26 }),
  vpc,
});
const myDatabaseCluster = new rds.DatabaseCluster(this, 'DatabaseCluster', {
  engine: rds.DatabaseClusterEngine.auroraMysql({ version: rds.AuroraMysqlEngineVersion.VER_2_08_1 }),
  credentials: rds.Credentials.fromGeneratedSecret('clusteradmin'),
  instanceProps: {
    vpc,
  },
});
const myServerlessCluster = new rds.ServerlessCluster(this, 'ServerlessCluster', {
  engine: rds.DatabaseClusterEngine.AURORA_POSTGRESQL,
  parameterGroup: rds.ParameterGroup.fromParameterGroupName(this, 'ParameterGroup', 'default.aurora-postgresql11'),
  vpc,
});
const myCoolConstruct = new Construct(this, 'MyCoolConstruct');

plan.addSelection('Selection', {
  resources: [
    backup.BackupResource.fromDynamoDbTable(myTable), // A DynamoDB table
    backup.BackupResource.fromRdsDatabaseInstance(myDatabaseInstance), // A RDS instance
    backup.BackupResource.fromRdsDatabaseCluster(myDatabaseCluster), // A RDS database cluster
    backup.BackupResource.fromRdsServerlessCluster(myServerlessCluster), // An Aurora Serverless cluster
    backup.BackupResource.fromTag('stage', 'prod'), // All resources that are tagged stage=prod in the region/account
    backup.BackupResource.fromConstruct(myCoolConstruct), // All backupable resources in `myCoolConstruct`
  ]
})

# plan: backup.BackupPlan
# vpc: ec2.Vpc

my_table = dynamodb.Table.from_table_name(self, "Table", "myTableName")
my_database_instance = rds.DatabaseInstance(self, "DatabaseInstance",
    engine=rds.DatabaseInstanceEngine.mysql(version=rds.MysqlEngineVersion.VER_8_0_26),
    vpc=vpc
)
my_database_cluster = rds.DatabaseCluster(self, "DatabaseCluster",
    engine=rds.DatabaseClusterEngine.aurora_mysql(version=rds.AuroraMysqlEngineVersion.VER_2_08_1),
    credentials=rds.Credentials.from_generated_secret("clusteradmin"),
    instance_props=rds.InstanceProps(
        vpc=vpc
    )
)
my_serverless_cluster = rds.ServerlessCluster(self, "ServerlessCluster",
    engine=rds.DatabaseClusterEngine.AURORA_POSTGRESQL,
    parameter_group=rds.ParameterGroup.from_parameter_group_name(self, "ParameterGroup", "default.aurora-postgresql11"),
    vpc=vpc
)
my_cool_construct = Construct(self, "MyCoolConstruct")

plan.add_selection("Selection",
    resources=[
        backup.BackupResource.from_dynamo_db_table(my_table),  # A DynamoDB table
        backup.BackupResource.from_rds_database_instance(my_database_instance),  # A RDS instance
        backup.BackupResource.from_rds_database_cluster(my_database_cluster),  # A RDS database cluster
        backup.BackupResource.from_rds_serverless_cluster(my_serverless_cluster),  # An Aurora Serverless cluster
        backup.BackupResource.from_tag("stage", "prod"),  # All resources that are tagged stage=prod in the region/account
        backup.BackupResource.from_construct(my_cool_construct)
    ]
)

BackupPlan plan;
Vpc vpc;

ITable myTable = Table.fromTableName(this, "Table", "myTableName");
DatabaseInstance myDatabaseInstance = DatabaseInstance.Builder.create(this, "DatabaseInstance")
        .engine(DatabaseInstanceEngine.mysql(MySqlInstanceEngineProps.builder().version(MysqlEngineVersion.VER_8_0_26).build()))
        .vpc(vpc)
        .build();
DatabaseCluster myDatabaseCluster = DatabaseCluster.Builder.create(this, "DatabaseCluster")
        .engine(DatabaseClusterEngine.auroraMysql(AuroraMysqlClusterEngineProps.builder().version(AuroraMysqlEngineVersion.VER_2_08_1).build()))
        .credentials(Credentials.fromGeneratedSecret("clusteradmin"))
        .instanceProps(InstanceProps.builder()
                .vpc(vpc)
                .build())
        .build();
ServerlessCluster myServerlessCluster = ServerlessCluster.Builder.create(this, "ServerlessCluster")
        .engine(DatabaseClusterEngine.AURORA_POSTGRESQL)
        .parameterGroup(ParameterGroup.fromParameterGroupName(this, "ParameterGroup", "default.aurora-postgresql11"))
        .vpc(vpc)
        .build();
Construct myCoolConstruct = new Construct(this, "MyCoolConstruct");

plan.addSelection("Selection", BackupSelectionOptions.builder()
        .resources(List.of(BackupResource.fromDynamoDbTable(myTable), BackupResource.fromRdsDatabaseInstance(myDatabaseInstance), BackupResource.fromRdsDatabaseCluster(myDatabaseCluster), BackupResource.fromRdsServerlessCluster(myServerlessCluster), BackupResource.fromTag("stage", "prod"), BackupResource.fromConstruct(myCoolConstruct)))
        .build());

BackupPlan plan;
Vpc vpc;

var myTable = Table.FromTableName(this, "Table", "myTableName");
var myDatabaseInstance = new DatabaseInstance(this, "DatabaseInstance", new DatabaseInstanceProps {
    Engine = DatabaseInstanceEngine.Mysql(new MySqlInstanceEngineProps { Version = MysqlEngineVersion.VER_8_0_26 }),
    Vpc = vpc
});
var myDatabaseCluster = new DatabaseCluster(this, "DatabaseCluster", new DatabaseClusterProps {
    Engine = DatabaseClusterEngine.AuroraMysql(new AuroraMysqlClusterEngineProps { Version = AuroraMysqlEngineVersion.VER_2_08_1 }),
    Credentials = Credentials.FromGeneratedSecret("clusteradmin"),
    InstanceProps = new InstanceProps {
        Vpc = vpc
    }
});
var myServerlessCluster = new ServerlessCluster(this, "ServerlessCluster", new ServerlessClusterProps {
    Engine = DatabaseClusterEngine.AURORA_POSTGRESQL,
    ParameterGroup = ParameterGroup.FromParameterGroupName(this, "ParameterGroup", "default.aurora-postgresql11"),
    Vpc = vpc
});
var myCoolConstruct = new Construct(this, "MyCoolConstruct");

plan.AddSelection("Selection", new BackupSelectionOptions {
    Resources = new [] { BackupResource.FromDynamoDbTable(myTable), BackupResource.FromRdsDatabaseInstance(myDatabaseInstance), BackupResource.FromRdsDatabaseCluster(myDatabaseCluster), BackupResource.FromRdsServerlessCluster(myServerlessCluster), BackupResource.FromTag("stage", "prod"), BackupResource.FromConstruct(myCoolConstruct) }
});

var plan BackupPlan
var vpc Vpc

myTable := dynamodb.Table_FromTableName(this, jsii.String("Table"), jsii.String("myTableName"))
myDatabaseInstance := rds.NewDatabaseInstance(this, jsii.String("DatabaseInstance"), &DatabaseInstanceProps{
	Engine: rds.DatabaseInstanceEngine_Mysql(&MySqlInstanceEngineProps{
		Version: rds.MysqlEngineVersion_VER_8_0_26(),
	}),
	Vpc: Vpc,
})
myDatabaseCluster := rds.NewDatabaseCluster(this, jsii.String("DatabaseCluster"), &DatabaseClusterProps{
	Engine: rds.DatabaseClusterEngine_AuroraMysql(&AuroraMysqlClusterEngineProps{
		Version: rds.AuroraMysqlEngineVersion_VER_2_08_1(),
	}),
	Credentials: rds.Credentials_FromGeneratedSecret(jsii.String("clusteradmin")),
	InstanceProps: &InstanceProps{
		Vpc: *Vpc,
	},
})
myServerlessCluster := rds.NewServerlessCluster(this, jsii.String("ServerlessCluster"), &ServerlessClusterProps{
	Engine: rds.DatabaseClusterEngine_AURORA_POSTGRESQL(),
	ParameterGroup: rds.ParameterGroup_FromParameterGroupName(this, jsii.String("ParameterGroup"), jsii.String("default.aurora-postgresql11")),
	Vpc: Vpc,
})
myCoolConstruct := constructs.NewConstruct(this, jsii.String("MyCoolConstruct"))

plan.AddSelection(jsii.String("Selection"), &BackupSelectionOptions{
	Resources: []BackupResource{
		backup.BackupResource_FromDynamoDbTable(myTable),
		backup.BackupResource_FromRdsDatabaseInstance(myDatabaseInstance),
		backup.BackupResource_FromRdsDatabaseCluster(myDatabaseCluster),
		backup.BackupResource_FromRdsServerlessCluster(myServerlessCluster),
		backup.BackupResource_FromTag(jsii.String("stage"), jsii.String("prod")),
		backup.BackupResource_FromConstruct(myCoolConstruct),
	},
})

If not specified, a new IAM role with a managed policy for backup will be created for the selection. The BackupSelection implements IGrantable.

To disable the plan from assigning the default AWSBackupServiceRolePolicyForBackup backup policy use the disableDefaultBackupPolicy property.

This is useful if you want to avoid granting unnecessary permissions to the role.

declare const plan: backup.BackupPlan;

const role = new iam.Role(this, 'BackupRole', {
  assumedBy: new iam.ServicePrincipal('backup.amazonaws.com'),
});
// Assign S3-specific backup policy
role.addManagedPolicy(iam.ManagedPolicy.fromAwsManagedPolicyName('AWSBackupServiceRolePolicyForS3Backup'));

plan.addSelection('Selection', {
  resources: [
    backup.BackupResource.fromTag('stage', 'prod'),
  ],
  role,
  disableDefaultBackupPolicy: true,
});

# plan: backup.BackupPlan


role = iam.Role(self, "BackupRole",
    assumed_by=iam.ServicePrincipal("backup.amazonaws.com")
)
# Assign S3-specific backup policy
role.add_managed_policy(iam.ManagedPolicy.from_aws_managed_policy_name("AWSBackupServiceRolePolicyForS3Backup"))

plan.add_selection("Selection",
    resources=[
        backup.BackupResource.from_tag("stage", "prod")
    ],
    role=role,
    disable_default_backup_policy=True
)

BackupPlan plan;


Role role = Role.Builder.create(this, "BackupRole")
        .assumedBy(new ServicePrincipal("backup.amazonaws.com"))
        .build();
// Assign S3-specific backup policy
role.addManagedPolicy(ManagedPolicy.fromAwsManagedPolicyName("AWSBackupServiceRolePolicyForS3Backup"));

plan.addSelection("Selection", BackupSelectionOptions.builder()
        .resources(List.of(BackupResource.fromTag("stage", "prod")))
        .role(role)
        .disableDefaultBackupPolicy(true)
        .build());

BackupPlan plan;


var role = new Role(this, "BackupRole", new RoleProps {
    AssumedBy = new ServicePrincipal("backup.amazonaws.com")
});
// Assign S3-specific backup policy
role.AddManagedPolicy(ManagedPolicy.FromAwsManagedPolicyName("AWSBackupServiceRolePolicyForS3Backup"));

plan.AddSelection("Selection", new BackupSelectionOptions {
    Resources = new [] { BackupResource.FromTag("stage", "prod") },
    Role = role,
    DisableDefaultBackupPolicy = true
});

var plan BackupPlan


role := iam.NewRole(this, jsii.String("BackupRole"), &RoleProps{
	AssumedBy: iam.NewServicePrincipal(jsii.String("backup.amazonaws.com")),
})
// Assign S3-specific backup policy
role.AddManagedPolicy(iam.ManagedPolicy_FromAwsManagedPolicyName(jsii.String("AWSBackupServiceRolePolicyForS3Backup")))

plan.AddSelection(jsii.String("Selection"), &BackupSelectionOptions{
	Resources: []BackupResource{
		backup.BackupResource_FromTag(jsii.String("stage"), jsii.String("prod")),
	},
	Role: Role,
	DisableDefaultBackupPolicy: jsii.Boolean(true),
})

To add rules to a plan, use addRule():

import { TimeZone } from 'aws-cdk-lib';
declare const plan: backup.BackupPlan;
plan.addRule(new backup.BackupPlanRule({
  completionWindow: Duration.hours(2),
  startWindow: Duration.hours(1),
  scheduleExpression: events.Schedule.cron({ // Only cron expressions are supported
    day: '15',
    hour: '3',
    minute: '30',
  }),
  scheduleExpressionTimezone: TimeZone.ETC_UTC,
  moveToColdStorageAfter: Duration.days(30),
}));

from aws_cdk import TimeZone
# plan: backup.BackupPlan

plan.add_rule(backup.BackupPlanRule(
    completion_window=Duration.hours(2),
    start_window=Duration.hours(1),
    schedule_expression=events.Schedule.cron( # Only cron expressions are supported
        day="15",
        hour="3",
        minute="30"),
    schedule_expression_timezone=TimeZone.ETC_UTC,
    move_to_cold_storage_after=Duration.days(30)
))

import software.amazon.awscdk.TimeZone;
BackupPlan plan;

plan.addRule(BackupPlanRule.Builder.create()
        .completionWindow(Duration.hours(2))
        .startWindow(Duration.hours(1))
        .scheduleExpression(Schedule.cron(CronOptions.builder() // Only cron expressions are supported
                .day("15")
                .hour("3")
                .minute("30").build()))
        .scheduleExpressionTimezone(TimeZone.ETC_UTC)
        .moveToColdStorageAfter(Duration.days(30))
        .build());

using Amazon.CDK;
BackupPlan plan;
plan.AddRule(new BackupPlanRule(new BackupPlanRuleProps {
    CompletionWindow = Duration.Hours(2),
    StartWindow = Duration.Hours(1),
    ScheduleExpression = Schedule.Cron(new CronOptions {  // Only cron expressions are supported
        Day = "15",
        Hour = "3",
        Minute = "30" }),
    ScheduleExpressionTimezone = TimeZone.ETC_UTC,
    MoveToColdStorageAfter = Duration.Days(30)
}));

import "github.com/aws/aws-cdk-go/awscdk"
var plan BackupPlan

plan.AddRule(backup.NewBackupPlanRule(&BackupPlanRuleProps{
	CompletionWindow: awscdk.Duration_Hours(jsii.Number(2)),
	StartWindow: awscdk.Duration_*Hours(jsii.Number(1)),
	ScheduleExpression: events.Schedule_Cron(&CronOptions{
		 // Only cron expressions are supported
		Day: jsii.String("15"),
		Hour: jsii.String("3"),
		Minute: jsii.String("30"),
	}),
	ScheduleExpressionTimezone: awscdk.TimeZone_ETC_UTC(),
	MoveToColdStorageAfter: awscdk.Duration_Days(jsii.Number(30)),
}))

Continuous backup and point-in-time restores (PITR) can be configured. Property deleteAfter defines the retention period for the backup. It is mandatory if PITR is enabled. If no value is specified, the retention period is set to 35 days which is the maximum retention period supported by PITR. Property moveToColdStorageAfter must not be specified because PITR does not support this option. This example defines an AWS Backup rule with PITR and a retention period set to 14 days:

declare const plan: backup.BackupPlan;
plan.addRule(new backup.BackupPlanRule({
  enableContinuousBackup: true,
  deleteAfter: Duration.days(14),
}));

# plan: backup.BackupPlan

plan.add_rule(backup.BackupPlanRule(
    enable_continuous_backup=True,
    delete_after=Duration.days(14)
))

BackupPlan plan;

plan.addRule(BackupPlanRule.Builder.create()
        .enableContinuousBackup(true)
        .deleteAfter(Duration.days(14))
        .build());

BackupPlan plan;

plan.AddRule(new BackupPlanRule(new BackupPlanRuleProps {
    EnableContinuousBackup = true,
    DeleteAfter = Duration.Days(14)
}));

var plan BackupPlan

plan.AddRule(backup.NewBackupPlanRule(&BackupPlanRuleProps{
	EnableContinuousBackup: jsii.Boolean(true),
	DeleteAfter: awscdk.Duration_Days(jsii.Number(14)),
}))

Rules can also specify to copy recovery points to another Backup Vault using copyActions. Copied recovery points can optionally have moveToColdStorageAfter and deleteAfter configured.

declare const plan: backup.BackupPlan;
declare const secondaryVault: backup.BackupVault;
plan.addRule(new backup.BackupPlanRule({
  copyActions: [{
    destinationBackupVault: secondaryVault,
    moveToColdStorageAfter: Duration.days(30),
    deleteAfter: Duration.days(120),
  }]
}));

# plan: backup.BackupPlan
# secondary_vault: backup.BackupVault

plan.add_rule(backup.BackupPlanRule(
    copy_actions=[backup.BackupPlanCopyActionProps(
        destination_backup_vault=secondary_vault,
        move_to_cold_storage_after=Duration.days(30),
        delete_after=Duration.days(120)
    )]
))

BackupPlan plan;
BackupVault secondaryVault;

plan.addRule(BackupPlanRule.Builder.create()
        .copyActions(List.of(BackupPlanCopyActionProps.builder()
                .destinationBackupVault(secondaryVault)
                .moveToColdStorageAfter(Duration.days(30))
                .deleteAfter(Duration.days(120))
                .build()))
        .build());

BackupPlan plan;
BackupVault secondaryVault;

plan.AddRule(new BackupPlanRule(new BackupPlanRuleProps {
    CopyActions = new [] { new BackupPlanCopyActionProps {
        DestinationBackupVault = secondaryVault,
        MoveToColdStorageAfter = Duration.Days(30),
        DeleteAfter = Duration.Days(120)
    } }
}));

var plan BackupPlan
var secondaryVault BackupVault

plan.AddRule(backup.NewBackupPlanRule(&BackupPlanRuleProps{
	CopyActions: []BackupPlanCopyActionProps{
		&BackupPlanCopyActionProps{
			DestinationBackupVault: secondaryVault,
			MoveToColdStorageAfter: awscdk.Duration_Days(jsii.Number(30)),
			DeleteAfter: awscdk.Duration_*Days(jsii.Number(120)),
		},
	},
}))

You can assign your own metadata to the resources that are associated with the rule when restored from backup using recoveryPointTags. Each tag is a key-value pair.

declare const plan: backup.BackupPlan;
plan.addRule(new backup.BackupPlanRule({
  recoveryPointTags: {
    key: 'value',
  },
}));

# plan: backup.BackupPlan

plan.add_rule(backup.BackupPlanRule(
    recovery_point_tags={
        "key": "value"
    }
))

BackupPlan plan;

plan.addRule(BackupPlanRule.Builder.create()
        .recoveryPointTags(Map.of(
                "key", "value"))
        .build());

BackupPlan plan;

plan.AddRule(new BackupPlanRule(new BackupPlanRuleProps {
    RecoveryPointTags = new Dictionary<string, string> {
        { "key", "value" }
    }
}));

var plan BackupPlan

plan.AddRule(backup.NewBackupPlanRule(&BackupPlanRuleProps{
	RecoveryPointTags: map[string]*string{
		"key": jsii.String("value"),
	},
}))

You can enable Backup indexes for specific resource types in the rule by using indexActions. Each rule can have at most one index action, and its resourceTypes must list at least one resource type to index.

declare const plan: backup.BackupPlan;
plan.addRule(new backup.BackupPlanRule({
  indexActions: [{
      resourceTypes: [backup.IndexActionResourceType.S3],
  }],
}));

# plan: backup.BackupPlan

plan.add_rule(backup.BackupPlanRule(
    index_actions=[backup.BackupPlanIndexActionProps(
        resource_types=[backup.IndexActionResourceType.S3]
    )]
))

BackupPlan plan;

plan.addRule(BackupPlanRule.Builder.create()
        .indexActions(List.of(BackupPlanIndexActionProps.builder()
                .resourceTypes(List.of(IndexActionResourceType.S3))
                .build()))
        .build());

BackupPlan plan;

plan.AddRule(new BackupPlanRule(new BackupPlanRuleProps {
    IndexActions = new [] { new BackupPlanIndexActionProps {
        ResourceTypes = new [] { IndexActionResourceType.S3 }
    } }
}));

var plan BackupPlan

plan.AddRule(backup.NewBackupPlanRule(&BackupPlanRuleProps{
	IndexActions: []BackupPlanIndexActionProps{
		&BackupPlanIndexActionProps{
			ResourceTypes: []IndexActionResourceType{
				backup.IndexActionResourceType_S3(),
			},
		},
	},
}))

Ready-made rules are also available:

declare const plan: backup.BackupPlan;
plan.addRule(backup.BackupPlanRule.daily());
plan.addRule(backup.BackupPlanRule.weekly());

# plan: backup.BackupPlan

plan.add_rule(backup.BackupPlanRule.daily())
plan.add_rule(backup.BackupPlanRule.weekly())

BackupPlan plan;

plan.addRule(BackupPlanRule.daily());
plan.addRule(BackupPlanRule.weekly());

BackupPlan plan;

plan.AddRule(BackupPlanRule.Daily());
plan.AddRule(BackupPlanRule.Weekly());

var plan BackupPlan

plan.AddRule(backup.BackupPlanRule_Daily())
plan.AddRule(backup.BackupPlanRule_Weekly())

By default a new vault is created when creating a plan. It is also possible to specify a vault either at the plan level or at the rule level.

const myVault = backup.BackupVault.fromBackupVaultName(this, 'Vault1', 'myVault');
const otherVault = backup.BackupVault.fromBackupVaultName(this, 'Vault2', 'otherVault');

const plan = backup.BackupPlan.daily35DayRetention(this, 'Plan', myVault); // Use `myVault` for all plan rules
plan.addRule(backup.BackupPlanRule.monthly1Year(otherVault)); // Use `otherVault` for this specific rule

my_vault = backup.BackupVault.from_backup_vault_name(self, "Vault1", "myVault")
other_vault = backup.BackupVault.from_backup_vault_name(self, "Vault2", "otherVault")

plan = backup.BackupPlan.daily35_day_retention(self, "Plan", my_vault) # Use `myVault` for all plan rules
plan.add_rule(backup.BackupPlanRule.monthly1_year(other_vault))

IBackupVault myVault = BackupVault.fromBackupVaultName(this, "Vault1", "myVault");
IBackupVault otherVault = BackupVault.fromBackupVaultName(this, "Vault2", "otherVault");

BackupPlan plan = BackupPlan.daily35DayRetention(this, "Plan", myVault); // Use `myVault` for all plan rules
plan.addRule(BackupPlanRule.monthly1Year(otherVault));

var myVault = BackupVault.FromBackupVaultName(this, "Vault1", "myVault");
var otherVault = BackupVault.FromBackupVaultName(this, "Vault2", "otherVault");

var plan = BackupPlan.Daily35DayRetention(this, "Plan", myVault); // Use `myVault` for all plan rules
plan.AddRule(BackupPlanRule.Monthly1Year(otherVault));

myVault := backup.BackupVault_FromBackupVaultName(this, jsii.String("Vault1"), jsii.String("myVault"))
otherVault := backup.BackupVault_FromBackupVaultName(this, jsii.String("Vault2"), jsii.String("otherVault"))

plan := backup.BackupPlan_Daily35DayRetention(this, jsii.String("Plan"), myVault) // Use `myVault` for all plan rules
plan.AddRule(backup.BackupPlanRule_Monthly1Year(otherVault))

You can backup VSS-enabled Windows applications running on Amazon EC2 instances by setting the windowsVss parameter to true. If the application has VSS writer registered with Windows VSS, then AWS Backup creates a snapshot that will be consistent for that application.

const plan = new backup.BackupPlan(this, 'Plan', {
  windowsVss: true,
});

plan = backup.BackupPlan(self, "Plan",
    windows_vss=True
)

BackupPlan plan = BackupPlan.Builder.create(this, "Plan")
        .windowsVss(true)
        .build();

var plan = new BackupPlan(this, "Plan", new BackupPlanProps {
    WindowsVss = true
});

plan := backup.NewBackupPlan(this, jsii.String("Plan"), &BackupPlanProps{
	WindowsVss: jsii.Boolean(true),
})

Backup vault

In AWS Backup, a backup vault is a container that you organize your backups in. You can use backup vaults to set the AWS Key Management Service (AWS KMS) encryption key that is used to encrypt backups in the backup vault and to control access to the backups in the backup vault. If you require different encryption keys or access policies for different groups of backups, you can optionally create multiple backup vaults.

const myKey = kms.Key.fromKeyArn(this, 'MyKey', 'aaa');
const myTopic = sns.Topic.fromTopicArn(this, 'MyTopic', 'bbb');

const vault = new backup.BackupVault(this, 'Vault', {
  encryptionKey: myKey, // Custom encryption key
  notificationTopic: myTopic, // Send all vault events to this SNS topic
});

my_key = kms.Key.from_key_arn(self, "MyKey", "aaa")
my_topic = sns.Topic.from_topic_arn(self, "MyTopic", "bbb")

vault = backup.BackupVault(self, "Vault",
    encryption_key=my_key,  # Custom encryption key
    notification_topic=my_topic
)

IKey myKey = Key.fromKeyArn(this, "MyKey", "aaa");
ITopic myTopic = Topic.fromTopicArn(this, "MyTopic", "bbb");

BackupVault vault = BackupVault.Builder.create(this, "Vault")
        .encryptionKey(myKey) // Custom encryption key
        .notificationTopic(myTopic)
        .build();

var myKey = Key.FromKeyArn(this, "MyKey", "aaa");
var myTopic = Topic.FromTopicArn(this, "MyTopic", "bbb");

var vault = new BackupVault(this, "Vault", new BackupVaultProps {
    EncryptionKey = myKey,  // Custom encryption key
    NotificationTopic = myTopic
});

myKey := kms.Key_FromKeyArn(this, jsii.String("MyKey"), jsii.String("aaa"))
myTopic := sns.Topic_FromTopicArn(this, jsii.String("MyTopic"), jsii.String("bbb"))

vault := backup.NewBackupVault(this, jsii.String("Vault"), &BackupVaultProps{
	EncryptionKey: myKey,
	 // Custom encryption key
	NotificationTopic: myTopic,
})

A vault has a default RemovalPolicy set to RETAIN. Note that removing a vault that contains recovery points will fail.

You can assign policies to backup vaults and the resources they contain. Assigning policies allows you to do things like grant access to users to create backup plans and on-demand backups, but limit their ability to delete recovery points after they're created.

Use the accessPolicy property to create a backup vault policy:

const vault = new backup.BackupVault(this, 'Vault', {
  accessPolicy: new iam.PolicyDocument({
    statements: [
      new iam.PolicyStatement({
        effect: iam.Effect.DENY,
        principals: [new iam.AnyPrincipal()],
        actions: ['backup:DeleteRecoveryPoint'],
        resources: ['*'],
        conditions: {
          StringNotLike: {
            'aws:userId': [
              'user1',
              'user2',
            ],
          },
        },
      }),
    ],
  }),
})

vault = backup.BackupVault(self, "Vault",
    access_policy=iam.PolicyDocument(
        statements=[
            iam.PolicyStatement(
                effect=iam.Effect.DENY,
                principals=[iam.AnyPrincipal()],
                actions=["backup:DeleteRecoveryPoint"],
                resources=["*"],
                conditions={
                    "StringNotLike": {
                        "aws:userId": ["user1", "user2"
                        ]
                    }
                }
            )
        ]
    )
)

BackupVault vault = BackupVault.Builder.create(this, "Vault")
        .accessPolicy(PolicyDocument.Builder.create()
                .statements(List.of(
                    PolicyStatement.Builder.create()
                            .effect(Effect.DENY)
                            .principals(List.of(new AnyPrincipal()))
                            .actions(List.of("backup:DeleteRecoveryPoint"))
                            .resources(List.of("*"))
                            .conditions(Map.of(
                                    "StringNotLike", Map.of(
                                            "aws:userId", List.of("user1", "user2"))))
                            .build()))
                .build())
        .build();

var vault = new BackupVault(this, "Vault", new BackupVaultProps {
    AccessPolicy = new PolicyDocument(new PolicyDocumentProps {
        Statements = new [] {
            new PolicyStatement(new PolicyStatementProps {
                Effect = Effect.DENY,
                Principals = new [] { new AnyPrincipal() },
                Actions = new [] { "backup:DeleteRecoveryPoint" },
                Resources = new [] { "*" },
                Conditions = new Dictionary<string, object> {
                    { "StringNotLike", new Dictionary<string, string[]> {
                        { "aws:userId", new [] { "user1", "user2" } }
                    } }
                }
            }) }
    })
});

vault := backup.NewBackupVault(this, jsii.String("Vault"), &BackupVaultProps{
	AccessPolicy: iam.NewPolicyDocument(&PolicyDocumentProps{
		Statements: []PolicyStatement{
			iam.NewPolicyStatement(&PolicyStatementProps{
				Effect: iam.Effect_DENY,
				Principals: []IPrincipal{
					iam.NewAnyPrincipal(),
				},
				Actions: []*string{
					jsii.String("backup:DeleteRecoveryPoint"),
				},
				Resources: []*string{
					jsii.String("*"),
				},
				Conditions: map[string]interface{}{
					"StringNotLike": map[string][]*string{
						"aws:userId": []*string{
							jsii.String("user1"),
							jsii.String("user2"),
						},
					},
				},
			}),
		},
	}),
})

Alternativately statements can be added to the vault policy using addToAccessPolicy().

Use the blockRecoveryPointDeletion property or the blockRecoveryPointDeletion() method to add a statement to the vault access policy that prevents recovery point deletions in your vault:

new backup.BackupVault(this, 'Vault', {
  blockRecoveryPointDeletion: true,
});

declare const backupVault: backup.BackupVault;
backupVault.blockRecoveryPointDeletion();

# backup_vault: backup.BackupVault
backup.BackupVault(self, "Vault",
    block_recovery_point_deletion=True
)
backup_vault.block_recovery_point_deletion()

BackupVault backupVault;
BackupVault.Builder.create(this, "Vault")
        .blockRecoveryPointDeletion(true)
        .build();
backupVault.blockRecoveryPointDeletion();

BackupVault backupVault;
new BackupVault(this, "Vault", new BackupVaultProps {
    BlockRecoveryPointDeletion = true
});
backupVault.BlockRecoveryPointDeletion();

var backupVault BackupVault
backup.NewBackupVault(this, jsii.String("Vault"), &BackupVaultProps{
	BlockRecoveryPointDeletion: jsii.Boolean(true),
})
backupVault.BlockRecoveryPointDeletion()

By default access is not restricted.

Use the lockConfiguration property to enable AWS Backup Vault Lock:

new backup.BackupVault(this, 'Vault', {
  lockConfiguration: {
    minRetention: Duration.days(30),
  },
});

backup.BackupVault(self, "Vault",
    lock_configuration=backup.LockConfiguration(
        min_retention=Duration.days(30)
    )
)

BackupVault.Builder.create(this, "Vault")
        .lockConfiguration(LockConfiguration.builder()
                .minRetention(Duration.days(30))
                .build())
        .build();

new BackupVault(this, "Vault", new BackupVaultProps {
    LockConfiguration = new LockConfiguration {
        MinRetention = Duration.Days(30)
    }
});

backup.NewBackupVault(this, jsii.String("Vault"), &BackupVaultProps{
	LockConfiguration: &LockConfiguration{
		MinRetention: awscdk.Duration_Days(jsii.Number(30)),
	},
})

Importing existing backup vault

To import an existing backup vault into your CDK application, use the BackupVault.fromBackupVaultArn or BackupVault.fromBackupVaultName static method. Here is an example of giving an IAM Role permission to start a backup job:

const importedVault = backup.BackupVault.fromBackupVaultName(this, 'Vault', 'myVaultName');

const role = new iam.Role(this, 'Access Role', { assumedBy: new iam.ServicePrincipal('lambda.amazonaws.com') });

importedVault.grant(role, 'backup:StartBackupJob');

imported_vault = backup.BackupVault.from_backup_vault_name(self, "Vault", "myVaultName")

role = iam.Role(self, "Access Role", assumed_by=iam.ServicePrincipal("lambda.amazonaws.com"))

imported_vault.grant(role, "backup:StartBackupJob")

IBackupVault importedVault = BackupVault.fromBackupVaultName(this, "Vault", "myVaultName");

Role role = Role.Builder.create(this, "Access Role").assumedBy(new ServicePrincipal("lambda.amazonaws.com")).build();

importedVault.grant(role, "backup:StartBackupJob");

var importedVault = BackupVault.FromBackupVaultName(this, "Vault", "myVaultName");

var role = new Role(this, "Access Role", new RoleProps { AssumedBy = new ServicePrincipal("lambda.amazonaws.com") });

importedVault.Grant(role, "backup:StartBackupJob");

importedVault := backup.BackupVault_FromBackupVaultName(this, jsii.String("Vault"), jsii.String("myVaultName"))

role := iam.NewRole(this, jsii.String("Access Role"), &RoleProps{
	AssumedBy: iam.NewServicePrincipal(jsii.String("lambda.amazonaws.com")),
})

importedVault.Grant(role, jsii.String("backup:StartBackupJob"))

Types

Name	Kind	Summary
BackupPlan	Construct (L2)	A backup plan.
BackupSelection	Construct (L2)	A backup selection.
BackupVault	Construct (L2)	A backup vault.
CfnBackupPlan	Construct (L1)	Contains an optional backup plan display name and an array of BackupRule objects, each of which specifies a backup rule.
CfnBackupSelection	Construct (L1)	Specifies a set of resources to assign to a backup plan.
CfnBackupVault	Construct (L1)	Creates a logical container where backups are stored.
CfnFramework	Construct (L1)	Creates a framework with one or more controls.
CfnLegalHold	Construct (L1)	Creates a legal hold on recovery points (backups).
CfnLogicallyAirGappedBackupVault	Construct (L1)	Creates a logical container to where backups may be copied.
CfnReportPlan	Construct (L1)	Creates a report plan.
CfnRestoreTestingPlan	Construct (L1)	Creates a restore testing plan.
CfnRestoreTestingSelection	Construct (L1)	This request can be sent after CreateRestoreTestingPlan request returns successfully.
CfnTieringConfiguration	Construct (L1)	Resource Type definition for AWS::Backup::TieringConfiguration.
BackupPlanCopyActionProps	Struct	Properties for a BackupPlanCopyAction.
BackupPlanIndexActionProps	Struct	Properties for a BackupPlanIndexAction.
BackupPlanProps	Struct	Properties for a BackupPlan.
BackupPlanRule	Class	A backup plan rule.
BackupPlanRuleProps	Struct	Properties for a BackupPlanRule.
BackupResource	Class	A resource to backup.
BackupSelectionOptions	Struct	Options for a BackupSelection.
BackupSelectionProps	Struct	Properties for a BackupSelection.
BackupVaultEvents	Enum	Backup vault events.
BackupVaultProps	Struct	Properties for a BackupVault.
CfnBackupPlan.AdvancedBackupSettingResourceTypeProperty	Struct	Specifies an object containing resource type and backup options.
CfnBackupPlan.BackupPlanResourceTypeProperty	Struct	Specifies an object containing properties used to create a backup plan.
CfnBackupPlan.BackupRuleResourceTypeProperty	Struct	Specifies an object containing properties used to schedule a task to back up a selection of resources.
CfnBackupPlan.CopyActionResourceTypeProperty	Struct	Copies backups created by a backup rule to another vault.
CfnBackupPlan.IndexActionsResourceTypeProperty	Struct	Specifies index actions.
CfnBackupPlan.LifecycleResourceTypeProperty	Struct	Specifies an object containing an array of Transition objects that determine how long in days before a recovery point transitions to cold storage or is deleted.
CfnBackupPlan.ScanActionResourceTypeProperty	Struct
CfnBackupPlan.ScanSettingResourceTypeProperty	Struct
CfnBackupPlanProps	Struct	Properties for defining a CfnBackupPlan.
CfnBackupSelection.BackupSelectionResourceTypeProperty	Struct	Specifies an object containing properties used to assign a set of resources to a backup plan.
CfnBackupSelection.ConditionParameterProperty	Struct	Includes information about tags you define to assign tagged resources to a backup plan.
CfnBackupSelection.ConditionResourceTypeProperty	Struct	Specifies an object that contains an array of triplets made up of a condition type (such as STRINGEQUALS ), a key, and a value.
CfnBackupSelection.ConditionsProperty	Struct	Contains information about which resources to include or exclude from a backup plan using their tags.
CfnBackupSelectionProps	Struct	Properties for defining a CfnBackupSelection.
CfnBackupVault.LockConfigurationTypeProperty	Struct	The LockConfigurationType property type specifies configuration for AWS Backup Vault Lock .
CfnBackupVault.NotificationObjectTypeProperty	Struct	Specifies an object containing SNS event notification properties for the target backup vault.
CfnBackupVaultProps	Struct	Properties for defining a CfnBackupVault.
CfnFramework.ControlInputParameterProperty	Struct	The parameters for a control.
CfnFramework.ControlScopeProperty	Struct	A framework consists of one or more controls.
CfnFramework.FrameworkControlProperty	Struct	Contains detailed information about all of the controls of a framework.
CfnFrameworkProps	Struct	Properties for defining a CfnFramework.
CfnLegalHold.DateRangeProperty	Struct	A date range for filtering recovery points.
CfnLegalHold.RecoveryPointSelectionProperty	Struct	The criteria to assign a set of resources, such as resource types or backup vaults.
CfnLegalHold.TagsItemsProperty	Struct
CfnLegalHoldProps	Struct	Properties for defining a CfnLegalHold.
CfnLogicallyAirGappedBackupVault.NotificationObjectTypeProperty	Struct
CfnLogicallyAirGappedBackupVaultProps	Struct	Properties for defining a CfnLogicallyAirGappedBackupVault.
CfnReportPlan.ReportDeliveryChannelProperty	Struct	Contains information from your report plan about where to deliver your reports, specifically your Amazon S3 bucket name, S3 key prefix, and the formats of your reports.
CfnReportPlan.ReportSettingProperty	Struct	Contains detailed information about a report setting.
CfnReportPlanProps	Struct	Properties for defining a CfnReportPlan.
CfnRestoreTestingPlan.RestoreTestingRecoveryPointSelectionProperty	Struct	RecoveryPointSelection has five parameters (three required and two optional).
CfnRestoreTestingPlanProps	Struct	Properties for defining a CfnRestoreTestingPlan.
CfnRestoreTestingSelection.KeyValueProperty	Struct	Pair of two related strings.
CfnRestoreTestingSelection.ProtectedResourceConditionsProperty	Struct	The conditions that you define for resources in your restore testing plan using tags.
CfnRestoreTestingSelectionProps	Struct	Properties for defining a CfnRestoreTestingSelection.
CfnTieringConfiguration.ResourceSelectionProperty	Struct
CfnTieringConfigurationProps	Struct	Properties for defining a CfnTieringConfiguration.
IBackupPlan	Interface	A backup plan.
IBackupVault	Interface	A backup vault.
IndexActionResourceType	Class	The resource type to index.
LockConfiguration	Struct	Configuration for AWS Backup Vault Lock.
TagCondition	Struct	A tag condition.
TagOperation	Enum	An operation that is applied to a key-value pair.