AWS Backup
Centralized service for scheduling, retaining, and restoring backups across many AWS services from one place.
Verified against AWS documentation · 2026-09-09
Key facts
- 01A backup plan is schedule + retention + lifecycle; assign resources by tag so anything new gets protected automatically
- 02Backups (recovery points) live in a backup vault with its own access policy — deleting the source EC2 instance doesn't delete its backups
- 03Vault Lock enforces WORM: governance mode can be removed by an IAM admin, compliance mode cannot be removed by anyone after the grace period (minimum 3 days) — not root, not AWS
- 04Cross-Region and cross-account copy are built into the plan; AWS Organizations pushes one backup policy to every account
Exam triggers
Phrases and scenarios that point here.
- "Centralize", "automate", "single console" for backups spanning several services → AWS Backup
- "No one, not even the root user, can delete backups" → Vault Lock, compliance mode
- Backups must sit in a second Region or a separate account → cross-Region / cross-account copy
- Replace hand-rolled snapshot scripts to reduce operational overhead → AWS Backup, not Lambda on a cron
Not this service
- Continuous replication with minutes-level RPO for failover → AWS Elastic Disaster Recovery
- Moving or syncing data between on-premises and AWS as a transfer job → AWS DataSync
Use cases
- 01Tag every production resource `Backup=daily` and attach one plan — an RDS instance someone spins up on Friday is covered by Saturday morning without a ticket
- 02Ransomware insurance: copy nightly backups into a locked vault in a separate backup-only account, so stolen prod credentials can't reach them
- 03Auditor asks you to prove every production volume was backed up daily last quarter — Backup Audit Manager's daily reports answer that instead of a spreadsheet
- 04Cheap DR posture for a small team: nightly cross-Region copies instead of a warm standby environment — slow to recover, but a fraction of the cost
- 05Decommissioning an old EC2 fleet: take final backups, terminate the instances, keep the recovery points for whatever retention window finance asked for
How it's charged
- 01Backup storage per GB-month is the main line item; cold storage is cheaper but only supported on some resource types and carries a 90-day minimum retention — delete early and you still pay the remainder
- 02Restores are billed per GB restored, so backups are cheap to keep and not always cheap to pull back
- 03Cross-Region copies bill data transfer to the sending account and destination storage to the receiving account — two accounts, two bills, one copy
- 04Backup Audit Manager charges per evaluation, plus AWS Config configuration items for each one — the Config side is a separate bill that catches people out
- 05The service, console, backup plans, and Vault Lock cost nothing on their own; you pay for stored data, transfers, restores, and restore testing
