AWS Backup
Centralized backup service across AWS services
AWS Backup is like having a personal assistant who remembers to back up everything important on a schedule you set. Instead of manually creating snapshots for EC2, backups for RDS, and copies of S3 data, you define backup policies once, and AWS Backup handles everything automatically. It works across multiple AWS services (EC2, EBS, RDS, DynamoDB, EFS, S3) and even across multiple AWS accounts. You set rules like 'back up my production databases daily and keep them for 30 days,' and AWS Backup does it all, tracks everything in one place, and makes restores simple.
AWS Backup provides centralized backup management across AWS services using backup plans (policies defining what, when, and how long to back up) and backup vaults (encrypted storage for backups). You assign resources to backup plans using tags or resource IDs. Backup supports cross-region and cross-account backups for disaster recovery.
Key Capabilities
Key features: lifecycle management (transition backups to cold storage after X days), backup compliance monitoring (ensure all resources are backed up per policy), and point-in-time recovery (for supported services like RDS).
Gotchas & Constraints
Gotcha #1: AWS Backup creates service-specific backups (EBS snapshots, RDS snapshots, etc.); you're charged for the underlying storage, not Backup itself. Gotcha #2: Restoring backups creates new resources; you must manually reconfigure applications to use restored resources. Constraints: Not all AWS services are supported (e.g., no native support for Lambda or API Gateway). Backup windows can impact performance for some services (e.g., RDS backups cause brief I/O suspension).
A SaaS company runs a multi-tier application with 50 EC2 instances, 10 RDS databases, 5 EFS file systems, and 20 DynamoDB tables across 3 AWS accounts. Previously, they used custom scripts to create backups, which was error-prone, inconsistent, and hard to audit. They implement AWS Backup with three backup plans: Production (daily backups, 30-day retention, cross-region copy to us-west-2), Staging (weekly backups, 7-day retention), and Compliance (monthly backups, 7-year retention, immutable vault lock). They tag all resources with Environment=Production, and AWS Backup automatically includes them in the Production plan. During a ransomware attack that encrypts production databases, they restore from yesterday's backup (stored in an isolated vault), recovering all data with 24-hour RPO. AWS Backup's centralized dashboard shows compliance status: 100% of production resources backed up per policy.