Central Backup Service
Central Backup Service
AWS Backup centralizes what used to be per-service cron jobs. You define a backup plan (schedule window, frequency, retention, optional transition to cold storage) and a selection (resources picked by tags, attributes, or explicitly). Supported resources include EC2/EBS, RDS and Aurora, DynamoDB, EFS, FSx, and Storage Gateway — all managed from one console instead of per-service snapshot scripts.
Backups land in encrypted vaults (each with its own KMS key); copy actions in the plan duplicate recovery points to another vault or another region for disaster recovery. Audit Manager frameworks continuously check that your selections and retention actually match policy, which answers the audit question without spreadsheet archaeology.
Building a Plan
Building a Plan
ScheduleExpression: cron(0 5 * * ? *) # daily 05:00 UTC window
StartWindowMinutes: 60 # window to START the job
CompletionWindowMinutes: 180 # window to FINISH it
RetentionInDays: 35
CopyActions:
- DestinationVaultArn: arn:aws:backup:us-west-2:...:vault/dr
Tag your resources (Environment=prod) and select by tag so new instances join the plan automatically; untagged resources silently skip protection. On-demand backups (the console's "Backup now") cover pre-deployment snapshots. Delete windows apply to recovery points — you cannot destroy a locked vault's contents, which is exactly the point for compliance.
Pitfalls and Interview Focus
Pitfalls and Interview Focus
Vault Lock in compliance mode is effectively permanent — locks cannot be removed once enforced, so test in audit mode first. Your KMS key becomes a single point of destruction: if the key policy or key itself is deleted, the backups become unreadable — protect keys with key policies and disable-then-schedule-deletion discipline.
Copy is asynchronous: a cross-region copy has its own completion time, so an RPO measured against "the copy exists" may be looser than you assume. Cold-storage transitions lower cost but retrieval takes hours — fine for archives, wrong for the tier that must meet your RTO. Remember coverage gaps: services outside the supported list need their own mechanism.
Interview: describe plan → selection → vault → copy, then name two protections (vault lock, KMS policy) and one blind spot.
Quiz
1. What does a backup plan define?
2. Why are backup selections tag-based?
3. What happens to backups if their KMS key is deleted?
Flashcards
Question
Backup plan fields
Click to reveal answer
Answer
Schedule window, start/completion windows, retention, lifecycle to cold, copy actions.
Question
Selection by tag
Click to reveal answer
Answer
Resources join protection through tags — the mechanism that prevents coverage drift.
Question
Vault lock
Click to reveal answer
Answer
Makes vault contents immutable; compliance-mode locks are irreversible — test in audit mode.
Question
Copy action
Click to reveal answer
Answer
Asynchronous duplicate of recovery points to another vault/region for DR.
Question
Cold storage lifecycle
Click to reveal answer
Answer
Cheaper archive tier with retrieval latency measured in hours.
Revision Notes
Key Takeaways
- 1. One plan + tag selections replaces scattered per-service snapshot scripts
- 2. Cross-region copy is the DR leg — but it is asynchronous, size your RPO accordingly
- 3. Protect the KMS key as fiercely as the backup itself
Interview Tips
- • Walk plan → selection → vault → copy and then probe failure modes (key, lock, window)
- • Ask clarifying questions about retention vs retrieval latency when the interviewer mentions cold storage
Cheat Sheet
AWS Backup: plan (cron window, retention, cold lifecycle, copy) + tag selections → encrypted vaults. Vault lock irreversible; KMS key = SPOF; copy async (RPO!); cold retrieval is slow.