AWS Backup

AWS Backup is a centralized, managed backup service that automates and orchestrates backups for supported AWS resources. It operates by applying backup plans and policies to create, retain, and copy recovery points into backup vaults. It normally sits in the management/control layer of an AWS architecture to protect compute and storage resources such as Amazon EC2/EBS, Amazon RDS, Amazon DynamoDB, Amazon EFS, AWS Storage Gateway, and Amazon FSx.

🗂 Resource Category

Management and Governance • Storage

🧠 Exam Memory Hook

Think: Centralised policy-based backups for AWS resources = AWS Backup

📖 Ownership

Classification: AWS Managed Service

AWS responsibilities: AWS operates and patches the underlying AWS Backup service control plane and the physical infrastructure that stores backup data; AWS provides the API, console, scheduling engine, backup vaults, and service-side lifecycle operations. AWS is responsible for service availability of the managed platform and the durability of backups stored in AWS-managed storage. AWS integrates with and secures service endpoints, and maintains the managed runtime and platform components of AWS Backup.

Customer responsibilities: The customer configures backup plans, backup rules, vaults, retention and lifecycle policies, IAM permissions, KMS keys for encryption, cross-account or cross-region copy settings, and restore operations. The customer is responsible for classifying which resources to protect, validating backups and restores, monitoring backup jobs and metrics, and implementing access controls and logging for backup data. The customer must also manage any on-premises connectors or Storage Gateway resources used with backup.

Patching responsibilities: AWS patches the physical infrastructure and the AWS Backup managed service platform. The customer patches guest operating systems, application runtimes, libraries, dependencies, and any software running on protected compute resources. If protected resources use managed runtimes (for example, managed database engines), the customer remains responsible for database schema, data, and application-level updates while AWS handles the managed database platform per its service model; for on-premises resources the customer maintains and patches the local hosts and gateways.

🏗 Typical Architecture

💡 Top 5 Features

Centralized backup plans and policy-driven scheduling across supported AWS resource types.
Backup vaults for storing recovery points with encryption and access control integration with AWS KMS and IAM.
Lifecycle management to transition backups between storage classes or to enforce retention rules.
Cross-region and cross-account copy capabilities for creating secondary recovery points for resiliency or isolation.
Restore orchestration with API, CLI, and console operations to create recovery points and perform restores.

✅ Top 5 Use Cases

Centralise and standardise backups across multiple AWS accounts and resource types to meet organisational retention policies.
Automate scheduled backups for production databases and file systems to simplify operational backup tasks and auditing.
Create cross-region copies of backups to support disaster recovery planning and geographic separation of recovery points.
Implement long-term retention and lifecycle rules for backups required by compliance or regulatory records retention.
Perform periodic restore tests and orchestrated recovery workflows to validate backup integrity and recovery procedures.

🏗 Architecture Placement

AWS Backup acts as a centralized backup control plane that receives backup requests from supported AWS resources and stores recovery points in backup vaults. It normally integrates with IAM for access control and AWS KMS for encryption, and can emit events to CloudWatch or EventBridge for monitoring and automation. Depending on configuration, backup plans can be managed at the account level or centrally across accounts using AWS Organizations, and backups are stored in regional vaults with options to copy cross-region or cross-account.

🎯 Commonly Used With

- Amazon EC2
- Amazon RDS
- Amazon DynamoDB
- Amazon EFS
- AWS Key Management Service

🌍 5 Real-World Examples

A bank uses AWS Backup to apply standard backup plans to RDS databases and EBS volumes to meet internal retention policies and audit requirements.
A healthcare provider schedules daily backups of EFS file systems and RDS instances and uses lifecycle rules to retain clinical records for mandated periods.
A retail e-commerce platform copies backups of production databases to a secondary region to support disaster recovery exercises during maintenance windows.
A telecommunications operator protects on-premises virtual machine data using AWS Storage Gateway with backups managed through AWS Backup for centralised retention.
A government agency enforces backup vault access controls and KMS encryption to meet data protection policies while managing restores during incident response.

🎓 AWS Exam Clues

Use when centralised, policy-driven backups are required across multiple supported AWS resource types.
Remember to configure AWS KMS keys and IAM policies because backup encryption and access control are customer-managed.
Backup vaults and lifecycle rules address retention and archival requirements rather than automated failover or application-level DR.
Cross-region and cross-account copy capabilities are useful for geographic resilience and separation of duties.
Validate restores regularly because backups alone do not guarantee successful application recovery without testing.

📝 Quick Revision

AWS Backup centralises and automates backups for supported AWS resources using backup plans, vaults, and lifecycle rules. Use it when you need policy-driven scheduling, retention, and cross-account or cross-region copies; ensure IAM, KMS, monitoring, and restore validation are configured.

🏷 Keywords

backup plan • backup vault • lifecycle policy • backup rule • restore job • cross-region copy • cross-account backup • backup vault lock • AWS Organizations integration • AWS KMS • backup monitoring • supported resource types