AWS Backup
Centralized backup
Centralized backup management for many services (EBS, EC2, RDS, Aurora, DynamoDB, EFS, FSx, S3…) using backup plans: schedules, retention periods, copies to other Regions/accounts, and deletion protection locks (Vault Lock).
- Cost$ Low
- Difficulty●●●●●
- Costs money when idle?A little
- Serverless
- In examsCLF · SAA · SOA
Think of it asLike a company's shared records room: every department sends in copies on one schedule and set of rules.
When to use it
✓ Use it when
You need a unified, compliant backup policy across many services and many accounts.
✗ Avoid it when
You only need simple automated EBS snapshots → Data Lifecycle Manager; you need to recover entire servers with an RPO of seconds → Elastic Disaster Recovery.
Common uses
- Daily backups for all databases and volumes
- Copying backups to another Region for DR
- Ransomware protection with Vault Lock
What does it cost?
- Pricing model: Charged per GB-month of backup data by resource type, plus restore and cross-Region copy fees.
Overly long retention or copying to many Regions makes storage costs keep growing.
When the question asks for a centralized, compliant backup policy across many services or accounts, choose AWS Backup (with Organizations); for "nobody, not even an admin, can delete backups early", choose Backup Vault Lock; for DR in another Region, enable cross-Region copy.
Frequently asked questions
How is AWS Backup different from each service's own snapshots?
Snapshots (EBS, RDS and so on) are features of each individual service, each with its own schedule and management. AWS Backup puts them under one backup plan: one schedule, one retention policy, and one place to monitor and report across many services and accounts. Under the hood it still uses the source service's snapshot mechanism.
How do I protect backups from accidental deletion or ransomware?
Keep backups in a vault and turn on Backup Vault Lock, which enforces WORM (write once, read many): once locked, even an admin cannot delete a backup before its retention ends. Also copy backups to another Region or account so you still have a copy if the main account is compromised.
How do cross-Region and cross-account backups work?
In the backup plan, add a copy step to a vault in the target Region or account; the copy runs automatically after each backup. For many accounts, use AWS Organizations to apply a backup policy to the whole organization from one place. A restore creates a new resource instead of overwriting the old one.
Related services
SAA-C03 study guide
Backup is covered in these study modules: