# AWS Backup

> One place to schedule, keep and restore backups of your AWS data.

- Level: Intermediate
- Topics: AWS
- URL: https://tidbit.legios.com.ar/aws-backup/
- In Spanish: [AWS Backup](https://tidbit.legios.com.ar/es/aws-backup/)

Each AWS storage service has its own way of taking snapshots: Amazon EBS disks, Amazon RDS databases, Amazon DynamoDB tables, file systems, S3 buckets. **AWS Backup** puts them all under one roof, so instead of remembering a dozen different settings, you write one set of rules and see every backup in a single console.

The rules live in a **backup plan**: how often to copy (every night, every hour), how long to keep each copy (35 days, 7 years), and where to store it. You then say which resources the plan covers, often simply "everything tagged `backup=daily`", so new databases get protected the moment someone tags them. Copies go into a **backup vault**, and can also be copied automatically to another Region or another account, in case a whole Region has trouble or an account is compromised.

That last point matters because of ransomware. An attacker who gains admin access may try to delete the backups before encrypting everything else. **Vault Lock** makes a vault write-once: until the retention period ends, nobody, not even the account's administrators, can delete or shorten those copies. A backup is only real once you have restored it, so AWS Backup also lets you run restore tests on a schedule.

## An analogy

A building's caretaker who, every night, photocopies the important papers of every office, files the copies in a fireproof safe across town, and has a rule that nothing in that safe can be shredded before its date.

## Keep in mind

- Centralizes backups of EBS, RDS, DynamoDB, file systems, S3 and more.
- A backup plan sets frequency, retention and which resources, often by tag.
- Copies can go to another Region or account for disaster recovery.
- Vault Lock makes backups undeletable until they expire, a defense against ransomware.

## Go deeper

- [What is AWS Backup? (official docs)](https://docs.aws.amazon.com/aws-backup/latest/devguide/whatisbackup.html)
- [AWS Backup](https://aws.amazon.com/backup/)

## Related terms

- [Amazon EBS](https://tidbit.legios.com.ar/amazon-ebs/): The virtual hard drive of an EC2 instance, kept alive even when the instance stops.
- [Amazon RDS](https://tidbit.legios.com.ar/amazon-rds/): A ready-made relational database that AWS keeps patched, backed up and running.
- [Database](https://tidbit.legios.com.ar/database/): An organized store of data that programs can search and update safely.
- [Amazon DynamoDB](https://tidbit.legios.com.ar/amazon-dynamodb/): A key-value database that answers in milliseconds no matter how big the table gets.
- [Amazon S3](https://tidbit.legios.com.ar/amazon-s3/): A giant online drawer for files, rented by the gigabyte.
- [Backup](https://tidbit.legios.com.ar/backup/): A separate copy of your data, kept so you can get it back when the original is lost.
- [Regions and Availability Zones](https://tidbit.legios.com.ar/regions-and-availability-zones/): Where AWS physically lives: cities worldwide, each split into separate data centers.
- [Malware and ransomware](https://tidbit.legios.com.ar/malware-and-ransomware/): Software built to harm you; ransomware locks your files and charges to unlock them.