Backup and Restore

Backup and Restore is the simplest and most cost-effective disaster recovery strategy. You create regular backups of your data and infrastructure, store them in a durable location (typically S3 in another region), and restore from those backups when a disaster occurs. While cheap to maintain, it results in the longest RTO (hours) and potentially significant RPO (time since last backup). It is appropriate for non-critical workloads where downtime of several hours is acceptable.

AWS Backup is a fully managed service that centralises and automates data protection across AWS services. It supports EBS volumes, RDS databases, DynamoDB tables, EFS file systems, FSx, EC2 instances, Aurora clusters, and S3. You define backup plans with schedules, retention periods, and vault destinations. AWS Backup enforces backup policies across multiple accounts via AWS Organizations, making it the go-to service for enterprise backup management.

Amazon RDS automatically creates daily snapshots and captures transaction logs to enable point-in-time recovery (PITR). You can restore your database to any second within the backup retention window (1-35 days). Automated backups are stored in S3 (managed by AWS, not visible in your S3 console). For cross-region DR, use the console or CLI to copy DB snapshots to another region — the copy can be used to launch a new RDS instance during a disaster.

S3 Cross-Region Replication (CRR) automatically replicates new objects from a source bucket to a destination bucket in another region. For backup purposes, configure your backup jobs to write to an S3 bucket with CRR enabled — backups are automatically copied to the DR region within minutes. Enable versioning on both buckets (required for CRR) so older backup versions are retained. Combine with S3 Object Lock to make backups immutable and protect against ransomware.

To enable EC2 recovery in a DR region, pre-create Amazon Machine Images (AMIs) from your production EC2 instances and copy them to the DR region. AMIs capture the root volume, instance configuration, and optionally data volumes. In a disaster, launch new EC2 instances from the DR-region AMI and attach your restored EBS volumes. Automate AMI creation with AWS Backup EC2 resource type or EC2 Image Builder for golden image pipelines.

DynamoDB offers two backup mechanisms. On-Demand backups create a full backup immediately with no performance impact — they can be retained indefinitely and restored in minutes. Point-In-Time Recovery (PITR), when enabled, continuously backs up your table for the last 35 days, allowing restore to any second in that window. Both backup types can be exported to S3 for cross-region backup or to integrate with AWS Backup. PITR is strongly recommended for production tables.

Amazon EFS integrates with AWS Backup for automated daily backups. EFS backups are incremental — only changed data is copied after the initial backup — making them storage-efficient. You can restore an entire file system or individual files from a backup. For cross-region DR, use AWS Backup Cross-Region Copy to automatically copy EFS backups to a vault in the DR region. Note that EFS itself is already Multi-AZ within a region; cross-region backup covers regional failure scenarios.

Not all backups need to be kept forever. Design a retention strategy based on your RPO and compliance requirements. A common pattern: daily backups for 7 days, weekly backups for 4 weeks, monthly backups for 12 months, annual backups for 7 years (the Grandfather-Father-Son scheme). AWS Backup lifecycle rules automate this. For S3-stored backups, use S3 Lifecycle policies to transition older backups to S3 Glacier or Deep Archive to dramatically reduce storage costs.

AWS Backup Vault Lock implements a WORM (Write Once, Read Many) policy that prevents anyone — including root users — from deleting backups or modifying the lock before its expiry. This protects backups from ransomware attacks and insider threats. Once applied, Vault Lock cannot be disabled. This feature is critical for compliance with regulations requiring immutable backups (SOC 2, PCI DSS, HIPAA). Set a minimum and maximum retention period to ensure backups are not deleted prematurely.

Creating backups is only half the job — you must regularly test that restores work correctly and within your RTO. AWS Backup supports restore testing plans that automatically restore backups to a test environment on a schedule and validate the restore succeeded. Without regular restore tests, you might discover during a real disaster that your backups are corrupted, incomplete, or take much longer to restore than expected. Document the restore time as your actual RTO data point.

Backup failures must be detected immediately — a failed backup job means your next disaster has no recent recovery point. Configure AWS Backup notifications via SNS to alert on backup job failures. Use CloudWatch metrics like NumberOfBackupJobsFailed to create alarms. Use AWS Config rules like BACKUP_PLAN_MIN_FREQUENCY_AND_MIN_RETENTION_CHECK to continuously verify that resources have appropriate backup plans assigned. Treat a missed backup as a potential compliance violation.

Test your understanding of AWS Solutions Architect (SAA-C03) concepts from this lesson.

In this lesson you learned: AWS Backup centralises backup management across RDS, DynamoDB, EFS, EC2, and more, S3 Cross-Region Replication automatically copies backups to your DR region, and Backup Vault Lock provides immutable backups for compliance and ransomware protection. Always test restores to validate your actual RTO. Next up we explore Pilot Light and Warm Standby strategies.