バックアップと復元

Backup and Restore の基礎

# Backup and Restore workflow:
# 1. Create snapshots/backups on a schedule
# 2. Replicate backups to a secondary region
# 3. On disaster:
#    a. Launch new infrastructure in DR region
#    b. Restore data from most recent backup
#    c. Update DNS to point to DR region
# 4. Failback when primary is restored

AWS Backup：バックアップ管理の一元化

# Create AWS Backup vault
aws backup create-backup-vault \
  --backup-vault-name production-dr-vault \
  --encryption-key-arn arn:aws:kms:us-east-1:123:key/abc

# Assign resources to backup plan
aws backup create-backup-selection \
  --backup-plan-id <plan-id> \
  --backup-selection '{
    "SelectionName": "all-production",
    "IamRoleArn": "arn:aws:iam::123:role/BackupRole",
    "ListOfTags": [{"ConditionType":"STRINGEQUALS","ConditionKey":"Environment","ConditionValue":"production"}]
  }'

RDS の自動バックアップ

# Copy RDS snapshot to DR region
aws rds copy-db-snapshot \
  --source-db-snapshot-identifier arn:aws:rds:us-east-1:123:snapshot:rds:mydb-2026-06-21-05-00 \
  --target-db-snapshot-identifier mydb-dr-2026-06-21 \
  --region us-west-2 \
  --copy-tags

# Restore in DR region from copied snapshot
aws rds restore-db-instance-from-db-snapshot \
  --db-instance-identifier mydb-dr \
  --db-snapshot-identifier mydb-dr-2026-06-21 \
  --region us-west-2

バックアップのための S3 クロスリージョンレプリケーション

# Enable S3 bucket versioning (required for CRR)
aws s3api put-bucket-versioning \
  --bucket my-backups-us-east-1 \
  --versioning-configuration Status=Enabled

# Configure Cross-Region Replication
aws s3api put-bucket-replication \
  --bucket my-backups-us-east-1 \
  --replication-configuration '{
    "Role": "arn:aws:iam::123:role/replication-role",
    "Rules": [{
      "Status": "Enabled",
      "Destination": {
        "Bucket": "arn:aws:s3:::my-backups-us-west-2",
        "StorageClass": "STANDARD_IA"
      }
    }]
  }'

EC2 AMI のバックアップとインスタンスの復旧

# Create AMI from running EC2 instance
aws ec2 create-image \
  --instance-id i-1234567890abcdef0 \
  --name 'prod-web-server-$(date +%Y%m%d)' \
  --no-reboot

# Copy AMI to DR region
aws ec2 copy-image \
  --source-region us-east-1 \
  --source-image-id ami-12345678 \
  --region us-west-2 \
  --name 'prod-web-server-dr'

DynamoDB のバックアップ：オンデマンドと PITR

# Enable DynamoDB PITR
aws dynamodb update-continuous-backups \
  --table-name Orders \
  --point-in-time-recovery-specification PointInTimeRecoveryEnabled=true

# Restore to a specific point in time
aws dynamodb restore-table-to-point-in-time \
  --source-table-name Orders \
  --target-table-name Orders-DR-Restored \
  --restore-date-time '2026-06-21T10:30:00.000Z'

AWS Backup による EFS のバックアップ

# AWS Backup plan with cross-region copy for EFS
{
  'Rules': [{
    'RuleName': 'daily-efs-backup',
    'TargetBackupVaultName': 'primary-vault',
    'ScheduleExpression': 'cron(0 5 ? * * *)',
    'Lifecycle': {'DeleteAfterDays': 7},
    'CopyActions': [{
      'DestinationBackupVaultArn': 'arn:aws:backup:us-west-2:123:backup-vault:dr-vault',
      'Lifecycle': {'DeleteAfterDays': 30}
    }]
  }]
}

バックアップの保持期間とライフサイクルポリシー

# S3 lifecycle policy for backup files
aws s3api put-bucket-lifecycle-configuration \
  --bucket my-backups \
  --lifecycle-configuration '{
    "Rules": [{
      "ID": "backup-tiering",
      "Status": "Enabled",
      "Transitions": [
        {"Days": 30, "StorageClass": "STANDARD_IA"},
        {"Days": 90, "StorageClass": "GLACIER"},
        {"Days": 365, "StorageClass": "DEEP_ARCHIVE"}
      ]
    }]
  }'

バックアップボールトロックと不変性

# Apply Backup Vault Lock
aws backup put-backup-vault-lock-configuration \
  --backup-vault-name production-dr-vault \
  --min-retention-days 7 \
  --max-retention-days 365
  # Note: Once locked, cannot be unlocked
  # Use --changeable-for-days N during initial setup
  # for a grace period to change configuration

バックアップの復元テスト

# AWS Backup restore testing (available in newer API)
# Steps to manually test restore:
# 1. Identify most recent successful backup
aws backup list-recovery-points-by-backup-vault \
  --backup-vault-name production-dr-vault \
  --by-resource-type RDS

# 2. Start restore job
aws backup start-restore-job \
  --recovery-point-arn arn:aws:rds:us-east-1:123:snapshot:mydb-recovery \
  --iam-role-arn arn:aws:iam::123:role/BackupRestoreRole \
  --resource-type RDS \
  --metadata RecoveryPointId=...

バックアップの監視とアラート

# SNS notification for backup failures
aws backup put-backup-vault-notifications \
  --backup-vault-name production-dr-vault \
  --sns-topic-arn arn:aws:sns:us-east-1:123:backup-alerts \
  --backup-vault-events \
    BACKUP_JOB_FAILED \
    RESTORE_JOB_FAILED \
    COPY_JOB_FAILED

クイックチェック

レッスンのまとめ