Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Creating a backup plan

You can create a backup plan using the Amazon Backup console, API, CLI, SDK, or an Amazon CloudFormation template.

Creating backup plans using the Amazon Backup console

Open the Amazon Backup console at https://console.aws.amazon.com/backup. From the dashboard, choose Manage Backup plans. Or, using the navigation pane, choose Backup plans and choose Create Backup plan.

Start options

You have three choices for your new backup plan:

In this tutorial, we will choose Build a new plan. Each part of the configuration has a link to an expanded section further on the page to where you can navigate for more detail.

Creating backup plans using the Amazon CLI

You can also define your backup plan in a JSON document and provide it using the Amazon Backup console or Amazon CLI. The following JSON document contains a sample backup plan that creates a daily backup at 1:00 Pacific time (the local time adjusts to daylight, standard, or summer time conditions if applicable). It automatically deletes a backup after one year.

{
  "BackupPlan":{
    "BackupPlanName":"test-plan",
    "Rules":[
      {
        "RuleName":"test-rule",
        "TargetBackupVaultName":"test-vault",
        "ScheduleExpression":"cron(0 1 ? * * *)",
        "ScheduleExpressionTimezone":"America/Los_Angeles",
        "StartWindowMinutes":integer, // Value is in minutes
        "CompletionWindowMinutes":integer, // Value is in minutes
        "Lifecycle":{
          "DeleteAfterDays":integer, // Value is in days
        }
      }
    ]
  }
}

You can store your JSON document with a name you choose. The following CLI command shows create-backup-plan with a JSON named test-backup-plan.json:

aws backup create-backup-plan --cli-input-json file://PATH-TO-FILE/test-backup-plan.json

Note that while some systems number the days of the week from 0 to 6, we number them from 1 to 7. For more information, see Cron expressions . For more information about timezones, see TimeZone in the Amazon Location Service API reference.

Backup plan options and configuration

When you define a backup plan in the Amazon Backup console, you configure the following options:

Backup plan name

You must provide a unique backup plan name.

If you choose name that is identical to the name of an existing plan, you will receive an error message.

Backup rules

Backup plans are composed of one or more backup rules. To add backup rules to a backup plan, or to edit existing rules in a backup plan:

Each backup rule consists of the following elements.

Backup rule name

Backup rule names are case sensitive. They must contain from 1 to 50 alphanumeric characters or hyphens.

Backup frequency

The backup frequency determines how often Amazon Backup creates a snapshot backup. Using the console, you can choose a frequency of every hour, 12 hours, daily, weekly, or monthly. You can also create a cron expression that creates snapshot backups as frequently as hourly. Using the Amazon Backup CLI, you can schedule snapshot backups as frequently as hourly.

If you select weekly, you can specify which days of the week you want backups to be taken. If you select monthly, you can choose a specific day of the month.

You can also check the Enable continuous backups for supported resources checkbox to create a point-in-time restore (PITR)-enabled continuous backup rule. Unlike snapshot backups, continuous backups allow you to perform point-in-time restore. To learn more about continuous backups, see Point-in-Time Recovery.

Backup window

Backup windows consist of the time that the backup window begins and the duration of the window in hours. Backup jobs are started within this window. The default settings in the console are:

You can customize the backup frequency and backup window start time using a cron expression. To see the six fields of Amazon cron expressions, see Cron Expressions in the Amazon CloudWatch Events User Guide. Two examples of Amazon cron expressions are 15 * ? * * * (take a backup every hour at 15 minutes past the hour) and 0 12 * * ? * (take a backup every day at 12 noon UTC). For a table of examples, click the preceding link and scroll down the page.

Amazon Backup evaluates cron expressions between 00:00 and 23:59. If you create a backup rule for "every 12 hours" but provide a start time of later than 11:59, it will only run once per day.

Continuous backups and point-in-time restore (PITR) reference the changes recorded over a period of time; therefore, they cannot be scheduled with a time or cron expression.

Overlapping backup rules

On occasion, a backup plan might contain multiple, overlapping rules. When the start windows of different rules overlap, Amazon Backup retains the backup under the rule with the longer retention period. For example, consider a backup plan with two rules:

After 24 hours, the second rule creates two backups (because it has the longer retention period). The first rule creates eight backups (because the second rule's 8-hour start window prevented more hourly backups from running). Specifically:

During the start window, the backup job status remains in CREATED status until it has successfully begun or until the start window time has run out. If within the start window time Amazon Backup receives an error that allows the job to be retried, Amazon Backup will automatically retry to begin the job at least every 10 minutes until the backup successfully begins (the job status changes to RUNNING) or until the job status changes to EXPIRED (which is expected to occur when the start window time is over).

Lifecycle and storage tiers

Backups are stored for the number of days you specify, known as the backup lifecycle. Backups can be restored until the end of their lifecycle.

This is set as the total retention period in the lifecycle section of backup rule configuration in the Amazon Backup console.

If you use Amazon CLI, this is set using the parameter DeleteAfterDays. The retention period for snapshots can range between 1 day and 100 years (or indefinitely if you don't enter one), while the retention period for continuous backups can range from 1 day to 35 days. The creation date of a backup is the date the backup job started, not the date it completed. If your backup job doesn't complete on the same date it started, use the date on which it began to help calculate retention periods.

Backups are maintained in a storage tier. Each tier incurs a different cost for storage and for restore, as outlined by Amazon Backup pricing. Every backup is created and is stored in warm storage. Depending on how long you choose to store your backup, you may wish to transition your backup to a lower-cost tier called cold storage. Feature availability by resource displays which resources have this optional feature.

Console

1. Open the Amazon Backup console at https://console.amazonaws.cn/backup.

2. Create or edit a backup plan.

3. In the lifecycle section of backup rule configuration, check the box Move backups from warm to cold storage.

4. (optional) If Amazon EBS is one of the resources you back up and your backup frequency is monthly or less frequent, you can transition them to cold tier using EBS snapshot archival.

5. Input a value (in days) that you want your backups to remain in warm storage. Amazon Backup recommends at least 8 days.

6. Input a value (in days) for the total retention period. The difference between total retention period and time in warm storage will be the amount of days the backups remain in cold storage.

Amazon CLI

1. Use create-backup-plan or update-backup-plan.

3. Include the Boolean parameter OptInToArchiveForSupportedResources for EBS resources.

4. Include the parameter MoveToColdStorageAfterdays.

5. Use the parameter DeleteAfterDays. This value must be 90 (days) plus the value you input for MoveToColdStorageAfterDays.

Cold storage is currently available for the following resource types:

Once you have enabled transition to cold storage through the console or command line, the following conditions are true for backups in cold storage (or archive):

Backup vault

A backup vault is a container to organize your backups in. Backups created by a backup rule are organized in the backup vault that you specify in the backup rule. You can use backup vaults to set the Amazon Key Management Service (Amazon KMS) encryption key that is used to encrypt backups in the backup vault and to control access to the backups in the backup vault. You can also add tags to backup vaults to help you organize them. If you don't want to use the default vault, you can create your own. For step-by-step instructions for creating a backup vault, see Step 3: Create a backup vault.

Copy to Regions

As part of your backup plan, you can optionally create a backup copy in another Amazon Web Services Region. For more information about backup copies, see Creating backup copies across Amazon Web Services Regions.

When you define a backup copy, you configure the following options:

Destination Region

The destination Region for the backup copy.

(Advanced Settings) Backup vault

The destination backup vault for the copy.

(Advanced Settings) IAM Role

The IAM role that Amazon Backup uses when creating the copy. The role must also have Amazon Backup listed as a trusted entity, which enables Amazon Backup to assume the role. If you choose Default and the Amazon Backup default role is not present in your account, a role is created for you with the correct permissions.

(Advanced Settings) Lifecycle

Specifies when to transition the backup copy to cold storage and when to expire (delete) the copy. Backups transitioned to cold storage must be stored in cold storage for a minimum of 90 days. You can't change this value after a copy has transitioned to cold storage.

Expire specifies the number of days after creation that the copy is deleted. This must be greater than 90 days beyond the Transition to cold storage value.

Tags added to recovery points

The tags that you list here are automatically added to backups when they are created.

Tags added to backup plans

These tags are associated with the backup plan itself to help you organize and track your backup plan.

Advanced backup settings

Enables application consistent backups for third-party applications that are running on Amazon EC2 instances. Currently, Amazon Backup supports Windows VSS backups. Amazon Backup excludes specific Amazon EC2 instance types from Windows VSS backups. For more information, see Creating Windows VSS backups.

Amazon CloudFormation templates for backup plans

We provide two sample Amazon CloudFormation templates for your reference. The first template creates a simple backup plan. The second template enables VSS backups in a backup plan.

Description: backup plan template to back up all resources daily at 5am UTC, and tag all recovery points with backup:daily.

Resources:
  KMSKey:
    Type: AWS::KMS::Key
    Properties:
      Description: "Encryption key for daily"
      EnableKeyRotation: True
      Enabled: True
      KeyPolicy:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              "AWS": { "Fn::Sub": "arn:${AWS::Partition}:iam::${AWS::AccountId}:root" }
            Action:
              - kms:*
            Resource: "*"

  BackupVaultWithDailyBackups:
    Type: "AWS::Backup::BackupVault"
    Properties:
      BackupVaultName: "BackupVaultWithDailyBackups"
      EncryptionKeyArn: !GetAtt KMSKey.Arn

  BackupPlanWithDailyBackups:
    Type: "AWS::Backup::BackupPlan"
    Properties:
      BackupPlan:
        BackupPlanName: "BackupPlanWithDailyBackups"
        BackupPlanRule:
          - RuleName: "RuleForDailyBackups"
            TargetBackupVault: !Ref BackupVaultWithDailyBackups
            ScheduleExpression: "cron(0 5 ? * * *)"
    DependsOn: BackupVaultWithDailyBackups
    
  DDBTableWithDailyBackupTag:
    Type: "AWS::DynamoDB::Table"
    Properties:
      TableName: "TestTable"
      AttributeDefinitions:
        - AttributeName: "Album"
          AttributeType: "S"
      KeySchema:
        - AttributeName: "Album"
          KeyType: "HASH"
      ProvisionedThroughput:
        ReadCapacityUnits: "5"
        WriteCapacityUnits: "5"
      Tags:
        - Key: "backup"
          Value: "daily"

  BackupRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Service:
                - "backup.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/service-role/service-role"

  TagBasedBackupSelection:
    Type: "AWS::Backup::BackupSelection"
    Properties:
      BackupSelection:
        SelectionName: "TagBasedBackupSelection"
        IamRoleArn: !GetAtt BackupRole.Arn
        ListOfTags:
          - ConditionType: "STRINGEQUALS"
            ConditionKey: "backup"
            ConditionValue: "daily"
      BackupPlanId: !Ref BackupPlanWithDailyBackups
    DependsOn: BackupPlanWithDailyBackups

Description: backup plan template to enable Windows VSS and add backup rule to take backup of assigned resources daily at 5am UTC.

Resources:
  KMSKey:
    Type: AWS::KMS::Key
    Properties:
      Description: "Encryption key for daily"
      EnableKeyRotation: True
      Enabled: True
      KeyPolicy:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              "AWS": { "Fn::Sub": "arn:${AWS::Partition}:iam::${AWS::AccountId}:root" }
            Action:
              - kms:*
            Resource: "*"

  BackupVaultWithDailyBackups:
    Type: "AWS::Backup::BackupVault"
    Properties:
      BackupVaultName: "BackupVaultWithDailyBackups"
      EncryptionKeyArn: !GetAtt KMSKey.Arn

  BackupPlanWithDailyBackups:
    Type: "AWS::Backup::BackupPlan"
    Properties:
      BackupPlan:
        BackupPlanName: "BackupPlanWithDailyBackups"
        AdvancedBackupSettings:
          - ResourceType: EC2
            BackupOptions:
              WindowsVSS: enabled
        BackupPlanRule:
          - RuleName: "RuleForDailyBackups"
            TargetBackupVault: !Ref BackupVaultWithDailyBackups
            ScheduleExpression: "cron(0 5 ? * * *)"

    DependsOn: BackupVaultWithDailyBackups