Amazon Backup and Amazon Organizations
Amazon Backup is a service that allows you to manage and monitor the Amazon Backup jobs in your organization. Using Amazon Backup, if you sign-in as a user in the organization's management account, you can enable organization-wide backup protection and monitoring. It helps you to achieve compliance by using backup policies to centrally apply Amazon Backup plans to resources across all of the accounts in your organization. When you use both Amazon Backup and Amazon Organizations together, you can get the following benefits:
- Protection
-
You can enable the backup policy type in your organization and then create backup policies to attach to the organization's root, OUs, or accounts. A backup policy combines an Amazon Backup plan with the other details required to apply the plan automatically to your accounts.Policies that are directly attached to an account are merged with policies inherited from the organization's root and any parent OUs to create an effective policy that applies to the account. The policy includes the ID of an IAM role that has permissions to run Amazon Backup on the resources in your accounts. Amazon Backup uses the IAM role to perform the backup on your behalf as specified by the backup plan in the effective policy.
- Monitoring
-
When you enable trusted access for Amazon Backup in your organization, you can use the Amazon Backup console to view details about the backup, restore, and copy jobs in any of the accounts in your organization. For more information, see Monitor your backup jobs in the Amazon Backup Developer Guide.
For more information about Amazon Backup, see the Amazon Backup Developer Guide.
Use the following information to help you integrate Amazon Backup with Amazon Organizations.
Enabling trusted access with Amazon Backup
For information about the permissions needed to enable trusted access, see Permissions required to enable trusted access.
You can enable trusted access using either the Amazon Backup console or the Amazon Organizations console.
Important
We strongly recommend that whenever possible, you use the Amazon Backup console or tools to enable integration with Organizations. This lets Amazon Backup perform any configuration that it requires, such as creating resources needed by the service. Proceed with these steps only if you can’t enable integration using the tools provided by Amazon Backup. For more information, see this note.
If you enable trusted access by using the Amazon Backup console or tools then you don’t need to complete these steps.
To enabled trusted access using Amazon Backup, see Enabling backup in multiple Amazon Web Services accounts in the Amazon Backup Developer Guide.
Disabling trusted access with Amazon Backup
For information about the permissions needed to enable trusted access, see Permissions required to enable trusted access.
Amazon Backup requires trusted access with Amazon Organizations to enable monitoring of backup, restore, and copy jobs across your organization's accounts. If you disable trusted access Amazon Backup, you lose the ability to view jobs outside of the current account. The Amazon Backup role that Amazon Backup creates remains. If you later re-enable trusted access, Amazon Backup continues to operate as before, without the need for you to reconfigure the service.
You can disable trusted access using only the Organizations tools.
You can disable trusted access by running a Organizations Amazon CLI command, or by calling an Organizations API operation in one of the Amazon SDKs.
Enabling a delegated administrator account for Amazon Backup
See Delegated administrator in the Amazon Backup Developer Guide.