# Amazon Backup and Amazon Organizations
<a name="services-that-can-integrate-backup"></a>

Amazon Backup is a service that allows you to manage and monitor the Amazon Backup jobs in your organization. Using Amazon Backup, if you sign-in as a user in the organization's management account, you can enable organization-wide backup protection and monitoring. It helps you to achieve compliance by using [backup policies](orgs_manage_policies_backup.md) to centrally apply Amazon Backup plans to resources across all of the accounts in your organization. When you use both Amazon Backup and Amazon Organizations together, you can get the following benefits:

**Protection**  
You can [enable the backup policy type](enable-policy-type.md) in your organization and then [create backup policies](orgs_policies_create.md) to attach to the organization's root, OUs, or accounts. A backup policy combines an Amazon Backup plan with the other details required to apply the plan automatically to your accounts.Policies that are directly attached to an account are merged with policies [inherited](orgs_manage_policies_inheritance_mgmt.md) from the organization's root and any parent OUs to create an [effective policy](orgs_manage_policies_effective.md) that applies to the account. The policy includes the ID of an IAM role that has permissions to run Amazon Backup on the resources in your accounts. Amazon Backup uses the IAM role to perform the backup on your behalf as specified by the backup plan in the effective policy.

**Monitoring**  
When you [enable trusted access for Amazon Backup](orgs_integrate_services.md#orgs_how-to-enable-disable-trusted-access) in your organization, you can use the Amazon Backup console to view details about the backup, restore, and copy jobs in any of the accounts in your organization. For more information, see [Monitor your backup jobs](https://docs.amazonaws.cn/aws-backup/latest/devguide/monitor-and-verify-protected-resources.html) in the *Amazon Backup Developer Guide*.

For more information about Amazon Backup, see the *[Amazon Backup Developer Guide](https://docs.amazonaws.cn/aws-backup/latest/devguide/)*.

Use the following information to help you integrate Amazon Backup with Amazon Organizations.



## Enabling trusted access with Amazon Backup
<a name="integrate-enable-ta-backup"></a>

For information about the permissions needed to enable trusted access, see [Permissions required to enable trusted access](orgs_integrate_services.md#orgs_trusted_access_perms).

You can enable trusted access using either the Amazon Backup console or the Amazon Organizations console.

**Important**  
We strongly recommend that whenever possible, you use the Amazon Backup console or tools to enable integration with Organizations. This lets Amazon Backup perform any configuration that it requires, such as creating resources needed by the service. Proceed with these steps only if you can’t enable integration using the tools provided by Amazon Backup. For more information, see [this note](orgs_integrate_services.md#important-note-about-integration).   
If you enable trusted access by using the Amazon Backup console or tools then you don’t need to complete these steps.

To enabled trusted access using Amazon Backup, see [Enabling backup in multiple Amazon Web Services accounts](https://docs.amazonaws.cn//aws-backup/latest/devguide/manage-cross-account.html#enable-xaccount-management) in the *Amazon Backup Developer Guide*.

## Disabling trusted access with Amazon Backup
<a name="integrate-disable-ta-backup"></a>

For information about the permissions needed to enable trusted access, see [Permissions required to enable trusted access](orgs_integrate_services.md#orgs_trusted_access_perms).

Amazon Backup requires trusted access with Amazon Organizations to enable monitoring of backup, restore, and copy jobs across your organization's accounts. If you disable trusted access Amazon Backup, you lose the ability to view jobs outside of the current account. The Amazon Backup role that Amazon Backup creates remains. If you later re-enable trusted access, Amazon Backup continues to operate as before, without the need for you to reconfigure the service. 

You can only disable trusted access using the Organizations tools.

You can disable trusted access by running a Organizations Amazon CLI command, or by calling an Organizations API operation in one of the Amazon SDKs.

------
#### [ Amazon CLI, Amazon API ]

**To disable trusted service access using the Organizations CLI/SDK**  
Use the following Amazon CLI commands or API operations to disable trusted service access:
+ Amazon CLI: [disable-aws-service-access](https://docs.amazonaws.cn/cli/latest/reference/organizations/disable-aws-service-access.html)

  Run the following command to disable Amazon Backup as a trusted service with Organizations.

  ```
  $ aws organizations disable-aws-service-access \
      --service-principal backup.amazonaws.com
  ```

  This command produces no output when successful.
+ Amazon API: [DisableAWSServiceAccess](https://docs.amazonaws.cn/organizations/latest/APIReference/API_DisableAWSServiceAccess.html)

------

## Enabling a delegated administrator account for Amazon Backup
<a name="integrate-enable-da-backup"></a>

See [Delegated administrator](https://docs.amazonaws.cn/aws-backup/latest/devguide/manage-cross-account.html#backup-delegatedadmin) in the *Amazon Backup Developer Guide*.