6.1 Centralized Backup Automation & AWS Backup

6.1 Centralized Backup Automation & AWS Backup

CloudOps Blueprint Focus: The AWS Certified CloudOps Engineer – Associate (SOA-C03) exam tests your ability to centralize data protection into AWS Backup, configure automated backup plans and lifecycles, enforce Write-Once-Read-Many (WORM) immutability via AWS Backup Vault Lock, and automate cross-account disaster recovery and restore testing.

Centralized Data Protection & AWS Backup Architecture

In legacy architectures, backup management relied on fragmented cron scripts, custom Lambda functions, and independent Amazon EC2 Data Lifecycle Manager (DLM) policies. This introduced severe operational vulnerabilities: inconsistent retention, auditing gaps, and exposure to ransomware.

AWS Backup resolves these challenges through a centralized, policy-driven service that coordinates data protection across AWS services and hybrid workloads:

• Compute & Storage: Amazon EC2 instances (preserving AMIs, volume configurations, and attached storage), Amazon EBS volumes, and Amazon S3 buckets.
• Relational & NoSQL Databases: Amazon RDS instances, Amazon Aurora clusters, Amazon DynamoDB tables, and Amazon DocumentDB.
• File Systems & Hybrid: Amazon EFS, Amazon FSx (Windows File Server, Lustre, ONTAP, OpenZFS), AWS CloudFormation stacks, and on-premises VMware vSphere virtual machines via the AWS Backup Gateway.

AWS Backup runs operations via the service-linked role AWSBackupDefaultServiceRole. Recovery points are stored in Backup Vaults—encrypted logical containers secured by AWS KMS customer managed keys (CMKs) and governed by JSON Vault Access Policies.

---

Anatomy of a Backup Plan: Rules, Schedules & Lifecycles

A Backup Plan is a policy document defining data protection schedules and lifecycles through one or more Backup Rules:

• Schedule Expression: Dictates execution frequency using cron or rate expressions (e.g., cron(0 5 ? * * *) for daily execution at 05:00 UTC).
• Start and Completion Windows: The Start Window (1 to 72 hours) defines the timeframe within which AWS Backup must initiate the job. The Completion Window (must be at least 1 hour greater than the start window) defines the duration within which the backup must finish before cancellation.
• Lifecycle Tiering Rules:
  • Transition to Cold Storage: Moves recovery points to an ultra-low-cost tier after N days (supported for Amazon EFS, DynamoDB, and VMware; requires at least 90 days total retention).
  • Expiration: Permanently deletes recovery points from the vault after M days.

---

Dynamic Resource Assignments & Tag Governance

AWS Backup provides dynamic resource assignment mechanisms to ensure comprehensive coverage:

• Tag-Based Assignment: Evaluates tag key-value pairs (e.g., BackupPlan = Daily-Gold or Environment = Production). Newly provisioned resources bearing these tags enroll automatically.
• Resource IDs & ARNs: Allows explicit targeting of critical databases or file systems requiring customized protection schedules.
• Continuous Backups for Point-in-Time Recovery (PITR): In addition to periodic snapshots, backup rules can enable continuous backups for supported resources (such as Amazon S3 and Amazon RDS), capturing change logs in real time to allow restoration to any second within a 35-day window.

Tag consistency is enforced across accounts using AWS Organizations Tag Policies, preventing untagged workloads from evading backup plans.

---

Cross-Region & Cross-Account Backup Architecture

To protect against regional outages and account-level compromise, enterprise architectures require decoupled backup copies:

• Cross-Region Disaster Recovery: Duplicates recovery points from a source vault (e.g., us-east-1) to a destination vault in a secondary Region (e.g., us-west-2).
• Cross-Account Air-Gap Isolation: Copies recovery points across accounts in an AWS Organization into an isolated security account. Even if an adversary compromises root credentials in production, copies in the isolated account remain protected.

Cross-account backup copies require two key configurations:

1. The destination vault must attach a Vault Access Policy allowing backup:CopyIntoBackupVault from the source account or organization (aws:PrincipalOrgID).
2. Workloads must be encrypted with an AWS KMS Customer Managed Key (CMK). AWS-managed default keys (aws/ebs, aws/rds) cannot be shared cross-account. The source CMK policy must grant cross-account decryption rights to the destination account.

---

AWS Backup Vault Lock: WORM Compliance & Immutability

AWS Backup Vault Lock enforces Write-Once-Read-Many (WORM) storage immutability at the vault level, preventing premature deletion or ransomware attacks:

In Compliance Mode, administrators define minimum and maximum retention days. The mandatory cooling-off period gives operators at least 72 hours to test or cancel the lock before it becomes permanent and completely immutable.

---

AWS Backup Audit Manager & Automated Restore Testing

Operational resilience requires ongoing validation of backup health and recoverability:

• AWS Backup Audit Manager: Evaluates backup activity against governance controls (e.g., verifying daily backups and 90-day retention across tagged databases). It produces daily compliance reports and flags policy drift via AWS Config.
• AWS Backup Restore Testing: Automatically executes scheduled restore jobs into isolated test environments. It validates recovery point integrity, measures completion times against Recovery Time Objectives (RTO), and automatically cleans up restored test resources to avoid unnecessary compute charges.