8.4 Automated Backup & Recovery with AWS Backup & Elastic Disaster Recovery

Enterprise Backup Automation with AWS Backup

AWS Backup provides a centralized, policy-driven data protection platform that automates backup scheduling, retention management, lifecycle transitions, and cross-region/cross-account replication across AWS services and hybrid workloads.

Core Architecture Components

• Backup Plans: Policy documents that define when backups are taken (cron expression), lifecycle rules (transitions from warm storage to cold storage, and final expiration), and target backup vaults.
• Backup Vaults: Encrypted logical containers in AWS Backup that store and organize recovery points. Vaults are encrypted using AWS Key Management Service (AWS KMS).
• Resource Assignment: Resources can be assigned to plans using explicit resource ARNs or dynamically via AWS Resource Tags (e.g., BackupPlan = ProductionDaily). Supported services include Amazon EBS, EC2, RDS, Aurora, DynamoDB, EFS, FSx, S3, DocumentDB, Neptune, and AWS CloudFormation stacks.

Continuous Backup and Point-in-Time Recovery (PITR)

In addition to scheduled snapshot backups, AWS Backup supports Continuous Backup for transaction-intensive data stores, including Amazon RDS, Amazon Aurora, and Amazon S3:

• Captures transaction log streams continuously alongside periodic base snapshots.
• Enables Point-in-Time Recovery (PITR), allowing administrators to restore data to any chosen second within a retention window of up to 35 days.
• Crucial for rolling back database corruption, accidental table drops, or bad application deployments without losing transactions recorded up to the exact second before the incident.

Cross-Account and Cross-Region Backup Copies

To safeguard against regional outages and sophisticated ransomware attacks that compromise an entire AWS account, AWS Backup automates Cross-Region and Cross-Account Backup Copies:

[ Source Account: Production (111111111111) ]
  AWS Backup Plan ──> Source Vault (Region: us-east-1)
                           │
                           ├─ 1. Replicates to DR Region (us-west-2)
                           │     Target Vault (Encrypted with us-west-2 CMK)
                           │
                           ▼ 2. Cross-Account Copy
[ Target Account: Isolated Disaster Recovery / Security (999999999999) ]
  Isolated Backup Vault (Access Policy: Restrict Delete Actions)
  KMS Customer Managed Key (Key Policy: Grants Decrypt/Encrypt to Account 111111111111)

[!IMPORTANT] DOP-C02 Exam Trap: AWS Backup cannot copy recovery points across accounts using default AWS-managed KMS keys (aws/backup). The source and destination backup vaults must be encrypted with AWS KMS Customer Managed Keys (CMKs). The destination KMS key policy and destination backup vault access policy must explicitly grant backup:CopyIntoBackupVault and cryptographic permissions to the source account root or backup service role.

AWS Backup Vault Lock: Governance Mode vs. Compliance Mode

To meet regulatory compliance standards (such as SEC Rule 17a-4, FINRA, and HIPAA) and prevent ransomware from wiping recovery points, AWS Backup provides Vault Lock, enforcing Write-Once-Read-Many (WORM) storage immutability.

AWS Elastic Disaster Recovery (AWS DRS)

AWS Elastic Disaster Recovery (AWS DRS) is the recommended service for continuous disaster recovery replication of physical, virtual, and cloud-based servers into AWS. DRS minimizes downtime and data loss by providing fast, reliable recovery of on-premises, VMware, Hyper-V, and cross-cloud or cross-region AWS workloads.

Continuous Block-Level Replication Mechanics

1. AWS Replication Agent: Installed directly on the operating system of source servers. It operates at the storage driver level, capturing every block change in real time.
2. Encrypted Transport: The agent streams modified blocks over TLS across TCP port 1500 (or via AWS Direct Connect / AWS Site-to-Site VPN) to the designated AWS recovery region.
3. Staging Area Subnet: Data lands in an isolated, lightweight Staging Area VPC:
   • Replication Servers: Low-cost, lightweight Amazon EC2 instances (typically t3.small or t3.medium) that act as ingestion proxies.
   • Staging EBS Volumes: Low-cost Amazon EBS volumes (such as sc1, st1, or gp3) that maintain a 1:1 block replica of each source disk.
4. Cost Optimization: Full-scale compute instances (e.g., memory-optimized or compute-optimized production instances) are not provisioned during normal operation. The organization pays only for the lightweight staging instances and EBS storage.

Launch Templates and Non-Disruptive Drills

When a disaster strikes or during scheduled operational validation:

• Launch Settings & Templates: Each replicated server is associated with an Amazon EC2 Launch Template that specifies the target subnet, security groups, instance type, and volume performance tiers (such as gp3 or io2).
• Non-Disruptive Drills: DevOps engineers can launch recovery instances into an isolated testing VPC at any time without interrupting ongoing block-level replication and without impacting the production source environment. Once testing completes, the drill instances are terminated with a single API call.
• Failback Automation: When primary infrastructure is restored, AWS DRS coordinates reverse replication, streaming changed blocks from AWS back to the source server before completing a clean failback.

Automated Resiliency Assessment with AWS Resilience Hub

AWS Resilience Hub provides a centralized dashboard to assess, manage, and track the resiliency posture of AWS workloads. It bridges the gap between infrastructure deployment and disaster recovery validation.

Assessment Lifecycle

1. Workload Ingestion: Ingests application architecture definitions from AWS CloudFormation stacks, Terraform state files, AWS Service Catalog AppRegistry applications, or Amazon EKS resource groups.
2. RTO and RPO Objective Definition: Defines business-level RTO and RPO targets for disruption categories: Application disruptions, Infrastructure disruptions, Availability Zone disruptions, and Regional disruptions.
3. Resiliency Score and Gap Analysis: Analyzes architecture against the AWS Well-Architected Framework and historical operational data, calculating an overall Resiliency Score (0–100%). It highlights gaps where stated RTO/RPO targets cannot be met (e.g., a single-AZ RDS instance, unbacked EBS volumes, or missing Route 53 health checks).
4. Automated Artifact Generation: Resilience Hub automatically outputs actionable operational code:
   • CloudWatch Alarms: Metric alarms for critical latency and fault indicators.
   • SSM Automation Runbooks: Standard operating procedures (SOPs) for failover and database restoration.
   • AWS Fault Injection Simulator (FIS) Templates: Pre-configured chaos experiments designed to inject faults and verify that automated recovery runbooks execute successfully.