AWS Backup

AWS Backup is a centralized, policy-driven backup service. Instead of setting up backups separately for each service — EBS snapshots here, RDS automated backups there, a Lambda cron job for something else — you define one backup policy and AWS Backup applies it consistently across many services and even across accounts.

The Problem It Solves

Left to their own devices, teams end up with a patchwork: per-service snapshot schedules, home-grown Lambda + EventBridge scripts, tag-based cleanup jobs, and inconsistent retention. It's fragile, hard to audit, and easy to get wrong.

AWS Backup replaces that patchwork with a single control plane: define what to protect, how often, how long to keep it, and where to copy it — once — and let the service enforce it everywhere.

The Main Building Blocks

Backup plan — the policy: how often to back up, how long to keep it, when to move it to cheaper cold storage, and whether to copy it elsewhere.

Resource assignment — what the plan protects. The common approach is by tag: tag a resource backup=daily and it's automatically covered, including resources created in the future.

Backup vault — the encrypted container where backups (called recovery points) are stored. A vault can be locked so backups can't be deleted early.

Why It Matters for Resilience

Backups are only useful if they're consistent, protected, and restorable. AWS Backup adds three things that ad-hoc snapshots struggle with: immutability (Vault Lock, so backups survive even a compromised admin), copies to other Regions/accounts for disaster recovery, and organization-wide enforcement so no account can quietly skip backing up.