Backups & Disaster Recovery
Decide how much data and time you can afford to lose (your RPO and RTO), automate backups with AWS Backup, and actually rehearse the restore — an untested backup is just a hope.
Backups are the classic thing everyone agrees is important and nobody tests. Let's fix both halves.
Speak in RPO and RTO
- RPO (Recovery Point Objective) — how much data you can afford to lose, in time. An hourly snapshot means up to an hour of loss.
- RTO (Recovery Time Objective) — how long you can be down while recovering.
These two numbers drive everything, and they cost money in opposite directions — tighter targets, bigger bill. Pick them deliberately per workload.
Automate it with AWS Backup
AWS Backup gives you one place to define backup plans — schedules, retention, lifecycle to cold storage — and apply them across EBS, RDS, DynamoDB, EFS and more via tags. Enable a vault lock so backups cannot be deleted early, even by an admin (your ransomware insurance).
Choose a DR strategy honestly
AWS describes four, cheapest to priciest: Backup & Restore, Pilot Light, Warm Standby, and Multi-Site Active/Active. Most teams need Pilot Light or Warm Standby — do not pay for active/active unless the business truly needs seconds of RTO.
The part people skip: rehearse
A backup you have never restored is Schrödinger's backup. Schedule a real restore drill each quarter and measure the actual RTO against the one you promised.
Example
{
"BackupPlan": {
"BackupPlanName": "daily-35day-retention",
"Rules": [
{
"RuleName": "DailyBackups",
"TargetBackupVaultName": "Default",
"ScheduleExpression": "cron(0 5 ? * * *)",
"StartWindowMinutes": 60,
"CompletionWindowMinutes": 180,
"Lifecycle": {
"MoveToColdStorageAfterDays": 7,
"DeleteAfterDays": 35
},
"CopyActions": [
{
"DestinationBackupVaultArn": "arn:aws:backup:us-west-2:123456789012:backup-vault:dr-vault"
}
]
}
]
}
}When to use it
- A company uses AWS Backup to create daily snapshots of all RDS instances and EBS volumes on a retention schedule, satisfying a 30-day RPO requirement.
- An operations team documents that their RTO is 4 hours and tests cross-region restore from S3 snapshots monthly to confirm they can meet it.
- A platform team replicates S3 buckets cross-region using CRR so if us-east-1 becomes unavailable, data is available in us-west-2 within minutes.
More examples
Create AWS Backup Vault and Plan
Creates a backup vault and a plan that runs daily at 2 AM and retains backups for 30 days, addressing RPO requirements.
aws backup create-backup-vault \
--backup-vault-name prod-vault
aws backup create-backup-plan \
--backup-plan '{
"BackupPlanName": "daily-30day",
"Rules": [{
"RuleName": "daily",
"TargetBackupVaultName": "prod-vault",
"ScheduleExpression": "cron(0 2 * * ? *)",
"Lifecycle": {"DeleteAfterDays": 30}
}]
}'Enable S3 Cross-Region Replication
Configures S3 Cross-Region Replication so every new object written to the source bucket is automatically copied to a DR bucket.
aws s3api put-bucket-replication \
--bucket source-bucket-us-east-1 \
--replication-configuration '{
"Role": "arn:aws:iam::123456789012:role/S3ReplicationRole",
"Rules": [{
"Status": "Enabled",
"Destination": {
"Bucket": "arn:aws:s3:::replica-bucket-us-west-2"
}
}]
}'List Available Recovery Points
Lists all recovery points in a backup vault with their type and creation date, confirming backups ran as expected.
aws backup list-recovery-points-by-backup-vault \
--backup-vault-name prod-vault \
--query 'RecoveryPoints[].{ARN:RecoveryPointArn,Resource:ResourceType,Created:CreationDate,Status:Status}' \
--output table
Discussion