Amazon EC2 Backup and Restore Using AWS Backup

3.1 — Configure the services used with AWS Backup

a. In the left navigation pane in the AWS Backup console, under My account, choose Settings.
b. On the Service opt-in page, choose Configure resources.

c. On the Configure resources page, use the toggle switches to enable or disable the services used with AWS Backup. Choose Confirm when your services are configured.

• AWS resources that you're backing up should be in the Region you are using for this tutorial, and resources must all be in the same AWS Region (however, see step 3.2 for information on Cross-Region Copy). This tutorial uses the US West (Oregon) Region (us-west-1).
  
  

3.2 — Configure a backup plan for an Amazon EC2 instance

d. In the AWS Backup console, select Backup plans in the left navigation pane under My account, and then Create backup plan.

e. AWS Backup provides three ways to get started using backup plans, but for this tutorial, select Build a new plan:

• Start with a template — You can create a new backup plan based on a template provided by AWS Backup. Be aware that backup plans created by AWS Backup are based on backup best practices and common backup policy configurations. When you select an existing backup plan to start from, the configurations from that backup plan are automatically populated for your new backup plan. You can then change any of these configurations according to your backup requirements.
• Build a new plan — You can create a new backup plan by specifying each of the backup configuration details, as described in the next section. You can choose from the recommended default configurations.
• Define a plan using JSON — You can modify the JSON expression of an existing backup plan or create a new expression.
  

f. Backup plan name — You must provide a unique backup plan name. If you try to create a backup plan that is identical to an existing plan, you get an AlreadyExistsException error. For this tutorial, enter EC2-webapp.

g. Backup rule name — Backup plans are composed of one or more backup rules. Backup rule names are case sensitive. They must contain from 1 to 63 alphanumeric characters or hyphens. For this tutorial, enter EC2-Dailies.

h. Backup vault — A backup vault is a container to organize your backups in. Backups created by a backup rule are organized in the backup vault that you specify in the backup rule. You can use backup vaults to set the AWS Key Management Service (AWS KMS) encryption key that is used to encrypt backups in the backup vault and to control access to the backups in the backup vault. You can also add tags to backup vaults to help you organize them. If you don't want to use the default vault, you can create your own.

• Create new Backup vault — Instead of using the default backup vault that is automatically created for you in the AWS Backup console, you can create specific backup vaults to save and organize groups of backups in the same vault.
  i)    To create a backup vault, choose Create new Backup vault.
  

ii) Enter a name for your backup vault. You can name your vault to reflect what you will store in it, or to make it easier to search for the backups you need. For example, you could name it FinancialBackups.
iii) Select an AWS KMS key. You can use either a key that you already created or select the default AWS Backup KMS key.
iv) Optionally, add tags that will help you search for and identify your backup vault.
v) Choose the Create Backup vault button.

i. Backup frequency — The backup frequency determines how often a backup is created. You can choose a frequency of every 12 hours, daily, weekly, or monthly. When selecting weekly, you can specify which days of the week you want backups to be taken. When selecting monthly, you can choose a specific day of the month.

j. Enable continuous backups for point-in-time recovery — With continuous backups, you can perform point-in-time restores (PITRs) by choosing when to restore, down to the second. The most time that can elapse between the current state of your workload and your most recent point-in-time restore is 5 minutes. You can store continuous backups for up to 35 days. If you do not enable continuous backups, AWS Backup takes snapshot backups for you.

k. Backup window — Backup windows consist of the time that the backup window begins and the duration of the window in hours. The default backup window is set to start at 5 AM UTC (Coordinated Universal Time) and lasts 8 hours.

m. Retention period — AWS Backup automatically deletes your backups at the end of this period to save storage costs for you. AWS Backup can retain snapshots between 1 day and 100 years (or indefinitely, if you do not enter a retention period), and continuous backups between 1 and 35 days.

n. Copy to destination — As part of your backup plan, you can optionally create a backup copy in another AWS Region. Using AWS Backup, you can copy backups to multiple AWS Regions on-demand, or automatically as part of a scheduled backup plan. Cross-Region Replication (CRR) is particularly valuable if you have business continuity or compliance requirements to store backups a minimum distance away from your production data. When you define a backup copy, you configure the following options:

• Copy to destination — The destination Region for the backup copy.
• Destination Backup vault — The destination backup vault for the copy.
• (Advanced Settings) Transition to cold storage
• (Advanced Settings) Retention period
  
  • Note: Cross-Region Copy incurs additional data transfer costs. You can refer to the AWS Backup pricing page for more information.
    
    

o. Tags added to recovery points — The tags that you list here are automatically added to backups when they are created.

p. Advanced backup settings — Enables application-consistent backups for third-party applications that are running on Amazon EC2 instances. Currently, AWS Backup supports Windows VSS backups. This is only applicable for Windows EC2 Instances running SQL Server or Exchange databases.

q. Choose Create plan.

a. Select the created backup plan and choose the Assign resources button.

c. IAM role — When creating a tag-based backup plan, if you choose a role other than Default role, make sure that it has the necessary permissions to back up all tagged resources. AWS Backup tries to process all resources with the selected tags. If it encounters a resource that it doesn't have permission to access, the backup plan fails.

d. Define resource selection — You can choose to include all resource types or specific resource types.

e. For resource ID-based assignment, select Resource type and the name of the resource.

f. To exclude specific resource IDs, select Resource type and the name of the resource.

h. Choose the Resource selection button to assign the resources to the backup plan.

i. Navigate to the AWS Backup console. The backup jobs will be seen under Jobs.

j. A backup, or recovery point, represents the content of a resource, such as an Amazon EC2 instance or Amazon RDS database, at a specified time. Recovery point is a term that refers generally to the different backups in AWS services, such as Amazon EBS snapshots and Amazon RDS backups. In AWS Backup, recovery points are saved in backup vaults, which you can organize according to your business needs. Each recovery point has a unique ID.