TECH **AWS Backup & Cross-Region Backup: Zero-Fluff, Hands-On Study Guide**

AWS Backup & Cross-Region Backup: Zero-Fluff, Hands-On Study Guide

(AWS Solutions Architect – Associate)

1. What This Is & Why It Matters

You’re a cloud engineer at a fintech startup. Your CTO just got off a call with the board: "We need a bulletproof backup strategy—if our primary AWS region goes down, we must recover in under 30 minutes. And by the way, compliance requires 7-year retention for all financial data."

This is where AWS Backup and cross-region backups come in.
- AWS Backup is a centralized, policy-driven service that automates backups for AWS resources (EC2, RDS, EBS, DynamoDB, EFS, etc.).
- Cross-region backups copy your backups to a secondary AWS region, giving you disaster recovery (DR) if your primary region fails (e.g., us-east-1 outage).

Why this matters in production:
- Without backups: A single DELETE command, ransomware attack, or region outage could wipe out your data permanently.
- Without cross-region backups: If your primary region goes down (e.g., AWS outage, natural disaster), you’re offline until it recovers.
- With AWS Backup + cross-region:
- Automate backups (no manual scripts).
- Meet compliance (e.g., HIPAA, GDPR, SOX).
- Recover fast (RTO = Recovery Time Objective).
- Save money (no over-provisioning storage).

Real-world scenario:
You inherit a legacy AWS environment where backups are done via cron jobs and S3 copies. The scripts are brittle, retention is inconsistent, and there’s no cross-region protection. Your mission: Replace this with AWS Backup, enforce 30-day retention, and replicate backups to us-west-2 for DR.

2. Core Concepts & Components

3. Step-by-Step: Set Up Cross-Region Backups for RDS

Prerequisites

• AWS account with admin IAM permissions (or AWSBackupFullAccess).
• An RDS instance (e.g., MySQL) in us-east-1.
• A secondary region (e.g., us-west-2) for DR.

Step 1: Create a Backup Vault in Primary Region

aws backup create-backup-vault \
  --backup-vault-name "PrimaryBackupVault" \
  --region us-east-1

Verify:

aws backup describe-backup-vault --backup-vault-name "PrimaryBackupVault" --region us-east-1

Step 2: Create a Backup Vault in Secondary Region

aws backup create-backup-vault \
  --backup-vault-name "DRBackupVault" \
  --region us-west-2

Step 3: Create a Backup Plan

Save this as backup-plan.json:

{
  "BackupPlan": {
    "BackupPlanName": "RDS-Daily-Backup-Plan",
    "BackupPlanRule": [
      {
        "RuleName": "DailyBackup",
        "TargetBackupVault": "PrimaryBackupVault",
        "ScheduleExpression": "cron(0 5 * * ? *)",  # 5 AM UTC daily
        "StartWindowMinutes": 60,
        "CompletionWindowMinutes": 180,
        "Lifecycle": {
          "DeleteAfterDays": 30  # Retain for 30 days
        },
        "CopyActions": [
          {
            "DestinationBackupVaultArn": "arn:aws:backup:us-west-2:123456789012:backup-vault:DRBackupVault",
            "Lifecycle": {
              "DeleteAfterDays": 30
            }
          }
        ]
      }
    ]
  }
}

Apply the plan:

aws backup create-backup-plan --backup-plan file://backup-plan.json --region us-east-1

Step 4: Assign Resources to the Backup Plan

aws backup create-backup-selection \
  --backup-plan-id $(aws backup list-backup-plans --query "BackupPlans[?BackupPlanName=='RDS-Daily-Backup-Plan'].BackupPlanId" --output text --region us-east-1) \
  --backup-selection '{
    "SelectionName": "RDS-Backup-Selection",
    "IamRoleArn": "arn:aws:iam::123456789012:role/service-role/AWSBackupDefaultServiceRole",
    "Resources": ["arn:aws:rds:us-east-1:123456789012:db:my-database"]
  }' \
  --region us-east-1

Verify:

aws backup list-backup-jobs --region us-east-1

Step 5: Test Recovery (Critical!)

1. Go to AWS Backup Console → Recovery Points.
2. Select a recovery point → Restore.
3. Choose Restore to point in time (for RDS) or Create new instance (for EC2).
4. Verify the restored resource works.

4. ? Production-Ready Best Practices

Security

• IAM: Use AWSBackupDefaultServiceRole (least privilege) or create a custom role with: json {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"backup:CreateBackup",
"backup:CopyIntoRegion",
"rds:CreateDBSnapshot"
],
"Resource": "*"
}
] }
• Encryption: Backups are encrypted by default (AWS KMS). Use a customer-managed CMK for audit trails.
• Vault Lock: Enable Backup Vault Lock to prevent deletion (compliance requirement).

Cost Optimization

• Lifecycle Rules: Move old backups to S3 Glacier or Glacier Deep Archive after 30 days.
  bash aws backup put-backup-vault-access-policy \
--backup-vault-name "PrimaryBackupVault" \
--policy '{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Deny",
"Principal": "*",
"Action": "backup:DeleteBackupVault",
"Resource": "*"
}
]
}'
• Cross-Region Costs: Data transfer between regions costs ~$0.02/GB. Budget for it.

Reliability & Maintainability

• Tagging: Tag resources with Backup:Daily or Backup:Weekly to target them in Backup Plans.
• Monitoring: Set CloudWatch alarms for BackupJobFailed events.
• Testing: Always test restores. A backup you can’t restore is useless.

Observability

• CloudWatch Metrics:
• NumberOfBackupJobsFailed
• NumberOfBackupJobsCompleted
• BackupSizeInBytes
• AWS Backup Audit Manager: Generate compliance reports for auditors.

5. ⚠️ Common Mistakes & Traps

6. ? Exam/Certification Focus

Typical Question Patterns

1. "Which AWS service automates backups for EC2, RDS, and DynamoDB?"
2. ✅ AWS Backup
3. ❌ AWS Storage Gateway (for hybrid)

4. ❌ S3 Versioning (only for S3)

5. "You need to retain backups for 7 years for compliance. What’s the most cost-effective way?"

6. ✅ AWS Backup + S3 Glacier Deep Archive lifecycle rule

7. ❌ Keep all backups in S3 Standard (expensive)

8. "How do you ensure backups are available if us-east-1 fails?"

9. ✅ Enable cross-region copy in Backup Plan
10. ❌ Use S3 Cross-Region Replication (only for S3)

Key ⚠️ Trap Distinctions

• Backup Vault vs. S3 Bucket:
• Backup Vault = Managed by AWS Backup (for RDS, EC2, etc.).
• S3 Bucket = Manual backups (e.g., aws s3 cp).
• Cross-Region Copy vs. Cross-Region Replication:
• Cross-Region Copy = For AWS Backup (RDS, EC2, etc.).
• Cross-Region Replication = For S3 only.

7. ? Hands-On Challenge

Challenge:
"You have an EC2 instance in us-east-1. Set up a Backup Plan that: 1. Takes daily backups at 3 AM UTC. 2. Retains backups for 14 days. 3. Copies backups to us-west-2 for DR. 4. Test a restore."

Solution:
1. Create a Backup Vault in us-east-1 and us-west-2.
2. Create a Backup Plan with:
json
{
"BackupPlanName": "EC2-Daily-Backup",
"BackupPlanRule": [
{
"RuleName": "DailyBackup",
"TargetBackupVault": "PrimaryBackupVault",
"ScheduleExpression": "cron(0 3 * * ? *)",
"Lifecycle": { "DeleteAfterDays": 14 },
"CopyActions": [{
"DestinationBackupVaultArn": "arn:aws:backup:us-west-2:123456789012:backup-vault:DRBackupVault"
}]
}
]
} 3. Assign the EC2 instance to the Backup Plan.
4. Restore the EC2 instance from a recovery point.

Why it works:
- The CopyActions field ensures cross-region replication.
- DeleteAfterDays: 14 enforces retention.

8. ? Rapid-Reference Crib Sheet

9. ? Where to Go Next

1. AWS Backup Documentation – Official guide.
2. AWS Backup Workshop – Hands-on labs.
3. AWS Well-Architected Framework – Backup & Restore – Best practices.
4. AWS Backup Audit Manager – Compliance reporting.

Final Tip:
"Backups are like insurance—you only realize their value when disaster strikes. Test your restores monthly, and never assume a backup exists until you’ve verified it." ?