Centralized backup: SAA-C03 study notes and practice questions
What to know about Centralized backup for the SAA-C03 exam, from the Design Resilient Architectures domain (26% of the exam guide), then 1 free question to test it. Part of the SAA-C03 study guide.
When a scenario asks for consistent backups across several services or accounts, with as little scripting as possible, AWS Backup is the answer. The details are about retention, copies and protection against deletion.
Key facts
One service, many resources: EC2, EBS, RDS, Aurora, DynamoDB, EFS, FSx, S3, Storage Gateway, DocumentDB, Neptune, Redshift and more.
Backup plans define frequency, backup window, retention and lifecycle (for example, move to cold storage after 30 days). Resources are assigned by tag or resource ID, so new resources tagged backup=daily are protected automatically.
Copy rules send copies to another Region or another account, for disaster recovery and to protect against a compromised account.
AWS Organizations backup policies apply plans across every account from the management account or a delegated administrator.
Backup Vault Lock makes backups immutable (write once, read many). In compliance mode, once the grace period ends, no one, not even the root user, can delete backups or shorten retention. Governance mode lets users with specific permissions change it.
Logically air-gapped vaults store backups in a locked vault owned by AWS that can be shared to another account for recovery.
Point-in-time recovery for supported services (such as RDS and DynamoDB) lets you restore to any second within the retention window.
AWS Backup Audit Manager reports on whether backups meet your policies.
How to choose
The scenario says
Look for
Back up EBS, RDS and DynamoDB on one schedule with no scripts
AWS Backup plan with tag-based assignment
Same policy across all accounts
Organizations backup policy
Backups must survive ransomware or a rogue administrator
Vault Lock in compliance mode, plus a cross-account copy
A copy in another Region for DR
Copy rule to a vault in that Region
Common traps
Lambda functions calling snapshot APIs on a schedule. It works, but fails “least operational overhead”.
Relying on IAM to stop deletion. An administrator can change IAM; Vault Lock in compliance mode can’t be undone.
Using governance mode when “no one” must be able to delete. That’s compliance mode.
A company runs workloads in 25 AWS accounts in AWS Organizations, using Amazon EBS volumes, Amazon RDS databases and Amazon DynamoDB tables.
Auditors require one centrally managed backup policy for every account, a copy of each backup in a second AWS Region, and backups that nobody, including administrators in the management account, can delete or shorten before 35 days have passed.
Which solution meets these requirements?
Choose one answer.
AA. Create Amazon Data Lifecycle Manager policies in each account with cross-Region copy rules, and an SCP that denies deleting snapshots.
BB. Deploy AWS Backup policies from the management account with a cross-Region copy rule, and an SCP that denies deleting recovery points.
CC. Turn on RDS backup replication, DynamoDB point-in-time recovery and EBS snapshot schedules in each account, plus an SCP that denies deletes.
DD. Deploy AWS Backup policies from the management account with a cross-Region copy rule, and lock the backup vaults in compliance mode.
Show the answer and explanation
Answer: D
A. Wrong: Data Lifecycle Manager manages only EBS snapshots and EBS-backed AMIs, so it cannot back up the RDS databases or DynamoDB tables. It is also configured per account, and an SCP does not restrict users or roles in the management account. Learn more: How Amazon Data Lifecycle Manager works (opens in a new tab)
B. Wrong: Organization backup policies and copy rules meet the central policy and second-Region needs. However, SCPs do not affect users or roles in the management account, and administrators there can edit or detach the SCP, so the backups are not truly undeletable. Learn more: Service control policies (SCPs) (opens in a new tab)
C. Wrong: These native features protect each service separately, so there is no single central policy across the 25 accounts, and each must be set up and checked account by account. The SCP has the same weakness as before: it does not bind the management account. Learn more: Replicating automated backups to another AWS Region (opens in a new tab)
D. Right: Correct. Backup policies in AWS Organizations apply the same backup plan to every member account, and copy actions place copies in a vault in another Region. After its grace time ends, a compliance-mode Vault Lock with a 35-day minimum retention cannot be changed or removed by any user or by AWS. DynamoDB copies across Regions need AWS Backup's advanced DynamoDB features turned on. Learn more: AWS Backup Vault Lock (opens in a new tab)
Explanation
AWS Backup covers EBS, RDS and DynamoDB in one service, Organizations backup policies give one central policy for all accounts, and copy rules add a second-Region copy. The deciding requirement is immutability against management-account administrators: SCPs never restrict the management account, but AWS Backup Vault Lock in compliance mode cannot be altered by anyone once its grace time ends.
Want more on Centralized backup? The 5 full-length practice sets have 10 more Centralized backup questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →