addRule

addSelection

BackupPlan

backupPlanName

Rules for the backup plan.

Use `addRule()` to add rules after
instantiation.

backupPlanRules

The backup vault where backups are stored.

backupVault

windowsVss

BackupSelection

backupPlan

The resources to backup.

Use the helper static methods defined on `BackupResource`.

resources

Whether to automatically give restores permissions to the role that AWS Backup uses.

If `true`, the `AWSBackupServiceRolePolicyForRestores` managed
policy will be attached to the role.

allowRestores

backupSelectionName

Whether to disable automatically assigning default backup permissions to the role that AWS Backup uses.

If `false`, the `AWSBackupServiceRolePolicyForBackup` managed policy will be
attached to the role.

disableDefaultBackupPolicy

The role that AWS Backup uses to authenticate when backuping or restoring the resources.

The `AWSBackupServiceRolePolicyForBackup` managed policy
will be attached to this role unless `disableDefaultBackupPolicy`
is set to `true`.

role

Adds a statement to the vault access policy.

addToAccessPolicy

Adds a statement to the vault access policy that prevents anyone from deleting a recovery point.

blockRecoveryPointDeletion

Grant the actions defined in actions to the given grantee on this Backup Vault resource.

[disable-awslint:no-grants]

grant

BackupVault

A resource-based policy that is used to manage access permissions on the backup vault.

accessPolicy

The name of a logical container where backups are stored.

Backup vaults
are identified by names that are unique to the account used to create
them and the AWS Region where they are created.

backupVaultName

Whether to add statements to the vault access policy that prevents anyone from deleting a recovery point.

The server-side encryption key to use to protect your backups.

encryptionKey

lockConfiguration

notificationEvents

notificationTopic

The removal policy to apply to the vault.

Note that removing a vault
that contains recovery points will fail.

removalPolicy

Contains an optional backup plan display name and an array of `BackupRule` objects, each of which specifies a backup rule.

Each rule in a backup plan is a separate scheduled task and can back up a different selection of AWS resources.

For a sample CloudFormation template, see the [AWS Backup Developer Guide](https://docs.aws.amazon.com/aws-backup/latest/devguide/assigning-resources.html#assigning-resources-cfn) .

CfnBackupPlan

Uniquely identifies the backup plan to be associated with the selection of resources.

backupPlanTags

Specifies a set of resources to assign to a backup plan.

For a sample CloudFormation template, see the [AWS Backup Developer Guide](https://docs.aws.amazon.com/aws-backup/latest/devguide/assigning-resources.html#assigning-resources-cfn) .

CfnBackupSelection

backupPlanId

Specifies the body of a request to assign a set of resources to a backup plan.

It includes an array of resources, an optional array of patterns to exclude resources, an optional role to provide access to the AWS service the resource belongs to, and an optional array of tags used to identify a set of resources.

backupSelection

Creates a logical container where backups are stored.

A `CreateBackupVault` request includes a name, optionally one or more resource tags, an encryption key, and a request ID.

Do not include sensitive data, such as passport numbers, in the name of a backup vault.

For a sample CloudFormation template, see the [AWS Backup Developer Guide](https://docs.aws.amazon.com/aws-backup/latest/devguide/assigning-resources.html#assigning-resources-cfn) .

CfnBackupVault

The name of a logical container where backups are stored.

Backup vaults are identified by names that are unique to the account used to create them and the AWS Region where they are created.

A resource-based policy that is used to manage access permissions on the target backup vault.

backupVaultTags

A server-side encryption key you can specify to encrypt your backups from services that support full AWS Backup management;

for example, `arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab` . If you specify a key, you must specify its ARN, not its alias. If you do not specify a key, AWS Backup creates a KMS key for you by default.

To learn which AWS Backup services support full AWS Backup management and how AWS Backup handles encryption for backups from services that do not yet support full AWS Backup , see [Encryption for backups in AWS Backup](https://docs.aws.amazon.com/aws-backup/latest/devguide/encryption.html)

encryptionKeyArn

Configuration for [AWS Backup Vault Lock](https://docs.aws.amazon.com/aws-backup/latest/devguide/vault-lock.html) .

The SNS event notifications for the specified backup vault.

notifications

Creates a framework with one or more controls.

A framework is a collection of controls that you can use to evaluate your backup practices. By using pre-built customizable controls to define your policies, you can evaluate whether your backup practices comply with your policies and which resources are not yet in compliance.

For a sample CloudFormation template, see the [AWS Backup Developer Guide](https://docs.aws.amazon.com/aws-backup/latest/devguide/bam-cfn-integration.html#bam-cfn-frameworks-template) .

CfnFramework

Contains detailed information about all of the controls of a framework.

Each framework must contain at least one control.

frameworkControls

An optional description of the framework with a maximum 1,024 characters.

frameworkDescription

The unique name of a framework.

This name is between 1 and 256 characters, starting with a letter, and consisting of letters (a-z, A-Z), numbers (0-9), and underscores (_).

frameworkName

frameworkTags

Creates a logical container to where backups may be copied.

This request includes a name, the Region, the maximum number of retention days, the minimum number of retention days, and optionally can include tags and a creator request ID.

> Do not include sensitive data, such as passport numbers, in the name of a backup vault.

CfnLogicallyAirGappedBackupVault

The name of a logical container where backups are stored.

Logically air-gapped backup vaults are identified by names that are unique to the account used to create them and the Region where they are created.

The maximum retention period that the vault retains its recovery points.

maxRetentionDays

This setting specifies the minimum retention period that the vault retains its recovery points.

The minimum value accepted is 7 days.

minRetentionDays

The backup vault access policy document in JSON format.

The server-side encryption key that is used to protect your backups; for example, `arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab` .

If this field is left blank, AWS Backup will create an AWS owned key to be used to encrypt the content of the logically air-gapped vault. The ARN of this created key will be available as `Fn::GetAtt` output.

The Amazon Resource Name (ARN) of the MPA approval team to associate with the backup vault.

This cannot be changed after it is set from the CloudFormation template.

mpaApprovalTeamArn

Returns event notifications for the specified backup vault.

Creates a report plan.

A report plan is a document that contains information about the contents of the report and where AWS Backup will deliver it.

If you call `CreateReportPlan` with a plan that already exists, you receive an `AlreadyExistsException` exception.

For a sample CloudFormation template, see the [AWS Backup Developer Guide](https://docs.aws.amazon.com/aws-backup/latest/devguide/assigning-resources.html#assigning-resources-cfn) .

CfnReportPlan

Contains information about where and how to deliver your reports, specifically your Amazon S3 bucket name, S3 key prefix, and the formats of your reports.

reportDeliveryChannel

Identifies the report template for the report. Reports are built using a report template. The report templates are:.

`RESOURCE_COMPLIANCE_REPORT | CONTROL_COMPLIANCE_REPORT | BACKUP_JOB_REPORT | COPY_JOB_REPORT | RESTORE_JOB_REPORT`

If the report template is `RESOURCE_COMPLIANCE_REPORT` or `CONTROL_COMPLIANCE_REPORT` , this API resource also describes the report coverage by AWS Regions and frameworks.

reportSetting

An optional description of the report plan with a maximum 1,024 characters.

reportPlanDescription

The unique name of the report plan.

This name is between 1 and 256 characters starting with a letter, and consisting of letters (a-z, A-Z), numbers (0-9), and underscores (_).

reportPlanName

reportPlanTags

Creates a restore testing plan.

The first of two steps to create a restore testing plan. After this request is successful, finish the procedure using CreateRestoreTestingSelection.

CfnRestoreTestingPlan

The specified criteria to assign a set of resources, such as recovery point types or backup vaults.

recoveryPointSelection

The RestoreTestingPlanName is a unique string that is the name of the restore testing plan.

This cannot be changed after creation, and it must consist of only alphanumeric characters and underscores.

restoreTestingPlanName

A CRON expression in specified timezone when a restore testing plan is executed.

When no CRON expression is provided, AWS Backup will use the default expression `cron(0 5 ? * * *)` .

scheduleExpression

Optional.

This is the timezone in which the schedule expression is set. By default, ScheduleExpressions are in UTC. You can modify this to a specified timezone.

scheduleExpressionTimezone

Defaults to 24 hours.

A value in hours after a restore test is scheduled before a job will be canceled if it doesn't start successfully. This value is optional. If this value is included, this parameter has a maximum value of 168 hours (one week).

startWindowHours

Optional tags to include.

A tag is a key-value pair you can use to manage, filter, and search for your resources. Allowed characters include UTF-8 letters,numbers, spaces, and the following characters: `+ - = . _ : /.`

CfnRestoreTestingSelection

The Amazon Resource Name (ARN) of the IAM role that AWS Backup uses to create the target resource;

for example: `arn:aws:iam::123456789012:role/S3Access` .

iamRoleArn

The type of AWS resource included in a resource testing selection;

for example, an Amazon EBS volume or an Amazon RDS database.

protectedResourceType

Unique string that is the name of the restore testing plan.

The name cannot be changed after creation. The name must consist of only alphanumeric characters and underscores. Maximum length is 50.

The unique name of the restore testing selection that belongs to the related restore testing plan.

The name consists of only alphanumeric characters and underscores. Maximum length is 50.

restoreTestingSelectionName

You can include specific ARNs, such as `ProtectedResourceArns: ["arn:aws:...", "arn:aws:..."]` or you can include a wildcard: `ProtectedResourceArns: ["*"]` , but not both.

protectedResourceArns

In a resource testing selection, this parameter filters by specific conditions such as `StringEquals` or `StringNotEquals` .

protectedResourceConditions

You can override certain restore metadata keys by including the parameter `RestoreMetadataOverrides` in the body of `RestoreTestingSelection` .

Key values are not case sensitive.

See the complete list of [restore testing inferred metadata](https://docs.aws.amazon.com/aws-backup/latest/devguide/restore-testing-inferred-metadata.html) .

restoreMetadataOverrides

This is amount of hours (1 to 168) available to run a validation script on the data.

The data will be deleted upon the completion of the validation script or the end of the specified retention period, whichever comes first.

AWS Backup

L2 Constructs3

BackupPlan

BackupSelection

BackupVault

L1 Constructs9

CfnBackupPlan

CfnBackupSelection

CfnBackupVault

CfnFramework

CfnLogicallyAirGappedBackupVault

CfnReportPlan

CfnRestoreTestingPlan

CfnRestoreTestingSelection

CfnTieringConfiguration

Learn AWS the Practical Way

Quick Facts

Related Links

More AWS Backup deep dives