canonical: https://jentic.com/apis/amazonaws.com/backup

# AWS Backup

AWS Backup is a unified, policy-based backup service for AWS resources, including EBS volumes, EC2 instances, RDS and Aurora databases, DynamoDB tables, EFS, FSx, S3, and Storage Gateway. The API lets you define backup plans with schedules and retention rules, group resources via selections and tags, store recovery points in encrypted backup vaults with vault locks for immutability, restore on demand, and run audit frameworks with reports for compliance evidence. It also supports legal holds that block deletion of designated recovery points.

## For AI agents

Schedule, run, and restore backups across AWS resources, manage backup vaults and retention policies, and surface compliance reports so an agent can keep customer data recoverable.

## Scope

Does not provide application-aware database log shipping, file-level on-prem backup agents, or long-term archival outside AWS. Use for AWS-resource backup, restore, and policy management only.

## Capabilities

- Define backup plans with schedule expressions, retention windows, lifecycle to cold storage, and copy actions to other regions
- Group resources into backup selections by ARN list or tag rules so the right resources are protected automatically
- Create encrypted backup vaults and apply vault locks for write-once-read-many immutability against ransomware
- Start an on-demand backup job, check job status, and stop a job mid-flight
- Restore from a recovery point to a new resource (EBS volume, RDS instance, EFS file system) with restore parameters
- Place legal holds on recovery points to prevent deletion during litigation or investigation
- Run AWS Backup Audit Manager frameworks and generate compliance reports against backup posture

## Use cases

### Daily RDS Backup with 35-Day Retention

Protect production RDS databases with a daily backup plan and 35-day retention without writing custom Lambda jobs. Create a backup plan with a daily cron schedule and a lifecycle that moves recovery points to cold storage after 30 days, then create a backup selection that targets RDS instances tagged Backup=daily. AWS Backup runs the schedule, encrypts recovery points in the vault, and lets you restore to a new instance on demand. Initial setup takes about an hour.

Example prompt: Create a backup plan named rds-daily with a rule scheduled cron(0 2 * * ? *), DeleteAfterDays=35, and a backup selection IamRoleArn=arn:..., conditions targeting tag Backup=daily.

### Ransomware-Resistant Vault Lock

Make backups truly immutable so a compromised IAM identity cannot delete or shorten retention on recovery points. Apply a vault lock to a backup vault with PutBackupVaultLockConfiguration and a minimum and maximum retention period; once the cooldown elapses the lock is permanent. Suitable for regulated industries and for recovery from ransomware attacks that target backups first.

Example prompt: Call PutBackupVaultLockConfiguration on vault prod-vault with MinRetentionDays=30, MaxRetentionDays=3650, and ChangeableForDays=3.

### Disaster Recovery Restore

Recover a production resource from a recovery point during an incident, such as a corrupted EBS volume, a deleted DynamoDB table, or an unintentionally truncated EFS share. Use ListRecoveryPointsByBackupVault to find the right point, then StartRestoreJob with the resource-specific metadata to create a new resource. AWS Backup tracks the job status and the operator can attach the restored resource once the job completes.

Example prompt: Find the latest recovery point for resource arn:aws:ec2:...:volume/vol-0abc, then call StartRestoreJob with metadata including AvailabilityZone and encrypted=true to create a new EBS volume.

### Agent-Driven Compliance Sweep

Let a compliance agent verify that every tagged production database, file system, and table has a recent successful backup, raising an alert otherwise. The agent calls AWS Backup through Jentic to list protected resources, fetch their last successful backup time, and compare against policy thresholds. AWS credentials never leave your Jentic One instance, and the same agent logic runs unmodified across customer accounts.

Example prompt: Search Jentic for 'list protected resources in AWS Backup', execute it filtered by tag Environment=production, and for each resource fetch the latest recovery point with ListRecoveryPointsByResource, raising an alert if no recovery point is younger than 24 hours.

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| PUT | /backup/plans/ | Create a backup plan |
| GET | /backup/plans/ | List backup plans |
| PUT | /backup/plans/{backupPlanId}/selections/ | Create a backup selection |
| PUT | /backup-vaults/{backupVaultName} | Create a backup vault |
| GET | /backup-vaults/{backupVaultName} | Describe a backup vault |
| POST | /legal-holds/ | Create a legal hold |
| POST | /audit/frameworks | Create an audit framework |
| GET | /audit/frameworks | List audit frameworks |

## Key resources

- **Backup Plans** — Schedules, lifecycle rules, retention, and copy actions defining when and where backups run.
- **Backup Selections** — Resource targeting via ARN lists or tag conditions linked to a backup plan.
- **Backup Vaults** — Encrypted containers for recovery points, with optional vault locks for immutability.
- **Recovery Points** — Individual backup snapshots with retention metadata, available for restore.
- **Backup and Restore Jobs** — Running and historical jobs with status, percent complete, and error reasons.
- **Legal Holds** — Restrictions that prevent deletion of designated recovery points during legal events.
- **Audit Frameworks and Reports** — Compliance frameworks and generated reports against backup posture.

## Why Jentic

- **Setup:** Wiring AWS Backup by hand means holding an access key ID and secret access key, computing an AWS Signature Version 4 signature on every request, resolving the correct regional backup host, and handling throttling and retries yourself. Through Jentic you install once, import AWS Backup from the API Directory, store the AWS access key once, and your agent calls it.
- **Permission scoping:** Backup puts the plan and vault identifiers in the URL path (/backup/plans/{backupPlanId}/... and /backup-vaults/{backupVaultName}), so a rule can pin your agent to a specific plan or vault. You choose the operations it may call, so destructive ones like deleting a backup plan or vault are not included unless you add them.
- **Credential handling:** Your AWS access key ID and secret access key are stored once, encrypted, by your own Jentic One instance, and the Signature Version 4 signature is computed at execution time. The raw keys never enter the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'create a backup plan' or 'start a restore job', and Jentic returns the matching AWS Backup operation with its input schema so the agent calls the right endpoint without crawling the AWS reference.

## Related APIs

- **AWS Support API** — Open and track support cases when a backup job fails or a restore needs hands-on AWS engineering help.
- **Amazon EC2 (EBS Snapshots)** — Direct EBS snapshot APIs for ad-hoc point-in-time copies without the policy framework.
- **AWS CloudTrail** — Audit trail of every backup plan, vault, and recovery point change for compliance review.

## FAQ

### What authentication does the AWS Backup API use?

All requests are signed with AWS Signature Version 4 using an AWS access key ID and secret access key. Through Jentic, the keys live encrypted in the vault and Jentic computes the signature server-side; the agent only holds a scoped Jentic credential.

### Which AWS services can AWS Backup protect?

AWS Backup supports EBS volumes, EC2 instances, RDS and Aurora databases, DynamoDB tables, EFS file systems, FSx file systems, Amazon S3 buckets, AWS Storage Gateway, Amazon Neptune, Amazon DocumentDB, Amazon Redshift, and Amazon Timestream, among others, all from a single backup plan.

### Can I make backups immutable to defend against ransomware?

Yes. Apply a vault lock to a backup vault with PutBackupVaultLockConfiguration and a minimum retention. Once the cooldown elapses (governance lock) or immediately (compliance lock), even root cannot delete or shorten retention until the recovery point reaches its expiry.

### How do I restore a resource from a backup through Jentic?

Search Jentic for 'restore from an AWS Backup recovery point', load the StartRestoreJob schema, and execute it with the recovery point ARN, the IAM role, and the service-specific metadata. The operation maps to POST /restore-jobs and Jentic returns the job ID so the agent can poll DescribeRestoreJob until completion.

### What are the rate limits for the AWS Backup API?

AWS Backup applies standard AWS throttling and returns ThrottlingException when exceeded. Heavy job listings should be paginated with NextToken; high-volume restore creation should be batched and retried with exponential backoff.

### How is AWS Backup priced?

You pay for storage of recovery points (with separate warm and cold pricing), restore charges per service, and any cross-region copy data transfer. The backup plan, vault, and policy infrastructure itself has no separate charge.

### Can I limit what my agent is allowed to do with the AWS Backup API?

Yes. Because Jentic One is self-hosted, you set the rules that decide which AWS Backup operations and credentials your agent may use. AWS Backup puts the plan and vault identifiers in the URL path, such as /backup/plans/{backupPlanId} and /backup-vaults/{backupVaultName}, so you can pin the agent to a specific backup plan or vault. You also choose the exact operations it may call, so destructive ones like deleting a backup plan or a vault stay out of reach unless you explicitly add them.