AWS Backup: plans, vaults, restore tests

Start as usual:

cd C:\aws-lab
aws login --profile saat-admin
$env:AWS_PROFILE = 'saat-admin'
$v = Get-Content C:\aws-lab\saat-vpc.json | ConvertFrom-Json
$acct = aws sts get-caller-identity --query Account --output text
.\Start-SsmEndpoints.ps1

1Create the backup role and vault

Paste this whole block:

'{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "backup.amazonaws.com" }, "Action": "sts:AssumeRole" } ] }' | Set-Content backup-trust.json
$role = aws iam create-role --role-name saat-backup-role --assume-role-policy-document file://backup-trust.json --tags Key=course,Value=saatvedha-aws --query Role.Arn --output text
aws iam attach-role-policy --role-name saat-backup-role --policy-arn arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup
aws iam attach-role-policy --role-name saat-backup-role --policy-arn arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForRestores
aws backup create-backup-vault --backup-vault-name saat-vault --backup-vault-tags course=saatvedha-aws --query BackupVaultName --output text

You should see this:

saat-vault

The vault uses the AWS managed key for AWS Backup. Companies often use a customer managed KMS key per vault (Lesson 30) so access to backups can be controlled separately.

2Launch a server with data and a backup tag

Paste this whole block:

$ud = @'
#!/bin/bash
mkdir -p /opt/saat
printf "order 1001 paid 2499\norder 1002 paid 1850\n" > /opt/saat/orders.txt
sync
'@
[IO.File]::WriteAllText('C:\aws-lab\bk-userdata.sh', ($ud -replace "`r`n", "`n"))
$base = aws ssm get-parameter --name /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64 --query Parameter.Value --output text
$i = aws ec2 run-instances --image-id $base --instance-type t3.micro --subnet-id $v.PrivateA --security-group-ids $v.AppSg --iam-instance-profile Name=saat-ec2-ssm-profile --metadata-options HttpTokens=required --user-data file://bk-userdata.sh --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=bk01},{Key=Backup,Value=daily},{Key=course,Value=saatvedha-aws},{Key=lesson,Value=29}]' --query "Instances[0].InstanceId" --output text
do { Start-Sleep 20; $p = aws ssm describe-instance-information --filters "Key=InstanceIds,Values=$i" --query "InstanceInformationList[0].PingStatus" --output text } until ($p -eq 'Online')
aws ssm start-session --target $i --document-name AWS-StartInteractiveCommand --parameters command="cat /opt/saat/orders.txt"

You should see something like this (session lines left out):

order 1001 paid 2499
order 1002 paid 1850

3Create the plan and take a backup now

Paste this whole block (the backup usually takes 5 to 15 minutes):

@'
{
  "BackupPlanName": "saat-daily",
  "Rules": [
    {
      "RuleName": "daily-35d",
      "TargetBackupVaultName": "saat-vault",
      "ScheduleExpression": "cron(30 20 * * ? *)",
      "StartWindowMinutes": 60,
      "CompletionWindowMinutes": 180,
      "Lifecycle": { "DeleteAfterDays": 35 }
    }
  ]
}
'@ | Set-Content backup-plan.json
$plan = aws backup create-backup-plan --backup-plan file://backup-plan.json --backup-plan-tags course=saatvedha-aws --query BackupPlanId --output text
@'
{ "SelectionName": "tag-backup-daily", "IamRoleArn": "ROLE_ARN", "ListOfTags": [ { "ConditionType": "STRINGEQUALS", "ConditionKey": "Backup", "ConditionValue": "daily" } ] }
'@ -replace 'ROLE_ARN', $role | Set-Content backup-selection.json
$sel = aws backup create-backup-selection --backup-plan-id $plan --backup-selection file://backup-selection.json --query SelectionId --output text
Start-Sleep 15
$job = aws backup start-backup-job --backup-vault-name saat-vault --resource-arn "arn:aws:ec2:ap-south-1:$($acct):instance/$i" --iam-role-arn $role --lifecycle DeleteAfterDays=7 --query BackupJobId --output text
do { Start-Sleep 30; $st = aws backup describe-backup-job --backup-job-id $job --query State --output text; $st } until ($st -in 'COMPLETED', 'FAILED', 'ABORTED', 'EXPIRED')
aws backup describe-backup-job --backup-job-id $job --query "[State,PercentDone,BackupSizeInBytes]" --output text
$rp = aws backup describe-backup-job --backup-job-id $job --query RecoveryPointArn --output text

You should see something like this:

CREATED
RUNNING
RUNNING
COMPLETED
COMPLETED       100.0   8589934592

The plan will also back up bk01 every night because of its tag; the on-demand job just means you don’t have to wait until 2 a.m. The size is the full 8 GiB volume, though only changed blocks are stored after the first snapshot.

4Restore into another zone and check the data

Paste this whole block (the restore takes 5 to 10 minutes):

@'
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::ACCT:role/saat-ec2-ssm-role" } ] }
'@ -replace 'ACCT', $acct | Set-Content passrole.json
aws iam put-role-policy --role-name saat-backup-role --policy-name pass-instance-role --policy-document file://passrole.json
@{ InstanceType = 't3.micro'; SubnetId = $v.PrivateB; SecurityGroupIds = (ConvertTo-Json @($v.AppSg) -Compress); IamInstanceProfileName = 'saat-ec2-ssm-profile'; RequireIMDSv2 = 'true' } | ConvertTo-Json | Set-Content restore-meta.json
Start-Sleep 10
$rj = aws backup start-restore-job --recovery-point-arn $rp --iam-role-arn $role --metadata file://restore-meta.json --resource-type EC2 --query RestoreJobId --output text
do { Start-Sleep 30; $st = aws backup describe-restore-job --restore-job-id $rj --query Status --output text } until ($st -in 'COMPLETED', 'FAILED', 'ABORTED')
aws backup describe-restore-job --restore-job-id $rj --query "[Status,CreatedResourceArn]" --output text
$restored = (aws backup describe-restore-job --restore-job-id $rj --query CreatedResourceArn --output text) -split '/' | Select-Object -Last 1
do { Start-Sleep 20; $p = aws ssm describe-instance-information --filters "Key=InstanceIds,Values=$restored" --query "InstanceInformationList[0].PingStatus" --output text } until ($p -eq 'Online')
aws ssm start-session --target $restored --document-name AWS-StartInteractiveCommand --parameters command="cat /opt/saat/orders.txt"

You should see something like this:

COMPLETED       arn:aws:ec2:ap-south-1:111122223333:instance/i-0c9d8e7f6a5b40061
order 1001 paid 2499
order 1002 paid 1850

A new server, in ap-south-1b, with the same data, reachable through Session Manager because its instance role came back too. That is a tested backup. Write down how long the restore took; that number is your real recovery time, whatever the plan document says.

✅ Checkpoint: saat-daily selects servers tagged Backup=daily, an on-demand backup COMPLETED, and the restored server in ap-south-1b shows both order lines. Keep everything for the break lab.