AWS Backup Best Practices (2026 Update)

AWS Backup in 2026: The Controls That Actually Prevent Ransomware

ByPouya Nourizadeh

Ransomware has evolved faster than most cloud security programs. In 2025, multiple incidents demonstrated that paying a ransom no longer guarantees recovery; several organizations saw attackers return to delete snapshots and corrupt vaults. AWS responded by introducing stronger data-protection primitives, including direct backups to logically air-gapped vaults, enhanced Vault Lock controls, and AI-assisted configuration analysis.

This 2026 update outlines the most effective AWS Backup practices observed across enterprise environments, including real-world scenarios where configuration gaps led to compromise. The guidance focuses on practical, enforceable controls aligned with modern threat models.

Establish a Clear Backup Strategy

1.1 Inventory and Classify Critical Assets

Comprehensive inventory remains one of the most important foundations for reliable recovery.

Organizations should maintain a catalog of:

  • EC2, EBS, RDS, DynamoDB, S3, EFS,
  • Aurora (MySQL- and PostgreSQL-compatible editions)
  • Redshift Serverless workloads (noting limitations such as no point-in-time recovery for pause/resume clusters)
  • Containers: EKS cluster state and persistent volumes (supported since late 2025)
  • Hybrid workloads: VMware and SAP HANA via AWS Backup gateways/agents

Use a tiering approach:

  • Gold: strict RTO/RPO, continuous backups, cross-region copies
  • Silver: standard schedules and retention
  • Bronze: non-critical workloads with relaxed retention

This ensures backups map directly to business-impact needs.

1.2 Define RTO and RPO Requirements

Set clear, validated RTO/RPO targets.

  • Use continuous backups where supported for mission-critical workloads.
  • Validate schedules using AWS Backup scheduling previews.
  • For EKS workloads, remember that AWS Backup captures cluster state and persistent volumes; application-level orchestration still requires external tools such as Velero.

Implement Centralized and Secure Backup Controls

Modern ransomware increasingly targets backup infrastructure. Strong governance and immutability controls are essential.

2.1 Centralize Governance with Organizations

AWS distinguishes between:

  • Backup Plans → schedules, lifecycle rules, retention
  • Backup Policies → organization-wide enforcement through AWS Organizations

Key controls:

  • Vault Lock: Enforce WORM retention to prevent modification or deletion of protected recovery points.
  • Logically Air-Gapped Vaults: Provide isolation from compromised accounts for supported resource types.
    – Primary backup use requires onboarding to multi-party approval (MPA), introduced in 2025.
  • Cross-account governance and multi-party approval: Multi-party approval applies when vaults are shared through AWS RAM and IAM Identity Center.

These controls materially reduce the risk of backup tampering.

2.2 Apply Encryption and Least-Privilege Access

Recommended approach:

  • Encrypt all backups using customer-managed KMS keys.
  • Use AWS Backup Audit Manager to validate encryption, retention, and backup frequency compliance.
Role
Key Permissions
Purpose
Example Trust Notes
Backup Operator
Create/start backups
Daily operations
Trust policy must allow backup.amazonaws.com
Auditor
Read-only metadata/reports
Compliance
No restore privileges
Recovery Administrator

Restore access

Incident response
Use IAM Identity Center for approval workflows for air-gapped vaults
Key Permissions: Create/start backups
Purpose: Daily operations
Trust Notes: Trust policy must allow backup.amazonaws.com
Key Permissions: Read-only metadata / reports
Purpose: Compliance
Trust Notes: No restore privileges

Key Permissions: Restore access
Purpose: Incident response
Trust Notes: Use IAM Identity Center for approval workflows for air-gapped vaults

Cross-account restores and air-gapped vault access require explicit trust relationships and Identity Center delegation.

Optimize Backup Cost and Storage Posture

Cost waste frequently results from poor retention hygiene and underutilized lifecycle policies.

3.1 Use Lifecycle Policies for Tiering

Organizations should prioritize lifecycle automation over manual snapshot adjustments.

  • Configure transitions (e.g., to cold or archive) directly within Backup Plans.
  • Use Cost Explorer and Backup reports to identify large or idle backup sets.
  • Automated lifecycle rules prevent drift and maintain compliance.
3.2 Improve Recovery Readiness

Enhance resilience by:

  • Enabling cross-region backup copies for DR use cases.
  • Regularly reviewing retention policies to match business SLAs.
  • Using AWS Backup Audit Manager to detect configuration gaps (e.g., missing encryption).

Note: AWS does not offer a dedicated “Backup Evaluator”; configuration assessments depend on existing Audit Manager, Config, and internal governance tools.

Conclusion

AWS Backup provides a strong foundation for resilience, but success depends on adopting disciplined governance, lifecycle controls, and continuous validation.

Organizations can strengthen posture by:

  1. Completing a structured workload inventory.
  2. Enforcing organization-wide Backup Plans and Policies.
  3. Enabling Vault Lock and leveraging air-gapped vaults where supported (with MPA onboarding when required).
  4. Applying lifecycle tiering to control long-term storage costs.
  5. Running automated restore tests with custom validation workflows.

These measures ensure backups remain secure, compliant, and recoverable under modern threat conditions.

AWS Cost Disclaimer

AWS Backup vault types, lifecycle storage tiers, Audit Manager, and cross-region copies may incur additional charges. Organizations should review pricing for backup vaults, storage classes, and AWS Config (used by Audit Manager) when planning architectures and lifecycle policies.

Pouya Nourizadeh - Cloudformix Author
Pouya Nourizadeh
About Author

Pouya Nourizadeh is the founder of Cloudformix, with extensive experience optimizing enterprise cloud environments across AWS, Azure, and Google Cloud. For years, he has addressed real-world challenges in cloud cost management, performance, and architecture, offering practical insights for engineering teams navigating modern cloud complexities.

Similar Posts