Data loss, whether due to accidental deletion, cyberattacks, or system failures, can be catastrophic for any organization.

Imagine waking up one day and realizing that your backups have mysteriously vanished. 😱 Maybe someone accidentally deleted them (oops), or worse, a cyberattack wiped them out. Not cool, right?

Enter the AWS Central Backup Account – the superhero 🦸‍♂️ of backups! With this setup, all backups from your AWS Organization are automatically copied to a dedicated AWS account, ensuring an extra layer of protection. No more heart attacks over lost data! 💾✨

🔑 Why You Need This in Your Life

✔️ 🚀 Ultimate Backup Resilience – Even if a backup is deleted in a member account, a copy is safe in the Central Backup Account. Crisis averted!
✔️ 🧐 Compliance Made Easy – Need to meet regulations like GDPR or DORA? Centralized backups make audits a breeze!
✔️ 📝 Automate Everything – AWS Backup Plans take care of everything, so you can relax while your backups work for you.
✔️ 🔒 Backup Security – Protect your backups with Customer Managed KMS Keys and Backup Vault policy!
✔️ 📢 Automated Alerts & Monitoring – Get instant notifications if something goes wrong, so you can fix it before your boss finds out! 😅

🤔 The Problem This Solves

🚨 Backups can be lost! Accidental deletions, cyberattacks, or Murphy’s Law can strike at any time. With this setup, you always have a spare copy.
🚨 Manually copying backups is painful! We automate everything so you never have to worry about forgetting to copy your backups.
🚨 Visibility on backup failures is crucial! AWS EventBridge + Lambda + SNS work together to notify you immediately when something goes wrong.
🚨 AWS Managed Keys don’t work for cross-account backups! (at least now where I wrote this blog in February 2025) That’s why we use Customer Managed KMS Keys to securely share encrypted backups across accounts.

🔍 Centralized Backup Solution Architecture

The diagram illustrates a multi-account AWS backup strategy, ensuring backups are automatically copied from application accounts to a dedicated central backup account for enhanced security and disaster recovery.

🛠 Components in the Architecture

🚀 Application Account (Source Account)

• Hosts e.g: Amazon RDS and Amazon EBS volumes that need to be backed up.
• Uses AWS Managed Keys or Customer Managed Keys (KMS) to encrypt the snapshots of these resources.
• Implements an AWS Backup Plan to schedule automatic snapshots.

🚀 Backup Vaults

• Temporary Backup Vault: Stores the initial backup before copying it to the Primary Backup Vault.
• Primary Backup Vault: Stores the final backup within the application account, encrypted with a Customer Managed Key (CMK) to enable cross-account copy operations.

🚀 AWS Backup Copy Jobs

• Copy Job 1: Copies the backup from the Temporary Backup Vault to the Primary Backup Vault in the same AWS account.
• Copy Job 2 (Cross-account copy job) triggered from Lambda: Copies the backup from the Primary Backup Vault to the Central Backup Account.

🚀 AWS Lambda & Amazon EventBridge

• EventBridge triggers Lambda functions after each copy job is complete.

• Initiating the cross-account copy job once the backup reaches the Primary Backup Vault.

• Lambda delete backups from the Temporary Backup Vault after the cross-account copy is successfully complete.

• Sending notifications to alert admins of backup failures.

🚀 Parameter Store

Stores backup tag settings used by Lambda functions.

🚀 Central Backup Account

A dedicated AWS account used for long-term storage of backups.
Contains a Backup Vault, where cross-account copies from the application accounts are stored.
Uses a Customer Managed Key (CMK) to encrypt the backups securely.

📝 Prerequisites

✅ An AWS Organization with multiple accounts.
✅ Enable cross-account monitoring in AWS Backup from management account. The steps are described here.
✅ A dedicated AWS Backup Account for centralized backup that already have delegated permission for backup. You can find how to setup here.
✅ Ensure and enable the supported resources for cross-account backup. Check here

🚀 Step-by-Step Deployment

🤖 Deployment in central backup account

Step 1: Create a backup vault in Central Backup Account to store backup copy of member account
📍 Go to AWS Backup → Create a Backup Vault for member account to store the copy of the backup.
📍 Update the Backup Vault Policy → Allow the role in the member account to sent the copy into the backup vault.

📍 Create backup policy that will be implemented across the AWS Organization → The example can be found here.

👨🏼‍🏫 Deployment in member account

Step 1: Set Up a Customer Managed KMS Key 🔑
📍 Go to AWS KMS → Create a Customer Managed Key (CMK).
📍 Update the Key Policy to allow access from the Central Backup Account. → Please refer to this link

Step 2: Configure AWS Backup in Each Member Account 🏗️
📍 Create a Temporary Backup Vault and Primary Backup Vault.
📍 Set up an AWS Backup Plan Rule to back up tagged resources into the Temporary Backup Vault.
📍 Configure the Backup Plan Rule to copy backups to the Primary Backup Vault.

Step 3: Deploy a Lambda Function and EventBridge to Handle Backup Copy Jobs 🤖
📍 Create an EventBridge Rule for successful copy job from Temporary Vault to Primary Vault.
📍 Create an AWS Lambda function triggered by EventBridge. → The function run a copy job from Primary Backup Vault to Central Backup Vault in central backup Account.
📍 If the event is a successful copy from Temporary to Primary Vault, Lambda copies it to the Central Backup Account.

Step 4: Set Up EventBridge to Watch for Backup Jobs Failures 👀
📍 Create an EventBridge Rule for failed backup, copy, or restore jobs (so you know when something’s broken).
📍 Create an SNS Topic and subscribe your email (or Slack, or any your preference endpoint that supported in SNS)
📍 Add SNS as Eventbridge Target to sent the notification.
📍 Get real-time alerts before disaster strikes!

🎯 Conclusion – Your Backups Just Got Smarter!

By implementing this Centralized AWS Backup Solution, you’ve just leveled up your cloud game. No more “oops, my backup is gone” moments, no more compliance headaches, and no more manual backup drudgery.

🚀 Automation? Check.
🔒 Security? Check.
📢 Notifications? Check.

So what are you waiting for? Get started today! 🎉 Your future self will thank you!

‼️ Things to consider

🔔 The time where AWS Backup runs the backup job. In AWS Backup, RDS backups aren't allowed within an hour before the RDS maintenance window or the RDS automated backup window. Therefore, be sure that your backup plans for RDS databases are scheduled more than an hour apart from the RDS maintenance window and the RDS automated backup window.