Study guide

Technical reference and lesson notes

AWS Backup and Data Lifecycle Manager: Reliability and Business Continuity

Purpose of This Lesson

This lesson explains how AWS Backup provides centralized, policy-based protection across AWS and hybrid workloads, and how Amazon Data Lifecycle Manager (DLM) automates the lifecycle of Amazon EBS snapshots and EBS-backed AMIs. The main assessment skill is recognizing which service best fits a backup-management or EBS-lifecycle requirement.

Key Concepts

AWS Backup is a fully managed, centralized service for automating data protection.
AWS Backup supports multiple AWS services, including Amazon EC2, EBS, Amazon S3, Amazon FSx, Amazon EFS, Amazon RDS, DynamoDB, and Amazon DocumentDB.
AWS Backup can also protect hybrid workloads such as VMware workloads running in an on-premises data center, VMware Cloud, or AWS Outposts.
Backup behavior is policy-based: administrators define protection policies, and AWS Backup enforces them.
AWS Backup can be managed through the AWS Management Console, API, and AWS Command Line Interface (CLI).
AWS Backup data is encrypted with an AWS KMS key and provides protection that supports ransomware-resilience goals.
EBS snapshots are point-in-time backups of data stored on an EBS volume.
EBS snapshots are stored in Amazon S3 and are incremental when multiple snapshots are created.
Although snapshots are incremental, restoring an EBS volume requires only the most recent snapshot; AWS manages the underlying snapshot data dependencies.
An EBS snapshot can be used to create a volume in another Availability Zone, and it can also be used to create an AMI for launching EC2 instances.
Amazon Data Lifecycle Manager automates the creation, retention, and deletion of EBS snapshots and EBS-backed AMIs.

Centralized Backup and EBS Lifecycle Automation

AWS Backup

AWS Backup is the broader service when the requirement is centralized protection across several AWS resource types or hybrid environments. It provides policy-based data protection rather than requiring separate, service-specific backup processes for every workload.

Typical use cases include:

Applying consistent backup policies across databases, file systems, object storage, and compute-related storage.
Centralizing backup administration for multiple supported AWS services.
Protecting VMware workloads alongside AWS resources.
Enforcing retention requirements driven by auditors or compliance regimes.
Encrypting backups using an AWS KMS key.
Supporting disaster recovery designs that copy backups to isolated accounts.

EBS Snapshots

An EBS snapshot captures the state of data on an EBS volume at a point in time. Repeated snapshots are incremental, meaning later snapshots store only changed data relative to earlier snapshots. This reduces the amount of newly stored data compared with repeatedly creating complete independent copies.

Snapshots have several recovery and reuse options:

Restore an EBS volume from the latest snapshot.
Create the restored volume in another Availability Zone because the snapshot is stored in Amazon S3, a regional service.
Create an AMI from a snapshot and use that AMI to launch additional EC2 instances.

The incremental nature of snapshots does not change the operational restore choice: the latest snapshot is the required restore point, while AWS handles the underlying snapshot chain.

Amazon Data Lifecycle Manager

DLM is focused on automating EBS-related lifecycle operations. A DLM policy can standardize when EBS snapshots or EBS-backed AMIs are created, how long they are retained, and when outdated backups are deleted.

DLM supports reliability and operational goals by:

Enforcing a regular EBS backup schedule.
Creating standardized EBS-backed AMIs at regular intervals.
Retaining backups for audit or compliance needs.
Deleting outdated backups automatically to reduce storage costs.
Supporting disaster recovery policies that back up data to isolated accounts.

Exam- or Assessment-Relevant Takeaways

Choose AWS Backup when the scenario emphasizes centralized, policy-based protection across multiple AWS services or hybrid VMware workloads.
Choose DLM when the scenario specifically focuses on automating the lifecycle of EBS snapshots or EBS-backed AMIs.
An EBS snapshot is a point-in-time backup, not an independently running EC2 instance.
EBS snapshots are incremental, but the latest snapshot is sufficient as the restore selection.
A snapshot can support recovery in another Availability Zone because it is stored in Amazon S3, which is regional.
AWS Backup supports encryption using an AWS KMS key.
Retention and deletion are distinct lifecycle concerns: retention defines how long backups remain available, while deletion removes backups that are no longer needed.
Disaster recovery scenarios may require backup policies that copy data to isolated accounts rather than keeping all backup copies in the same account.

Tool / Feature Decision Guide

Requirement	Preferred service or feature	Reason
Centralize backup management for EC2, EFS, RDS, DynamoDB, S3, FSx, or other supported services	AWS Backup	It provides policy-based protection across multiple services.
Protect supported VMware workloads in hybrid environments	AWS Backup	It supports VMware workloads in on-premises data centers, VMware Cloud, and AWS Outposts.
Automatically create, retain, and delete EBS snapshots	DLM	DLM is designed for EBS snapshot lifecycle automation.
Produce refreshed, standardized EBS-backed AMIs on a schedule	DLM	DLM automates creation and retention of EBS-backed AMIs.
Recover EBS data in another Availability Zone	EBS snapshot restore	A snapshot can be used to create a volume in another Availability Zone.
Launch multiple EC2 instances from a captured EBS state	Create an AMI from the snapshot	The AMI can be used to launch additional EC2 instances.
Meet retention requirements while controlling backup storage growth	AWS Backup or DLM, based on resource scope	Use AWS Backup for broad centralized protection; use DLM for EBS-specific lifecycle policies.

Common Traps / Misconceptions

Treating AWS Backup and DLM as interchangeable: AWS Backup is a centralized, multi-service backup service; DLM is specifically focused on EBS snapshots and EBS-backed AMIs.
Assuming every snapshot is a full independent copy: EBS snapshots are incremental after the initial snapshot.
Assuming all earlier snapshots must be manually selected during restoration: The latest snapshot is sufficient for restoration because AWS manages the underlying incremental data.
Confusing a snapshot with an AMI: A snapshot backs up an EBS volume, while an AMI is used to launch EC2 instances and can be created from a snapshot.
Assuming a snapshot is tied to one Availability Zone: A snapshot can be used to create an EBS volume in another Availability Zone.
Ignoring deletion automation: Retention policies without timely deletion can leave outdated backups and increase storage costs.
Treating encryption as optional in the described AWS Backup workflow: The lesson identifies AWS Backup backups as encrypted with an AWS KMS key.
Keeping every disaster recovery copy in the same account: The lesson specifically identifies isolated-account backup policies as a disaster recovery option.

Real-World Engineer / Analyst Notes

Start with the resource scope when selecting a service. A requirement spanning databases, file systems, object storage, and hybrid VMware workloads points toward AWS Backup; an EBS-only requirement points toward DLM.
Separate three lifecycle decisions: backup frequency, retention duration, and deletion timing. A useful policy must address all three rather than merely creating backups.
Standardized EBS-backed AMIs can support repeatable instance-launch workflows, while snapshots are primarily volume-level recovery points.
Cross-Availability-Zone restoration is possible from a snapshot, but the target volume still needs to be created from that snapshot before it can be attached to an EC2 instance.
Isolated-account backup copies reduce dependence on the production account and are particularly relevant to disaster recovery and ransomware-resilience planning.
When reviewing an implementation, verify both the protection policy and its operational controls: encryption, retention, automated deletion, and the intended recovery location.

Quick Reference Summary

AWS Backup: Fully managed, centralized, policy-based backup for many AWS services and supported hybrid VMware workloads.
Management interfaces: Console, API, and AWS CLI.
Encryption: AWS Backup backups are encrypted with an AWS KMS key.
EBS snapshot: Point-in-time backup of an EBS volume, stored in Amazon S3.
Incremental behavior: Multiple snapshots store changed data incrementally; the latest snapshot is used for restoration.
Recovery flexibility: A snapshot can create a volume in another Availability Zone or be used to create an AMI.
DLM: Automates creation, retention, and deletion of EBS snapshots and EBS-backed AMIs.
Cost control: Automated deletion removes outdated backups.
Disaster recovery: Backup policies can place backups in isolated accounts.

Flashcards

Q: A company wants one policy-based backup service for RDS, EFS, DynamoDB, and VMware workloads. Which AWS service best fits the requirement, and why?

A: AWS Backup, because it centralizes policy-based protection across multiple AWS services and supported hybrid VMware workloads.

Q: When should DLM be selected instead of AWS Backup?

A: Select DLM when the requirement is specifically to automate the creation, retention, or deletion of EBS snapshots or EBS-backed AMIs.

Q: What does an EBS snapshot represent?

A: It is a point-in-time backup of the data on an EBS volume.

Q: What happens when multiple EBS snapshots are created for the same volume?

A: The snapshots are incremental, so later snapshots store changed data relative to earlier snapshots.

Q: During an EBS restore, why is the latest snapshot sufficient even though snapshots are incremental?

A: AWS manages the underlying incremental snapshot dependencies, so the latest snapshot provides the required restore point.

Q: An administrator needs to recover an EBS volume in a different Availability Zone. What should the administrator use?

A: Use the EBS snapshot to create a new volume in the target Availability Zone.

Q: What is the difference between restoring a volume from a snapshot and creating an AMI from a snapshot?

A: Restoring the snapshot creates an EBS volume for data recovery, while creating an AMI provides a reusable image for launching EC2 instances.

Q: Which AWS service is used to encrypt AWS Backup backups in the described workflow?

A: AWS Backup encrypts backups with an AWS KMS key.

Q: Why are retention and deletion both important in a backup policy?

A: Retention preserves backups for the required period, while automated deletion removes outdated backups and helps control storage costs.

Q: A compliance requirement mandates keeping EBS backups for a defined period and producing refreshed images regularly. Which DLM capabilities address these needs?

A: DLM can schedule regular EBS snapshot or EBS-backed AMI creation and enforce retention for the required period.

Q: What is the disaster recovery advantage of backing up to an isolated account?

A: It separates backup copies from the production account, supporting recovery if the primary account or its resources are compromised.

Q: Which management interfaces are available for AWS Backup?

A: AWS Backup can be managed through the AWS Management Console, API, and AWS CLI.

Practice Questions

Question 1

An organization needs centralized backup policies for Amazon RDS, Amazon EFS, Amazon S3, and on-premises VMware workloads. Which option best satisfies the requirement?

A. Amazon Data Lifecycle Manager

B. AWS Backup

C. An EBS snapshot policy only

D. An EBS-backed AMI schedule

Correct answer: B. AWS Backup

Explanation: The decisive clue is the broad multi-service and hybrid scope. AWS Backup provides centralized, policy-based protection for the listed AWS services and supported VMware workloads.

Question 2

An operations team wants to automatically create EBS snapshots every day, retain them for a defined period, and delete expired snapshots. Which service is the most direct fit?

A. AWS Backup

B. Amazon Data Lifecycle Manager

C. Amazon S3 lifecycle configuration only

D. Amazon RDS automated backups

Correct answer: B. Amazon Data Lifecycle Manager

Explanation: The requirement is specifically the automated creation, retention, and deletion lifecycle of EBS snapshots, which is DLM’s focus.

Question 3

An EBS volume in one Availability Zone must be recovered as a new volume in another Availability Zone. Which approach should the engineer use?

A. Attach the original volume directly to an instance in the other Availability Zone

B. Use the EBS snapshot to create a volume in the target Availability Zone

C. Convert the snapshot directly into an S3 bucket

D. Create an RDS read replica

Correct answer: B. Use the EBS snapshot to create a volume in the target Availability Zone

Explanation: EBS volumes are Availability Zone-specific, while the snapshot stored in Amazon S3 can be used to create a volume in another Availability Zone.

Question 4

A business wants regular, standardized images that can be used to launch additional EC2 instances and wants old images deleted automatically. Which solution best matches the requirement?

A. DLM managing EBS-backed AMIs

B. An isolated AWS Backup account with no lifecycle policy

C. An EFS mount target

D. A single manually created EBS snapshot

Correct answer: A. DLM managing EBS-backed AMIs

Explanation: DLM automates the creation and retention of EBS-backed AMIs, including the lifecycle management needed to remove outdated images.

Question 5

A company is designing ransomware-resilient backups and wants backup copies placed in isolated accounts while retaining policy-based centralized management. Which consideration from the lesson is most relevant?

A. Use only the newest EC2 instance without snapshots

B. Configure AWS Backup policies that back up data to isolated accounts

C. Store all backups in the same production account

D. Replace all snapshots with manually exported AMIs

Correct answer: B. Configure AWS Backup policies that back up data to isolated accounts

Explanation: The scenario combines centralized policy-based backup, ransomware protection, and account isolation—capabilities identified with AWS Backup in the lesson.

WordPress Metadata

Suggested Slug:
aws-backup-data-lifecycle-manager-soa-c03

Meta Description:
Study AWS Backup and Amazon Data Lifecycle Manager for centralized policy-based protection, EBS snapshot lifecycle automation, retention, encryption, and disaster recovery decisions.

Tags:
AWS Backup, Amazon Data Lifecycle Manager, AWS Certified CloudOps Engineer, SOA-C03, EBS snapshots, EBS-backed AMIs, KMS encryption, disaster recovery, backup retention, business continuity