Study guide

Technical reference and lesson notes

Using Amazon Data Lifecycle Manager (DLM) for Automated EBS Snapshots

Purpose of This Lesson

This lesson demonstrates how to use Amazon Data Lifecycle Manager (DLM) to automate the creation and expiration of Amazon EBS snapshots. The workflow uses an EC2 resource tag to identify which resources should receive snapshot protection, then applies a schedule and retention rule through an EBS snapshot lifecycle policy.

The lab uses an Amazon Linux 2023 EC2 instance, but the important concepts are the tagging strategy, policy targeting, IAM permissions, scheduling, retention, and cleanup.

Key Concepts

Data Lifecycle Manager (DLM): An AWS service for automating lifecycle operations on supported resources, including EBS snapshots.
EBS snapshot policy: The DLM policy type used in this lab to create and retain EBS snapshots automatically.
Resource tags: DLM uses tags to determine which volumes or instances are targeted by a policy.
Target type: An EBS snapshot policy can target resources by volume or by instance.
Schedule: The policy determines how frequently snapshots are created, such as every 12 hours or every 24 hours.
Retention: Snapshots can be retained by count or by age. The lab uses an age-based rule of seven days.
IAM role: DLM needs permissions to perform lifecycle operations. The console can create and use a default role with permissions such as creating and deleting snapshots.
Policy state: The policy must be enabled for scheduled actions to run.

Configuring an EBS Snapshot Lifecycle Policy

1. Launch or identify an EC2 instance

For the lab, launch an EC2 instance using an Amazon Linux 2023 AMI and a T2 micro instance type. A key pair is not required for the demonstrated workflow, and an existing security group can be selected instead of creating a new one.

The instance is used to provide an EBS-backed resource that DLM can identify through tags.

2. Apply the identifying tag

On the EC2 instance, add the following tag:

Key	Value
`Back up`	`yes`

The tag key and value are the selection criteria for the DLM policy. The policy will not target the instance unless its tags match the configured criteria.

3. Create the DLM policy

In Data Lifecycle Manager, create a custom policy with these settings:

Choose EBS snapshot policy as the policy type.
Select Instance as the resource target. Volume targeting is also available, but the lab targets the instance.
Configure the resource tag filter to match Back up=yes.
Leave the IAM role set to the default role so AWS can create the role for the policy.
Keep the policy enabled.
Configure the snapshot schedule.
Configure the retention rule.
Review and create the policy.

4. Configure scheduling and retention

The schedule can be configured at a frequency such as every 12 hours or every 24 hours. In the lab, the schedule is changed to daily, or every 24 hours, beginning at the selected time of 09:00 UTC.

The retention rule is configured by age: snapshots are retained until they are seven days old and then deleted automatically. This prevents the snapshot collection from growing indefinitely under normal policy operation.

5. Verify and clean up

Snapshots will appear in the EBS snapshots view only after the policy reaches its scheduled execution time. With a daily schedule, the lab may require waiting until the following day before a snapshot is visible.

After completing the lab, remove the resources to avoid unnecessary costs and ongoing activity:

Delete the DLM lifecycle policy.
Delete snapshots created by the policy.
Terminate the EC2 instance.

Exam- or Assessment-Relevant Takeaways

When a scenario requires scheduled EBS snapshot creation and automatic expiration, recognize Amazon Data Lifecycle Manager as the relevant service.
DLM resource selection depends on tags. A policy configured for Back up=yes will target matching resources, not every EC2 instance automatically.
Carefully distinguish targeting instances from targeting volumes when configuring an EBS snapshot policy.
Retention can be based on snapshot count or snapshot age. An age-based rule such as seven days deletes snapshots after they reach that age.
Snapshot creation is not necessarily immediate. The configured schedule and start time determine when the first snapshot appears.
The DLM policy requires an IAM role with permissions for lifecycle actions, including creating and deleting snapshots. The console can create the default role.
An enabled policy is required for scheduled lifecycle operations to occur.
In a lab or temporary environment, cleanup must include the policy, snapshots, and EC2 instance.

Tool / Feature Decision Guide

Requirement or situation	Appropriate choice	Reason
Automate periodic EBS snapshot creation and expiration	DLM EBS snapshot policy	It automates both scheduled snapshots and lifecycle retention.
Apply a policy to all matching EC2 instances	Target by instance and use resource tags	The policy selects instances whose tags match the configured key and value.
Apply a policy to specific EBS volumes	Target by volume and use resource tags	Volume targeting provides a different resource-selection scope.
Keep snapshots for a defined time period	Age-based retention	Snapshots expire after the configured age, such as seven days.
Keep only a defined number of snapshots	Count-based retention	The lifecycle is controlled by the number of retained snapshots rather than their age.
Avoid manually creating the required DLM service role	Use the default IAM role option	AWS creates the role with the permissions needed by the policy.
Check for the first snapshot immediately after creation	Do not assume it exists yet	The policy waits for its configured schedule and start time.

Common Traps / Misconceptions

Assuming DLM snapshots are created immediately: A newly created policy follows its schedule. A daily policy may not produce a visible snapshot until the next scheduled run.
Forgetting the tag match: The policy depends on the exact configured resource tag key and value. A missing or mismatched tag prevents the resource from being selected.
Confusing instance and volume targeting: Both are available, but they represent different targeting choices. Confirm which resource type the scenario requires.
Treating retention as permanent backup: A seven-day age rule intentionally deletes older snapshots. Retention settings must match the recovery requirement.
Leaving the policy enabled after a lab: An enabled policy can continue creating snapshots. Delete the policy and its snapshots when the environment is no longer needed.
Ignoring IAM permissions: DLM requires permissions for operations such as creating and deleting snapshots. The default role is convenient, but the role is still an essential part of the design.

Real-World Engineer / Analyst Notes

Use a consistent tagging convention for backup selection. A clear key such as Back up with a controlled value such as yes makes policy scope easier to audit.
Treat the tag filter as part of the backup design, not as optional metadata. A policy is only effective for resources it actually matches.
Validate the first scheduled execution before assuming the configuration works. Check the policy state, schedule, target tags, and EBS snapshots view.
Choose retention deliberately. Short retention limits storage growth but may not provide enough historical recovery points.
When testing DLM, account for the time-based nature of the schedule and for the cost of keeping an instance, policy, and snapshots running.
Cleanup is part of operational correctness. Temporary resources should be removed after verification, especially when the policy remains enabled.

Quick Reference Summary

Service: Amazon Data Lifecycle Manager (DLM)
Policy type: EBS snapshot policy
Selection mechanism: Resource tags
Lab tag: Back up=yes
Target options: Instance or volume
Example schedule: Every 24 hours at 09:00 UTC
Example retention: Delete snapshots after seven days
IAM: Use the default role or a role with required snapshot lifecycle permissions
Policy state: Enabled
Verification: Check the EBS snapshots view after the scheduled run
Lab cleanup: Delete the DLM policy, delete created snapshots, and terminate the EC2 instance

Flashcards

Q: An operations team wants scheduled EBS snapshots that expire automatically after a defined period. Which AWS feature should they evaluate first?

A: Amazon Data Lifecycle Manager with an EBS snapshot policy. DLM automates scheduled snapshot creation and retention-based deletion.

Q: How does the DLM policy in this lab identify the EC2 resource to protect?

A: It matches the resource tag Back up=yes. Only resources matching the configured tag criteria are targeted.

Q: When would you target resources by volume instead of by instance in an EBS snapshot policy?

A: Use volume targeting when the lifecycle policy should select EBS volumes directly rather than selecting instances as the target resource type.

Q: What is the difference between count-based and age-based snapshot retention?

A: Count-based retention keeps a specified number of snapshots, while age-based retention deletes snapshots after they reach a specified age, such as seven days.

Q: A daily DLM policy was created, but no snapshot is visible immediately. What is the most likely explanation?

A: The policy has not reached its scheduled execution time yet. Snapshot creation follows the configured frequency and start time rather than occurring immediately at policy creation.

Q: What schedule is used in the demonstrated configuration after changing the default frequency?

A: The policy is configured to create a snapshot every 24 hours, starting at 09:00 UTC.

Q: What role does the IAM role play in an EBS snapshot lifecycle policy?

A: It grants DLM permissions needed for lifecycle actions, including creating and deleting snapshots. The console can create the default role.

Q: Why must the DLM policy remain enabled for the schedule to operate?

A: An enabled policy is required for DLM to perform its configured scheduled lifecycle actions.

Q: A policy targets instances with Back up=yes, but a tagged resource is not protected. What should be checked first?

A: Verify the exact tag key and value, confirm the resource target type is correct, and ensure the policy is enabled.

Q: What is the operational risk of using a seven-day age-based retention rule without reviewing requirements?

A: Snapshots older than seven days will be deleted automatically, so recovery points beyond that period will not be available from this policy.

Q: Which resources should be removed after completing the demonstrated lab?

A: Delete the DLM policy, delete snapshots created by it, and terminate the EC2 instance.

Q: Why is tagging a central part of this DLM workflow rather than merely descriptive metadata?

A: DLM uses tags as selection criteria. The tag determines which resources the snapshot policy operates on.

Practice Questions

Question 1

An administrator creates an EBS snapshot policy that targets instances tagged Back up=yes. A running instance has the tag Back up=Yes with a capital Y, and no snapshots are created. What is the most likely cause?

A. DLM can only target stopped instances
B. The tag value does not exactly match the policy filter
C. EBS snapshots cannot be created from Amazon Linux 2023
D. The policy must target volumes instead of instances

Correct answer: B. The policy depends on the configured tag key and value. A value that does not match the policy filter can prevent the instance from being selected.

Question 2

A team wants snapshots created every 24 hours and automatically deleted when they are seven days old. Which configuration best matches the requirement?

A. Daily schedule with age-based retention of seven days
B. Twelve-hour schedule with count-based retention of seven snapshots
C. Daily schedule with no retention rule
D. One-time snapshot with count-based retention of seven days

Correct answer: A. The requirement specifies a daily schedule and a time-based expiration period, so the policy should use a 24-hour frequency and seven-day age retention.

Question 3

A DLM policy is configured correctly, but an engineer checks the EBS snapshots pane immediately after creating a daily policy and sees nothing. What should the engineer do first?

A. Terminate the instance and recreate the policy
B. Change the target from instance to volume without checking anything else
C. Verify the schedule and wait for the next scheduled execution
D. Add a key pair to the EC2 instance

Correct answer: C. DLM runs according to the configured schedule and start time. A daily policy may require waiting until the next scheduled run.

Question 4

A temporary lab has created a DLM policy, several snapshots, and an EC2 instance. The policy is still enabled. What is the safest cleanup sequence from the demonstrated workflow?

A. Delete only the EC2 instance
B. Disable the security group and leave the policy running
C. Delete the lifecycle policy, delete its snapshots, and terminate the instance
D. Delete the IAM role only

Correct answer: C. The policy can continue managing snapshots while enabled, and the snapshots and instance can also incur ongoing resource costs. All three resource categories should be cleaned up.

Question 5

A company wants its DLM policy to operate on EBS volumes rather than treating EC2 instances as the selected resources. Which policy choice is decisive?

A. Select volume as the resource target
B. Use an age-based retention rule
C. Set the policy start time to 09:00 UTC
D. Leave the policy disabled

Correct answer: A. DLM provides instance and volume targeting. Selecting volume determines that the policy evaluates volumes as the target resource type.

WordPress Metadata

Suggested Slug:
aws-data-lifecycle-manager-ebs-snapshot-policy

Meta Description:
Learn how to configure an AWS Data Lifecycle Manager EBS snapshot policy using EC2 tags, schedules, retention rules, and operational cleanup steps.

Tags:
AWS, Data Lifecycle Manager, DLM, EBS snapshots, EC2, backup automation, Amazon Linux 2023, IAM roles, AWS CloudOps, business continuity