Amazon EBS Snapshots and Data Lifecycle Manager (DLM) – SAP-C02 Study Guide

Purpose of This Lesson

Amazon Data Lifecycle Manager (DLM) automates the creation, retention, and deletion of Amazon EBS snapshots and EBS-backed Amazon Machine Images (AMIs). It is useful when an organization needs consistent backup schedules, standardized AMIs, compliance-oriented retention, or automated cleanup of obsolete recovery points.

This lesson focuses on how EBS snapshots work and where DLM fits into an AWS backup strategy.

Key Concepts

Amazon EBS snapshots

An EBS snapshot is a point-in-time backup of an EBS volume. Snapshots are stored and managed by AWS using Amazon S3 infrastructure, but they are not exposed as ordinary objects in a customer-owned S3 bucket.

Important characteristics include:

• Snapshots are incremental after the initial snapshot. Each subsequent snapshot stores blocks that changed since the previous relevant snapshot.
• A snapshot is independent of the Availability Zone in which the source volume was created.
• A new EBS volume can be restored from a snapshot in an Availability Zone selected by the user.
• A snapshot can be used as part of an AMI definition.
• Restoring a volume from a snapshot may require initialization of data blocks before the volume reaches its expected performance. Fast Snapshot Restore can reduce this delay when its additional cost and regional/AZ configuration are justified.

Snapshots provide volume-level protection. They do not automatically represent a complete application-consistent backup of every component in a multi-tier workload.

EBS-backed AMIs

An EBS-backed AMI contains image metadata and references to one or more EBS snapshots. Launching an EC2 instance from the AMI creates EBS volumes based on those mappings.

DLM can automate the creation and expiration of EBS-backed AMIs. This is useful for maintaining a rolling set of approved machine images, such as a current image plus several previous versions for rollback.

What Data Lifecycle Manager automates

DLM uses lifecycle policies to define how selected resources are protected. Depending on the policy type and configuration, a policy can automate:

• Snapshot or AMI creation on a schedule
• Retention based on count or age
• Deletion of expired snapshots or AMIs
• Creation and cleanup of standardized EBS-backed AMIs
• Cross-account or disaster-recovery workflows where the applicable DLM capabilities and permissions are configured

Resources are commonly selected using tags. This allows different backup schedules to be applied to different classes of EBS volumes or instances, such as production, development, or regulated workloads.

Retention and cost control

Retention policies are both a recovery and governance decision. Keeping more recovery points improves rollback flexibility but increases snapshot storage consumption. DLM can delete older recovery points automatically, reducing the risk of indefinite backup accumulation.

Retention should account for:

• Recovery point objectives and recovery time objectives
• Compliance and audit requirements
• Application release and rollback patterns
• Snapshot dependencies and deletion behavior
• Cross-account or cross-Region disaster recovery requirements
• The cost of retained snapshot data and any accelerated restore features

DLM is not a complete backup platform for every AWS resource

DLM is specialized for EBS snapshots and EBS-backed AMI lifecycle management. It should not be selected as a universal backup service for databases, DynamoDB tables, EFS file systems, or all AWS resource types. AWS Backup is generally the service to evaluate when centralized, policy-based protection across multiple supported AWS services is required.

Exam-Relevant Takeaways

• DLM automates EBS snapshot and EBS-backed AMI lifecycles. It handles scheduling, retention, and deletion.
• EBS snapshots are incremental. Later snapshots generally store changed blocks rather than copying the entire volume each time.
• A snapshot can restore a volume in another Availability Zone. The restored volume is created in the AZ selected during restoration.
• An EBS-backed AMI is built from EBS snapshots plus image metadata. DLM can maintain a rolling collection of these AMIs.
• Tag-based selection is central to lifecycle policies. Correct tagging is necessary for predictable policy scope.
• DLM reduces operational effort and storage waste, but it does not replace application-aware backup design. Database consistency, cross-account recovery, and restore testing still require deliberate architecture.
• Distinguish DLM from AWS Backup. DLM is focused on EBS and EBS-backed AMIs; AWS Backup provides broader centralized backup management for supported services.
• Snapshot restoration and snapshot creation are different concerns. A snapshot may exist successfully while a restored volume still requires initialization for full performance.

Architecture Decision Guide

Requirement	Appropriate approach	Important considerations
Scheduled backups of EC2 EBS volumes	DLM EBS snapshot lifecycle policy	Use tags, define a schedule, and set retention rules
A rolling set of standardized EC2 images	DLM EBS-backed AMI lifecycle policy	Include AMI retention and cleanup; validate image contents and launch permissions
Backup policies across many AWS services	Evaluate AWS Backup	Confirm that each required resource type and feature is supported
Restore a volume in another AZ in the same Region	Create an EBS volume from the snapshot in the target AZ	The snapshot is Region-scoped; the restored volume is AZ-specific
Recover after an account-level failure or security incident	Use a separate-account backup/copy design, potentially with DLM capabilities	Configure IAM, encryption keys, access controls, and restore procedures
Minimize storage from obsolete recovery points	DLM retention and deletion policies	Balance cost savings against compliance and rollback requirements
Rapid performance after restoring a critical volume	Consider Fast Snapshot Restore	It has additional cost and must be enabled for the relevant snapshot and AZs

Common Exam Traps

• Assuming every EBS snapshot is a complete independent full copy. The snapshot model is incremental, even though AWS manages the dependency details for restores and deletion.
• Assuming snapshots are tied to an Availability Zone. EBS volumes are AZ-specific, but snapshots can be used to create volumes in another AZ within the Region.
• Confusing DLM with AWS Backup. DLM is not the general-purpose answer for protecting every AWS service.
• Treating an AMI as a single flat disk image. An EBS-backed AMI includes metadata and one or more EBS snapshot-backed volume mappings.
• Ignoring tags when evaluating a DLM policy. A policy can unintentionally omit resources or protect the wrong resources if tags are inconsistent.
• Assuming a successful snapshot means an application-consistent backup. Filesystem and database consistency may require quiescing I/O, coordinating with the application, or using application-aware backup mechanisms.
• Expecting immediate peak performance after a restore. Volume initialization can affect performance until blocks are prepared or read; evaluate Fast Snapshot Restore for latency-sensitive workloads.
• Forgetting encryption permissions in cross-account designs. Encrypted snapshot sharing or copying requires suitable KMS key policies and permissions; AWS-managed default keys have restrictions compared with customer managed keys.

Real-World Engineer Notes

• Define backup classes through tags such as BackupPolicy=ProductionDaily rather than applying one schedule to every volume.
• Keep backup policy tags under change control. A tag modification can change which lifecycle policy manages a resource.
• Protect the DLM service role and policy permissions. A lifecycle policy that cannot describe, create, tag, or delete the intended resources will not meet the recovery design.
• Test restores regularly. A backup that has never been restored is an assumption, not a verified recovery capability.
• For multi-volume applications, coordinate snapshots across volumes when write ordering matters. Independent volume snapshots may not provide a crash-consistent view across the complete application.
• Use a separate AWS account for recovery copies when protection from accidental deletion or account compromise is important. Restrict delete permissions in the recovery account.
• Treat AMIs as release artifacts. Validate installed agents, patches, network configuration, secrets handling, IAM instance profiles, and boot behavior before making an AMI the basis for automated deployment.
• Choose retention based on business recovery needs rather than simply maximizing the number of snapshots. More recovery points increase cost and operational complexity.

Quick Reference Summary

• EBS snapshot: Point-in-time backup of an EBS volume.
• Storage model: AWS-managed snapshot storage using incremental data transfer after the initial snapshot.
• Restore scope: A snapshot can create an EBS volume in a selected AZ in the same Region.
• EBS-backed AMI: AMI metadata plus EBS snapshot-backed volume mappings.
• DLM purpose: Automate creation, retention, and deletion of EBS snapshots and EBS-backed AMIs.
• Resource selection: Commonly based on tags.
• Primary benefits: Consistent schedules, standardized images, compliance retention, and automated cost control.
• Key limitation: DLM is not a universal, application-aware backup service.
• Broader alternative: Evaluate AWS Backup for centralized protection across supported AWS services.
• Operational requirement: Test restores and verify encryption, IAM, tagging, and cross-account recovery behavior.

Flashcards

1. Q: What does Amazon Data Lifecycle Manager automate?

A: The scheduled creation, retention, and deletion of EBS snapshots and EBS-backed AMIs.

1. Q: Are EBS snapshots full copies every time?

A: No. After the initial snapshot, subsequent snapshots are incremental and capture changed blocks.

1. Q: Can a snapshot created from a volume in one AZ create a volume in another AZ?

A: Yes. The new volume is created in the target AZ selected during restoration.

1. Q: What two main components make up an EBS-backed AMI?

A: AMI metadata and one or more EBS snapshot-backed volume mappings.

1. Q: How does DLM usually determine which resources a policy manages?

A: Through resource tags specified in the lifecycle policy.

1. Q: Why use DLM retention rules?

A: To retain the required recovery points while automatically deleting older backups and controlling storage costs.

1. Q: Is DLM a universal backup service for all AWS resources?

A: No. DLM focuses on EBS snapshots and EBS-backed AMIs.

1. Q: Which AWS service should be evaluated for centralized backup across multiple supported services?

A: AWS Backup.

1. Q: Does an EBS snapshot automatically guarantee application consistency?

A: No. Application and filesystem consistency may require workload-specific coordination.

1. Q: What can affect performance immediately after restoring a volume from a snapshot?

A: Volume initialization can cause latency or reduced performance until blocks are initialized; Fast Snapshot Restore may help.

1. Q: Why are customer managed KMS keys important in some cross-account encrypted snapshot designs?

A: Cross-account access and copying require appropriate key policies and permissions, which are not available in the same way with AWS-managed default keys.

1. Q: What should be validated before using a DLM-created AMI in production deployment?

A: Boot behavior, patches, agents, networking, IAM configuration, secrets handling, and application readiness.

Practice Questions

Question 1

A company runs EC2 instances with EBS volumes in several Availability Zones. It must create daily snapshots, retain 14 recovery points, and automatically remove older snapshots. The operations team wants to manage the policy using resource tags. Which solution best meets the requirement with the least operational effort?

• A. Create an S3 lifecycle rule for an S3 bucket containing exported EBS snapshots
• B. Create an EBS snapshot lifecycle policy in Amazon Data Lifecycle Manager
• C. Create an AWS CloudFormation schedule that invokes an EC2 user-data script
• D. Create an AMI manually every day and delete old AMIs by hand

Correct answer: B

Explanation: DLM is designed to schedule EBS snapshots, apply retention rules, and delete expired snapshots. It can target resources based on tags.

Question 2

A restored EBS volume must be created in a different Availability Zone from the source volume. Which statement is correct?

• A. This is impossible because EBS snapshots are AZ-specific
• B. The snapshot must first be converted into an AMI
• C. The snapshot can be used to create a new volume in the target Availability Zone
• D. The original EBS volume automatically moves to the target Availability Zone

Correct answer: C

Explanation: EBS volumes are tied to an AZ, but snapshots can be used to create new volumes in another AZ within the same Region.

Question 3

An organization needs a centralized backup policy for EBS, Amazon EFS, Amazon RDS, and DynamoDB resources. Which service should architects evaluate first?

• A. Data Lifecycle Manager only
• B. Amazon Inspector
• C. AWS Backup
• D. Amazon S3 Transfer Family

Correct answer: C

Explanation: DLM specializes in EBS snapshots and EBS-backed AMIs. AWS Backup is intended for centralized backup management across multiple supported AWS services.

Question 4

A company uses DLM to create snapshots of a database volume every hour. During a restore test, the database contains a transaction state that is not consistent with a second volume used by the same application. What is the best conclusion?

• A. Incremental snapshots cannot be used for databases
• B. DLM automatically coordinates writes across all application volumes
• C. The design needs application-aware coordination or a consistent multi-volume backup approach
• D. The snapshots are invalid because they are stored using Amazon S3

Correct answer: C

Explanation: DLM can automate snapshot scheduling, but independent volume snapshots do not automatically guarantee application-consistent or cross-volume write ordering. Database and multi-volume workloads may require coordinated quiescing or an application-aware backup design.

Question 5

A security team wants encrypted EBS snapshots copied to a separate AWS account for disaster recovery. Which consideration is essential?

• A. Encrypted snapshots can always be shared without KMS permissions
• B. The receiving account must receive the source account’s AWS root credentials
• C. KMS key policies and cross-account IAM permissions must allow the required snapshot copy or access operations
• D. EBS snapshots cannot be used for cross-account recovery

Correct answer: C

Explanation: Cross-account encrypted snapshot workflows require correctly configured IAM permissions and KMS key policies. Customer managed KMS keys are commonly used when explicit cross-account key access is needed; AWS-managed default keys have additional sharing restrictions.