3.1.3.5. Implementing Cross-Region Backup & Recovery (AWS Backup, S3, Systems Manager)

3.1.3.5. Implementing Cross-Region Backup & Recovery (AWS Backup, S3, RDS)

Cross-region backup ensures that a regional disaster doesn't destroy both your data and your backups. AWS Backup provides centralized management; individual services offer native replication.

AWS Backup cross-region copy:

• Automatically copies backups to a vault in another region
• Supports: EBS, RDS, Aurora, DynamoDB, EFS, FSx, Storage Gateway
• Encryption: Backups are re-encrypted with a KMS key in the destination region

Service-native cross-region patterns:

Implementing S3 CRR:

{
  "Rules": [{
    "Status": "Enabled",
    "Destination": {
      "Bucket": "arn:aws:s3:::dr-backup-bucket-us-west-2",
      "StorageClass": "STANDARD_IA",
      "EncryptionConfiguration": {
        "ReplicaKmsKeyID": "arn:aws:kms:us-west-2:123456789012:key/dr-key-id"
      }
    },
    "Filter": {"Prefix": ""}
  }]
}

Backup lifecycle management: Use S3 lifecycle policies and AWS Backup retention rules to manage backup costs — transition older backups to Glacier Deep Archive, delete backups older than the retention period.

Exam Trap: AWS Backup uses a KMS key in the destination region to encrypt cross-region copies. If you don't specify a key, the default aws/backup key is used — which can't be shared cross-account. For cross-account DR (backups in a security account), you must use a customer-managed KMS key and grant the backup account access via key policy.