What is EBS and why having Backups for it is a Must-Have in AWS
Amazon Elastic Block Store (EBS) volumes are a type of block storage service provided by Amazon Web Services (AWS). EBS volumes are used to store data for Amazon Elastic Compute Cloud (EC2) instances and other AWS resources. They function like virtual hard drives and are designed to be highly available, durable, and scalable.
In the realm of Amazon Web Services (AWS), data is the cornerstone of your applications and workloads. Whether you’re running a website, managing databases, or hosting applications in the cloud, safeguarding your data must be one of your top priorities. That’s where EBS backups come into play, and they’re a crucial element of your AWS strategy for several compelling reasons:
- Data Protection: Safeguarding data from accidents and hardware failures.
- Disaster Recovery: Ensuring rapid recovery in emergencies.
- Compliance: Meeting data retention and regulatory requirements.
- Rollback and Testing: Testing changes and restoring to a known state.
- Data Migration: Simplifying data transfer between regions or accounts.
- Cost Savings: Economically securing data compared to maintaining large volumes.
- Data Integrity: Ensuring data consistency in snapshots.
- Granular Recovery: Restoring data at specific points in time.
- Easy Scalability: Adapting to changing storage needs with automation.
Getting started
In this tutorial we will explain how to create an EBS backup solution targeting an EC2 volume which will have a specific tag value. We will add a time window for creation of the backup and a lifecycle for retention management.
Let us start with the components that we need to build a solution
- An existing ec2 volume.
- A tag with some specific value on said ec2 volume.
- AWS Backup Vault
- AWS Backup Plan
- AWS Backup Backup rules
- AWS Backup Resource assignments
Configuration
Step 1. Tag the EBS volume
We choose/create an EC2 volume and attach a tag key/value pair. In this example it will be “myawsbackup – ebs-dev”
Notes* When choosing our key/value pair, bear in mind that this specification should be something that would help you recognise/manage your backups better and help you in a situation when you would need to choose a specific volume to do a data recovery.
For example using value: dev/prod/test would help you distinguish between your environments
Step 2. Vault
A backup vault is a logical container that stores your backups.
Backup vaults can be encrypted by an AWS KMS key or a customer managed key to control access to the vault and the backups within.
Backups are always stored in a backup Vault upon creation.You can create additional vaults. Each vault can be configured with different encryption keys or access policies.
Go to AWS Backup service and create your Backup Vault. Let’s call it “my-ebs-volumes” and we are going to use an AWS managed encryption key.
After creation you will be prompted to your newly created vault.
Inside is a summary of your Vault specifications. Here you can find “Recovery points”. This is the saved content of a resource. Each backup exists as a recovery point, which contains the content of a resource when it was backed up. These are created by backup plans or by on-demand backups.
You select a recovery point ID to reveal details about the specific recovery point.
Notes*
- As we learned the Vault holds the recovery points of our EBS volumes. From an “easy search” standpoint It is a good idea to separate your Vaults to hold recovery points for different environments.
For example: If you would want to see only your “dev” EBS volumes , you can send them to a Vault you named “ EBS volumes Dev”. The number of created Vaults is not billed, so you can create many of them. - A ‘Default’ vault is created with the first backup an account creates. You can use it as well , but it cannot be renamed or deleted.
Step 3. Backup Plan
A backup plan is a policy expression that defines when and how you want to back up your AWS resources, in our case EBS volumes.
You can assign resources to backup plans, and AWS Backup then automatically backs up and retains backups for those resources according to the backup plan. You can create multiple backup plans if you have workloads with different backup requirements.
As we learned earlier Vaults store backups according to backup rule configurations or by being the destination to which a backup is copied.
In the AWS Backup service we go to “Backup plans” and create your Backup plan.
Let’s build a new plan from scratch: Create a new backup plan by specifying each of the backup configuration details, either using the recommended defaults or settings that you choose.
In our case let’s start with naming and tagging the plan.
After that on the same page we will configure the Backup rules. There we specify the backup schedule, backup window, and life cycle of backups. Backup rules also specify which backup Vault to store backups in and what tags to add to backups when they are created.
In our case we will create a rule named ‘daily’ , send the backups to ‘my-ebs volumes’ Vault and this will happen on a daily basis starting from 01:00 AM and or in the next 8 hours of that time and will have a grace period of completion of 7 days. Then these backups will be retained for 30 days, which means that the first backup we did will expire after 31 days , the second one after 32 days and so on.
We can leave the next settings as default.
After clicking ‘Create plan” you will go to the next step of defining what resource you would like to make a backup of and by which criteria it will be selected.
In our case we will name ‘Resource assignment’ ‘ebs-volumes’ and we will use ‘default’ IAM role.
In resource selection we will select ‘include specific resource types’ so we get prompted the ‘Select specific resource type’ option and we will choose EBS. This will configure an ‘All volumes” type of situation for backup , then we will filter this by configuring the ‘Refine selection using tags’ option , where we will put the Key/Value pair we created in Step1. For our EBS volume.
Notes*You can have multiple backup rules in a single backup plan. For example, you can have a rule that creates daily backups that are retained for one month and another rule that creates monthly backups that are retained for one year.
This is a good practice for better recovery when an EBS volume gets corrupted in any way. That is why when creating a Backup plan it is good to set multiple rules like a daily one , a weekly one and a monthly one. So a naming convention like the one we used earlier (daily-weekly-monthly-ebs-dev) is nice way to communicate what ‘backup rules’ are defined in the ‘backup plan”
Inside is your newly created Backup plan, is a summary of the configurations we did earlier.
Notes*
- Resource assignments cannot be edited , only deleted then recreated.
- Backup rules can be edited , but if you have a Resource assignment created , you would need to delete it first before editing..
- Pricing – With AWS Backup, you pay only for the amount of backup storage you use and the amount of backup data you restore in the month. There is no minimum fee and there are no set-up charges.
Step 4. Retrieving
After all the configuration , we should be able to get a backup/snapshot of our EBS volume , which was tagged with a specific key/value pair, in the Vault we previously created.
Conclusion
AWS Backup simplifies the process of protecting your data and simplifies compliance with backup and retention policies. Overall by regularly creating and managing EBS snapshots through AWS Backup service, you can provide a scalable and reliable solution for ensuring the availability and recoverability of your critical data across a wide range of AWS services and resources.
