Two distinct mechanisms that solve overlapping but different problems within a disaster recovery strategy. They’re complementary, not alternatives — most mature setups use both.
AWS Backup
A centralised orchestration service that takes and manages backups across multiple AWS services from one place. Supports RDS, Aurora, EBS, EFS, FSx, DynamoDB, S3, Storage Gateway, Neptune, DocumentDB, Redshift, and others.
Core ideas:
- Backup plans — schedule + retention + lifecycle (transition to cold storage) defined as a policy.
- Backup vaults — logical containers for recovery points. Encrypted with a KMS key.
- Resource assignment — pick resources by tag, by ID, or organisation-wide.
- Cross-account / cross-region copy — built into the plan, no custom Lambda glue.
- AWS Backup Audit Manager — reports compliance against frameworks (e.g. “all production RDS has a daily backup retained 35 days”).
PITR (Point-in-Time Recovery)
Native to specific services. Lets you restore a database to any second within a retention window, not just to the timestamps a backup was taken.
How it works under the hood: the service continuously archives transaction logs (WAL for Postgres, binlog for MySQL, DynamoDB streams). At restore time, it replays from the nearest snapshot up to the target timestamp.
| Service | Max PITR window | Granularity |
|---|---|---|
| RDS (MySQL, Postgres, etc.) | 35 days | 1 second |
| Aurora | 35 days | 1 second |
| DynamoDB | 35 days | 1 second |
| S3 | versioning, not PITR | per-object versions |
Restores create a new instance/table — you cannot PITR in place. Plan for the rename and connection-string switch as part of recovery.
When to use which
PITR — for tight RPO within the retention window.
- “I need to recover to 14:32:07 just before the bad migration ran.”
- “We had a corrupted write at 03:00, restore to 02:59.”
- RPO can be as low as one second. RTO is dominated by restore time (often 30–90 minutes for a large RDS instance).
AWS Backup — for compliance, retention, and cross-account isolation.
- “Keep monthly backups for 7 years.”
- “All backups must live in a separate account with vault lock.”
- “Tag-based: any resource with
backup=dailygets the daily plan.” - Cross-region copy for region-failure DR.
Use both for production:
- Native PITR enabled with maximum retention (35 days) for granular recovery.
- AWS Backup running on top, copying snapshots to a hardened vault in a separate account, with a lifecycle that moves them to cold storage and retains for compliance horizons.
AWS Backup vs native snapshots
Native snapshots (RDS automated/manual snapshots, EBS snapshots) are per-service. AWS Backup is a wrapper that calls the same underlying APIs but adds:
- Unified policy and reporting across services.
- Centralised vault with KMS, IAM, and resource policies.
- Vault Lock for immutability.
- Cross-account copy without custom orchestration.
Native snapshots are fine for a single service in a single account. AWS Backup earns its keep at the org or multi-account scale.
Vault Lock
The ransomware-defence feature. Once a vault is locked in compliance mode, neither the root user nor IAM admins can delete or shorten retention until the configured period elapses. Two flavours:
- Governance mode — protects against accidental changes; can be removed by a privileged role.
- Compliance mode — write-once-read-many. Cannot be undone, even by AWS support, until retention expires. Test in governance first; switch to compliance with eyes open.
Without vault lock, an attacker (or careless engineer) with sufficient IAM can delete every backup in seconds. Vault lock makes the backups durable against the operators of the account. See Multi-Failure Defence Patterns for the layered approach.
Cost model
- PITR — usually a flat per-GB-month uplift on the storage of the underlying database. Bundled with the service.
- AWS Backup — billed per GB of warm/cold storage in the vault, plus restore I/O charges. Cross-region copy adds inter-region transfer cost. Cold storage is much cheaper (>50% reduction) but has a 90-day minimum retention and 4-hour restore SLA.
- Restore costs — restoring a snapshot is free of compute charges until the restored instance runs, but cold-storage restores cost per GB retrieved. Build retrieval cost into the DR runbook.
Common pitfalls
- Enabling PITR but never testing a restore. A pristine PITR window does not equal a working recovery.
- Putting backup vaults in the same account as the workload. A compromised account compromises the backups.
- Forgetting that IAM roles for backup operations need permissions in the target account; cross-account requires vault and KMS resource policies that allow the source account.
- Vault lock surprise — discovering compliance-mode lock cannot be reversed when the retention is misconfigured.
- Assuming AWS Backup covers something it doesn’t (e.g. SSM Parameter Store, Secrets Manager values — not in scope; need separate backup).