AWS AWS Backup CLI Commands

Associates an MPA approval team with a backup vault.

Removes the specified legal hold on a recovery point. This action can only be performed by a user with sufficient permissions.

Creates a backup plan using a backup plan name and backup rules. A backup plan is a document that contains information that Backup uses to schedule tasks that create recovery points for resources. If you call CreateBackupPlan with a plan that already exists, you receive an AlreadyExistsException exc

Creates a JSON document that specifies a set of resources to assign to a backup plan. For examples, see Assigning resources programmatically.

Creates a logical container where backups are stored. A CreateBackupVault request includes a name, optionally one or more resource tags, an encryption key, and a request ID. Do not include sensitive data, such as passport numbers, in the name of a backup vault.

Creates a framework with one or more controls. A framework is a collection of controls that you can use to evaluate your backup practices. By using pre-built customizable controls to define your policies, you can evaluate whether your backup practices comply with your policies and which resources ar

Creates a legal hold on a recovery point (backup). A legal hold is a restraint on altering or deleting a backup until an authorized user cancels the legal hold. Any actions to delete or disassociate a recovery point will fail with an error if one or more active legal holds are on the recovery point.

Creates a logical container to where backups may be copied. This request includes a name, the Region, the maximum number of retention days, the minimum number of retention days, and optionally can include tags and a creator request ID. Do not include sensitive data, such as passport numbers, in the

Creates a report plan. A report plan is a document that contains information about the contents of the report and where Backup will deliver it. If you call CreateReportPlan with a plan that already exists, you receive an AlreadyExistsException exception.

Creates a restore access backup vault that provides temporary access to recovery points in a logically air-gapped backup vault, subject to MPA approval.

Creates a restore testing plan. The first of two steps to create a restore testing plan. After this request is successful, finish the procedure using CreateRestoreTestingSelection.

This request can be sent after CreateRestoreTestingPlan request returns successfully. This is the second part of creating a resource testing plan, and it must be completed sequentially. This consists of RestoreTestingSelectionName, ProtectedResourceType, and one of the following: ProtectedResourc

Creates a tiering configuration. A tiering configuration enables automatic movement of backup data to a lower-cost storage tier based on the age of backed-up objects in the backup vault. Each vault can only have one vault-specific tiering configuration, in addition to any global configuration that a

Deletes a backup plan. A backup plan can only be deleted after all associated selections of resources have been deleted. Deleting a backup plan deletes the current version of a backup plan. Previous versions, if any, will still exist.

Deletes the resource selection associated with a backup plan that is specified by the SelectionId.

Deletes the backup vault identified by its name. A vault can be deleted only if it is empty.

Deletes the policy document that manages permissions on a backup vault.

Deletes Backup Vault Lock from a backup vault specified by a backup vault name. If the Vault Lock configuration is immutable, then you cannot delete Vault Lock using API operations, and you will receive an InvalidRequestException if you attempt to do so. For more information, see Vault Lock in the B

Deletes event notifications for the specified backup vault.

Deletes the framework specified by a framework name.

Deletes the recovery point specified by a recovery point ID. If the recovery point ID belongs to a continuous backup, calling this endpoint deletes the existing continuous backup and stops future continuous backup. When an IAM role's permissions are insufficient to call this API, the service sends b

Deletes the report plan specified by a report plan name.

This request deletes the specified restore testing plan. Deletion can only successfully occur if all associated restore testing selections are deleted first.

Input the Restore Testing Plan name and Restore Testing Selection name. All testing selections associated with a restore testing plan must be deleted before the restore testing plan can be deleted.

Deletes the tiering configuration specified by a tiering configuration name.

Returns backup job details for the specified BackupJobId.

Returns metadata about a backup vault specified by its name.

Returns metadata associated with creating a copy of a resource.

Returns the framework details for the specified FrameworkName.

Describes whether the Amazon Web Services account is opted in to cross-account backup. Returns an error if the account is not a member of an Organizations organization. Example: describe-global-settings --region us-west-2

Returns information about a saved resource, including the last time it was backed up, its Amazon Resource Name (ARN), and the Amazon Web Services service type of the saved resource.

Returns metadata associated with a recovery point, including ID, status, encryption, and lifecycle.

Returns the current service opt-in settings for the Region. If service opt-in is enabled for a service, Backup tries to protect that service's resources in this Region, when the resource is included in an on-demand backup or scheduled backup plan. Otherwise, Backup does not try to protect that servi

Returns the details associated with creating a report as specified by its ReportJobId.

Returns a list of all report plans for an Amazon Web Services account and Amazon Web Services Region.

Returns metadata associated with a restore job that is specified by a job ID.

Returns scan job details for the specified ScanJobID.

Removes the association between an MPA approval team and a backup vault, disabling the MPA approval workflow for restore operations.

Deletes the specified continuous backup recovery point from Backup and releases control of that continuous backup to the source service, such as Amazon RDS. The source service will continue to create and retain continuous backups using the lifecycle that you specified in your original backup plan. D

This action to a specific child (nested) recovery point removes the relationship between the specified recovery point and its parent (composite) recovery point.

Returns the backup plan that is specified by the plan ID as a backup template.

Returns BackupPlan details for the specified BackupPlanId. The details are the body of a backup plan in JSON format, in addition to plan metadata.

Returns a valid JSON document specifying a backup plan or an error.

Returns the template specified by its templateId as a backup plan.

Returns selection metadata and a document in JSON format that specifies a list of resources that are associated with a backup plan.

Returns the access policy document that is associated with the named backup vault.

Returns event notifications for the specified backup vault.

This action returns details for a specified legal hold. The details are the body of a legal hold in JSON format, in addition to metadata.

This operation returns the metadata and details specific to the backup index associated with the specified recovery point.

Returns a set of metadata key-value pairs that were used to create the backup.

This request returns the metadata for the specified restore job.

This request returns the minimal required set of metadata needed to start a restore job with secure default settings. BackupVaultName and RecoveryPointArn are required parameters. BackupVaultAccountId is an optional parameter.

Returns RestoreTestingPlan details for the specified RestoreTestingPlanName. The details are the body of a restore testing plan in JSON format, in addition to plan metadata.

Returns RestoreTestingSelection, which displays resources and elements of the restore testing plan.

Returns the Amazon Web Services resource types supported by Backup.

Returns TieringConfiguration details for the specified TieringConfigurationName. The details are the body of a tiering configuration in JSON format, in addition to configuration metadata.

This is a request for a summary of backup jobs created or running within the most recent 30 days. You can include parameters AccountID, State, ResourceType, MessageCategory, AggregationPeriod, MaxResults, or NextToken to filter results. This request returns a summary that contains Region, Account, S

Returns a list of existing backup jobs for an authenticated account for the last 30 days. For a longer period of time, consider using these monitoring tools.

Lists the backup plan templates.

Returns version metadata of your backup plans, including Amazon Resource Names (ARNs), backup plan IDs, creation and deletion dates, plan names, and version IDs.

Lists the active backup plans for the account.

Returns an array containing metadata of the resources associated with the target backup plan.

Returns a list of recovery point storage containers along with information about them.

This request obtains a list of copy jobs created or running within the the most recent 30 days. You can include parameters AccountID, State, ResourceType, MessageCategory, AggregationPeriod, MaxResults, or NextToken to filter results. This request returns a summary that contains Region, Account, Sta

Returns metadata about your copy jobs.

Returns a list of all frameworks for an Amazon Web Services account and Amazon Web Services Region.

This operation returns a list of recovery points that have an associated index, belonging to the specified account. Optional parameters you can include are: MaxResults; NextToken; SourceResourceArns; CreatedBefore; CreatedAfter; and ResourceType.

This action returns metadata about active and previous legal holds.

Returns an array of resources successfully backed up by Backup, including the time the resource was saved, an Amazon Resource Name (ARN) of the resource, and a resource type.

This request lists the protected resources corresponding to each backup vault.

Returns detailed information about the recovery points stored in a backup vault.

This action returns recovery point ARNs (Amazon Resource Names) of the specified legal hold.

The information about the recovery points of the type specified by a resource Amazon Resource Name (ARN). For Amazon EFS and Amazon EC2, this action only lists recovery points created by Backup.

Returns details about your report jobs.

Returns a list of your report plans. For detailed information about a single report plan, use DescribeReportPlan.

Returns a list of restore access backup vaults associated with a specified backup vault.

This request obtains a summary of restore jobs created or running within the the most recent 30 days. You can include parameters AccountID, State, ResourceType, AggregationPeriod, MaxResults, or NextToken to filter results. This request returns a summary that contains Region, Account, State, Restour

Returns a list of jobs that Backup initiated to restore a saved resource, including details about the recovery process.

This returns restore jobs that contain the specified protected resource. You must include ResourceArn. You can optionally include NextToken, ByStatus, MaxResults, ByRecoveryPointCreationDateAfter , and ByRecoveryPointCreationDateBefore.

Returns a list of restore testing plans.

Returns a list of restore testing selections. Can be filtered by MaxResults and RestoreTestingPlanName.

This is a request for a summary of scan jobs created or running within the most recent 30 days.

Returns a list of existing scan jobs for an authenticated account for the last 30 days.

Returns the tags assigned to the resource, such as a target recovery point, backup plan, or backup vault. This operation returns results depending on the resource type used in the value for resourceArn. For example, recovery points of Amazon DynamoDB with Advanced Settings have an ARN (Amazon Resour

Returns a list of tiering configurations.

Sets a resource-based policy that is used to manage access permissions on the target backup vault. Requires a backup vault name and an access policy document in JSON format.

Applies Backup Vault Lock to a backup vault, preventing attempts to delete any recovery point stored in or created in a backup vault. Vault Lock also prevents attempts to update the lifecycle policy that controls the retention period of any recovery point currently stored in a backup vault. If speci

Turns on notifications on a backup vault for the specified topic and events.

This request allows you to send your independent self-run restore test validation results. RestoreJobId and ValidationStatus are required. Optionally, you can input a ValidationStatusMessage.

Revokes access to a restore access backup vault, removing the ability to restore from its recovery points and permanently deleting the vault.

Starts an on-demand backup job for the specified resource.

Starts a job to create a one-time copy of the specified resource. Does not support continuous backups. See Copy job retry for information on how Backup retries copy job operations.

Starts an on-demand report job for the specified report plan.

Recovers the saved resource identified by an Amazon Resource Name (ARN).

Starts scanning jobs for specific resources.

Attempts to cancel a job to create a one-time backup of a resource. This action is not supported for the following services: Amazon Aurora Amazon DocumentDB (with MongoDB compatibility) Amazon FSx for Lustre Amazon FSx for NetApp ONTAP Amazon FSx for OpenZFS Amazon FSx for Windows File S

Assigns a set of key-value pairs to a resource.

Removes a set of key-value pairs from a recovery point, backup plan, or backup vault identified by an Amazon Resource Name (ARN) This API is not supported for recovery points for resource types including Aurora, Amazon DocumentDB. Amazon EBS, Amazon FSx, Neptune, and Amazon RDS.

Updates the specified backup plan. The new version is uniquely identified by its ID.

Updates the specified framework.

Updates whether the Amazon Web Services account is opted in to cross-account backup. Returns an error if the account is not an Organizations management account. Use the DescribeGlobalSettings API to determine the current settings.

This operation updates the settings of a recovery point index. Required: BackupVaultName, RecoveryPointArn, and IAMRoleArn

Sets the transition lifecycle of a recovery point. The lifecycle defines when a protected resource is transitioned to cold storage and when it expires. Backup transitions and expires backups automatically according to the lifecycle that you define. Resource types that can transition to cold storage

Updates the current service opt-in settings for the Region. Use the DescribeRegionSettings API to determine the resource types that are supported.

Updates the specified report plan.

This request will send changes to your specified restore testing plan. RestoreTestingPlanName cannot be updated after it is created. RecoveryPointSelection can contain: Algorithm ExcludeVaults IncludeVaults RecoveryPointTypes SelectionWindowDays

Updates the specified restore testing selection. Most elements except the RestoreTestingSelectionName can be updated with this request. You can use either protected resource ARNs or conditions, but not both.

This request will send changes to your specified tiering configuration. TieringConfigurationName cannot be updated after it is created. ResourceSelection can contain: Resources TieringDownSettingsInDays ResourceType