How do I use the AWS CLI to create an AWS Backup plan or run an on-demand job?

Resolution

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version.

Create an AWS Backup plan

Note: The following example backup plan is set up with a copy job configuration in the backup rule. You create a primary backup vault that hosts the recovery points in the source AWS Region. Then, you create a secondary vault in the destination Region. The secondary vault stores the recovery points that AWS Backup creates as part of the copy configuration in the backup plan.

1. To create a primary vault in the source Region, run the create-backup-vault command:

   aws backup create-backup-vault --backup-vault-name primary --region eu-west-1

   Note: Replace eu-west-1 with your source Region.

2. To create a secondary vault in the destination Region, run the create-backup-vault command again:

   aws backup create-backup-vault --backup-vault-name secondary --region eu-west-2

   Note: Replace eu-west-2 with your destination Region.

3. Configure a JSON file with the options for your backup plan.
   Example JSON file:

   {    "BackupPlanName": "testplan",
       "Rules": [{
           "RuleName": "HalfDayBackups",
           "TargetBackupVaultName": "primary",
           "ScheduleExpression": "cron(0 5/12 ? * * *)",
           "StartWindowMinutes": 480,
           "CompletionWindowMinutes": 10080,
           "Lifecycle": {
               "DeleteAfterDays": 30
           },
           "CopyActions": [{
               "DestinationBackupVaultArn": "arn:aws:backup:eu-west-2:111122223333:backup-vault:secondary",
               "Lifecycle": {
                   "DeleteAfterDays": 30
               }
           }]
       }]
   }

   Note: For ScheduleExpression, set the value based on the recovery point objective of your organization. The Lifecycle parameter is optional. You can specify a value that's based on the retention period of your backup strategy.

4. Run the create-backup-plan command and include the backup plan JSON file:

   aws backup create-backup-plan --backup-plan file://

5. In the preceding command's output, note the value that you receive for BackupPlanId.

6. Create a JSON file that sets the parameters to assign resources to the backup plan.
   Example JSON file:

   {    "SelectionName": "Myselection",
       "IamRoleArn": "arn:aws:iam::111122223333:role/service-role/AWSBackupDefaultServiceRole",
       "Resources": ["arn:aws:ec2:eu-west-1:111122223333:volume/vol-0abcdef1234"],
       "ListOfTags": [{
           "ConditionType": "STRINGEQUALS",
           "ConditionKey": "backup",
           "ConditionValue": "yes"
       }]
   }

   Note: To specify resources for a backup plan, you can use Amazon Resource Names (ARNs), tags, or both.

7. Run the create-backup-selection command and include the backup selection JSON file:

   aws backup create-backup-selection --backup-plan-id abcd-efgh-ijkl-mnop --backup-selection file://

   Note: Replace backup-plan-id with your backup plan ID.

Run an on-demand job in AWS Backup

To start an on-demand backup job, run the start-backup-job command.

The following example runs a backup job for the resource vol-0abcdef1234:

aws backup start-backup-job --backup-vault-name primary --resource-arn arn:aws:ec2:eu-west-1:111122223333:volume/vol-0abcdef1234 --iam-role-arn arn:aws:iam::111122223333:role/service-role/AWSBackupDefaultServiceRole --idempotency-token 623f13d2-78d2-11ea-bc55-0242ac130003 --start-window-minutes 60 --complete-window-minutes 10080 --lifecycle DeleteAfterDays=30 --region eu-west-1

Note: The preceding command includes a value for IdempotencyToken to distinguish between StartBackupJob calls. To generate a unique identifier on a Linux operating system (OS), run the uuid command:

uuid -r

To start an on-demand copy job, run the start-copy-job command.

The following example runs a job that copies the recovery point for snap-0abcdaf2247b33dbc from the source vault that's named primary to a destination vault that's named secondary:

aws backup start-copy-job --recovery-point-arn arn:aws:ec2:eu-west-1::snapshot/snap-0abcdaf2247b33dbc --source-backup-vault-name primary --destination-backup-vault-arn arn:aws:backup:eu-west-2:111122223333:backup-vault:secondary --iam-role-arn arn:aws:iam::111122223333:role/service-role/AWSBackupDefaultServiceRole --idempotency-token 5aac8974-78d2-11ea-bc55-0242ac130003 --lifecycle DeleteAfterDays=30 --region eu-west-1

To start a restore job, run the start-restore-job command.

The following example runs a restore job that uses a JSON metadata file:

aws backup start-restore-job --region us-east-1 --recovery-point-arn "arn:aws:backup:us-east-1:111222333444:recovery-point:123e4567-6cd9-464e-bb6b-13f70e79d347" --iam-role-arn "arn:aws:iam::111222333444:role/service-role/AWSBackupDefaultServiceRole"  --metadata file://path_to_json_file