How can I get notifications for AWS Backup jobs that fail?

Resolution

The following resolution uses Amazon Simple Notification Service (Amazon SNS) to deliver vault-based notifications for supported events in AWS Backup. The solution notifies you when AWS Backup jobs in a single vault fail. For more information, see How can I configure Amazon EventBridge notifications for failed AWS Backup Jobs?

To receive notifications for other events, see Amazon SNS and AWS Backup events.

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshoot AWS CLI errors. Also, make sure that you use the most recent AWS CLI version.

Create an SNS topic to send AWS Backup notifications

1. Open the Amazon SNS console.
2. From the navigation pane, choose Topics.
3. Under Details, for Type, choose Standard.
4. Choose Create topic.
5. For Name, enter a name for the topic.
6. Choose Create topic.
7. Under Details, copy the value for ARN.
8. Choose Edit, and then expand Access policy.
9. In the JSON editor, enter the following permissions into the policy:

   {
       "Sid": "My-statement-id",
       "Effect": "Allow",
       "Principal": {
           "Service": "backup.amazonaws.com"
       },
       "Action": "SNS:Publish",
       "Resource": "arn:aws:sns:eu-west-1:111111111111:exampletopic"
   }

   Note: Replace the value for Resource with the Amazon Resource Name (ARN). You can configure your Amazon SNS topic as unencrypted, or you can use encryption at rest. If you use the default AWS Key Management Service (AWS KMS) for the encryption, then AWS Backup can't publish messages to the SNS topic. Because Amazon manages the default AWS KMS key, you can't edit the policy. Instead, you must use a customer managed key. The customer managed key must grant decrypt and generateDataKey permissions to backup.amazonaws.com.
10. Choose Save changes.

After you save your changes, the updated Access Policy appears and is similar to the following example:

{
    "Version": "2008-10-17",
    "Id": "__default_policy_ID",
    "Statement": [{
        "Sid": "__default_statement_ID",
        "Effect": "Allow",
        "Principal": {
            "AWS": "*"
        },
        "Action": ["SNS:Publish", "SNS:RemovePermission", "SNS:SetTopicAttributes", "SNS:DeleteTopic", "SNS:ListSubscriptionsByTopic", "SNS:GetTopicAttributes", "SNS:Receive", "SNS:AddPermission", "SNS:Subscribe"],
        "Resource": "arn:aws:sns:eu-west-1:111111111111:exampletopic",
        "Condition": {
            "StringEquals": {
                "AWS:SourceOwner": "111111111111"
            }
        }
    }, {
        "Sid": "My-statement-id",
        "Effect": "Allow",
        "Principal": {
            "Service": "backup.amazonaws.com"
        },
        "Action": "SNS:Publish",
        "Resource": "arn:aws:sns:eu-west-1:111111111111:exampletopic"
    }]
}

Create an Amazon SNS subscription to receive notifications for a failed backup job

1. Open the Amazon SNS console.
2. From the navigation pane, choose Subscriptions.
3. Choose Create subscription.
4. For Topic ARN, select your SNS topic from the ARN that you created.
5. For Protocol, choose Email-JSON.
6. For Endpoint, enter the email address where you want to receive notifications.
7. Choose Create subscription. Amazon SNS sends you a subscription confirmation email.
8. Confirm the subscription.

Configure your backup vault to send notifications to the SNS topic

To send notifications to the SNS topic, complete the following steps:

1. To turn on notifications for a backup vault, run the AWS CLI put-backup-vault-notifications command:

   aws backup put-backup-vault-notifications --backup-vault-name examplevault  --sns-topic-arn arn:aws:sns:eu-west-1:111111111111:exampletopic --backup-vault-events "BACKUP_JOB_FAILED"

   Note: Set --backup-vault-events to BACKUP_JOB_FAILED.
2. To confirm that notifications are configured, run the AWS CLI get-backup-vault-notifications command:

   aws backup get-backup-vault-notifications --backup-vault-name examplevault

The command returns the following example output:

{
    "BackupVaultName": "examplevault",
    "BackupVaultArn": "arn:aws:backup:eu-west-1:111111111111:backup-vault:examplevault",
    "SNSTopicArn": "arn:aws:sns:eu-west-1:111111111111:exampletopic",
    "BackupVaultEvents": ["BACKUP_JOB_FAILED"]
}

Monitor emails for notifications

When your vault has an unsuccessful backup job, you receive a message similar to the following email notification:

"An AWS Backup job was stopped. Resource ARN : arn:aws:ec2:eu-west-1:111111111111:volume/vol-example56d7w92d4b. BackupJob ID : example4-3dd5-5678-b52d-90bd749355a5"

To test notifications, create two on-demand backups. Then, stop one of the backups. You get an email notification only for the stopped backup.

Related information

Troubleshooting AWS Backup