How do I troubleshoot tag-based resource assignments in AWS Backup?

Short description

AWS Backup plans use resource assignments to identify which resources to back up. Resources might not be included in backups when you create tag-based resource assignments for these reasons:

• Tags contain extra spaces or incorrect names
• Tag cases don't match the resource assignment
• Amazon Aurora cluster tags have incorrect configurations
• Amazon Elastic Compute Cloud (Amazon EC2) instances or Amazon Elastic Block Store (Amazon EBS) volumes don't have the correct tags
• Amazon Simple Storage Service (Amazon S3) tags exist at the object level instead of the bucket level

Resolution

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version.

To resolve tag-based resource assignment issues in AWS Backup, complete these checks:

Check for extra spaces or incorrect tag names

Tags must match the resource assignment name exactly in AWS Backup. Both extra spaces and incorrect tag names can prevent resources from proper backup.

Check for extra spaces in tags

If the tag doesn't exactly match the resource assignment name in AWS Backup, then check for extra spaces in the tags. Run the get-backup-selection command:

aws backup get-backup-selection \
    --backup-plan-id "your-backup-plan-id" \
    --selection-id "your-selection-id"

Note: Extra white spaces in tags are difficult to spot in the AWS Management Console. Use the AWS CLI to identify these tag errors.

Example output:

{
    "ListOfTags": [
        {
            "ConditionType": "STRINGEQUALS",
            "ConditionKey": "backup ",
            "ConditionValue": "Yes"
        }
    ]
} 

Note: The preceding output contains extra spaces after backup. These extra spaces prevent the resource from matching the tag and backing up the resource.

If your output contains extra spaces, then remove any trailing spaces. However, you can't edit an existing resource assignment. You must delete the resource assignment and create a new resource assignment.

Check tag names

Tags are case sensitive and both tag keys and values must follow specific naming best practices.

To check for case variations in tag values, run the describe-tags command:

aws ec2 describe-tags \
    --query "Tags[?contains(to_lower(Key), 'backup')].Key" \
    --output text | tr '\t' '\n' | sort | uniq -c

Example output:

      5 backup
      3 Backup
      2 BACKUP
      1 BackUp
      7 back-up
      1 backup-required

Note: The preceding output contains six different name variations of the backup tag key across resources. This might cause AWS Backup selection issues.

Make sure that the tag matches the resource assignment name exactly. For example, you create a tag with key-value pair Backup=Yes, but your resource assignment looks for backup=yes. In this case, AWS Backup won't assign the resource to the backup plan because the capitalization doesn't match exactly.

For more information, see Tagging best practices.

Check Aurora cluster tags

Make sure that you tag the Aurora clusters and not the writer or reader instances. Tagging individual writer or reader instances won't work for cluster backups.

To review the current tags on your Aurora cluster, run the list-tags-for-resource command:

aws rds list-tags-for-resource \
    --resource-name arn:aws:rds:us-east-1:123456789012:cluster:your-cluster-name

If incorrect tags exist in your Aurora writer or reader instances, then run the remove-tags-from-resource command to delete tags from those resources:

aws rds remove-tags-from-resource \
    --resource-name arn:aws:rds:us-east-1:123456789012:db:my-aurora-writer \
    --tag-keys backup

If your Aurora cluster isn't tagged, then run the add-tags-to-resource command to add tags:

aws rds add-tags-to-resource 
    --resource name arn:aws:rds:us-east-1:111222333444:cluster:AWS-EXAMPLE 
    --tags "[{\"Key\": \"backup\",\"Value\": \"yes\"}]"

Check EC2 instance or EBS volume tags

Verify that Amazon EC2 instances or Amazon EBS volumes have the correct tags.

Run the describe-tags command to check for resources that have the tag value backup=yes.

aws ec2 describe-tags 
    --filters "Name=backup,Values=yes"

Note: The preceding command works for both EC2 instances and EBS volumes.

If incorrect tags exist, then run the delete-tags command to remove incorrect tags from EC2 instances:

aws ec2 delete-tags \
    --resources i-1234567890abcdef0 \
    --tags Key=Backup

If your EC2 instance or EBS volumes require tags, then run the create-tags command to add tags:

aws ec2 create-tags 
    --resources i-1234567890abcdef0 vol-1234567890abcdef8 
    --tags Key=backup,Value=yes

Check S3 bucket-level tags

Make sure to apply tags at the Amazon S3 bucket level, not the object level. AWS Backup doesn't support selection of objects for backup based on their individual tags.

To check your current S3 bucket tags, run the get-bucket-tagging command:

aws s3api get-bucket-tagging --bucket amzn-s3-demo-bucket

Note: Replace amzn-s3-demo-bucket with your S3 bucket name.

To add S3 bucket-level tags, run the put-bucket-tagging command

aws s3api put-bucket-tagging 
    --bucket amzn-s3-demo-bucket
    --tagging 'TagSet=[{Key=backup,Value=yes}]'

Note: Replace amzn-s3-demo-bucket with your S3 bucket name.

Related information

What are tags?

Managing resources in the Resource Explorer console