How do I delete my AWS Backup vault?

Short description

Before you delete a backup vault, you must remove all recovery points stored in the vault. If your vault has a vault lock, an access policy with explicit Deny statements, or recovery points under a legal hold, you must address these blockers first. After you clear all recovery points and restrictions, delete the vault through the AWS Backup console or the AWS Command Line Interface (AWS CLI).

Resolution

Check your IAM permissions

Your AWS Identity and Access Management (IAM) role must have the backup:DeleteBackupVault permission.

Verify that the access policy attached to your backup vault doesn't include an explicit Deny statement that blocks the DeleteBackupVault action.

The following example policy blocks vault deletion:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "Principal": {
                "AWS": "*"
            },
            "Action": [
                "backup:DeleteBackupVault"
            ],
            "Resource": "*"
        }
    ]
}

If your vault has this type of policy, update the access policy to remove the Deny statement before you proceed.

Resolve vault lock restrictions

If your vault has a vault lock, you can't delete recovery points or the vault until you remove the lock. The steps to remove the lock depend on the lock mode:

Governance mode

If you have the DeleteBackupVaultLockConfiguration permission, remove the vault lock at any time. Run the following delete-backup-vault-lock-configuration AWS CLI command:

aws backup delete-backup-vault-lock-configuration --backup-vault-name YOUR-VAULT-NAME

Note: Replace YOUR-VAULT-NAME with the name of your backup vault.

Compliance mode

You can remove a compliance-mode vault lock only during the grace period (before the LockDate). After the grace period ends, you can't modify or delete the vault lock. Recovery points remain protected until their retention periods expire.

If you try to delete a recovery point in a locked vault, you receive the following error:

"RecoveryPoint cannot be deleted or updated (Backup vault configured with Lock)"

To resolve this error, remove the vault lock (if still in grace period) or wait for the retention period to expire.

Remove recovery points under legal hold

If any recovery points have a legal hold, you can't delete them until you remove the hold. To check for active legal holds:

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version.

Run the following list-legal-holds AWS CLI command:

aws backup list-legal-holds

If a legal hold applies to recovery points in your vault, cancel the legal hold before you delete those recovery points.

Delete all recovery points from the vault

You must delete every recovery point in the vault before you can delete the vault itself.

Delete a small number of recovery points (console)

1. Open the AWS Backup console.
2. In the navigation pane, choose Backup vaults.
3. Choose the name of the backup vault.
4. Select the recovery points you want to delete.
5. Choose Delete.
6. In the confirmation dialog, enter delete and choose Delete recovery points.

Delete recovery points in bulk (AWS CLI)

If your vault contains hundreds or thousands of recovery points, use the following script to delete them in bulk:

VAULT_NAME="YOUR-VAULT-NAME"

aws backup list-recovery-points-by-backup-vault \
    --backup-vault-name $VAULT_NAME \
    --query 'RecoveryPoints[].RecoveryPointArn' \
    --output text | tr '\t' '\n' | while read -r arn; do
    echo "Deleting: $arn"
    aws backup delete-recovery-point \
        --backup-vault-name $VAULT_NAME \
        --recovery-point-arn "$arn"
done

Note: Replace YOUR-VAULT-NAME with the name of your backup vault. This script lists all recovery point ARNs and deletes them one at a time. For vaults with a large number of recovery points, this process takes several minutes.

To verify that all recovery points are deleted, run the following list-recovery-points-by-backup-vault AWS CLI command:

aws backup list-recovery-points-by-backup-vault \
    --backup-vault-name YOUR-VAULT-NAME \
    --query 'RecoveryPoints | length(@)'

The output returns 0 when all recovery points are deleted.

Delete the backup vault

After you remove all recovery points, delete the vault.

AWS Backup console

1. Open the AWS Backup console.
2. In the navigation pane, choose Backup vaults.
3. Choose the name of the backup vault to open its details page.
4. Choose Delete vault.
5. In the confirmation dialog, enter the vault name and choose Delete Backup vault.

AWS CLI

Run the following delete-backup-vault AWS CLI command:

aws backup delete-backup-vault --backup-vault-name YOUR-VAULT-NAME

Note: Replace YOUR-VAULT-NAME with your backup vault name.

If the vault still contains recovery points, you receive the following error:

"An error occurred (InvalidRequestException) when calling the DeleteBackupVault operation: Backup vault with name YOUR-VAULT-NAME can't be deleted because it is not empty."

Return to the previous section and delete all remaining recovery points before you retry the vault deletion.

Understand vault deletion restrictions

You can't delete the following vaults through the AWS Management Console:

• Default vault – You can delete the default vault with the AWS CLI if it's empty. However, if you open the AWS Backup console in that Region, the console recreates the default vault.
• aws/efs/automatic-backup-vault – You can't delete the Amazon Elastic File System (Amazon EFS) automatic backup vault. You can only remove the recovery points stored in this vault.

Important: After you delete a vault, update any backup plans that reference the deleted vault. Backup jobs that target a deleted vault fail.

Related information

AWS Backup Vault Lock

Deleting backups

How do I delete recovery points that are under a legal hold or stored in a locked backup vault for AWS Backup?

How can I delete a default vault and Amazon EFS automatic backup vault in AWS Backup?

Troubleshooting deleting resources