AWS Backup Plan tagging strategy when applying plans to multiple resources

Hey,

Hope you're keeping well.

You’ve hit the hard quota of 100 resource assignments per backup plan, which cannot be increased. To cover all 587 resources, you’ll need to split them across multiple backup plans and group them logically (for example, one plan for certain S3 buckets, another for DynamoDB tables). For automatic coverage of new resources, use tag-based assignments rather than explicit resource listings—create multiple plans that target the same tag but filter by resource type to stay within limits. You can also request a soft limit increase for S3 buckets in AWS Backup via the Service Quotas console, but the 100-resource-per-plan cap will still apply.

Thanks and regards,
Taz

The issue you're experiencing is related to AWS Backup service limits, specifically the limit of 100 resource assignments per backup plan. This is a hard limit that cannot be increased. However, there are effective strategies to work around this limitation:

For your first question about increasing limits or working around them:

1. Create multiple backup plans with identical backup rules but different resource assignments. You could create 6-7 backup plans to cover all your 587 resources, with each plan handling up to 100 resources.

2. Use tag-based resource assignments more strategically. Instead of having one backup plan with many individual resource assignments, create backup plans that select resources based on tags. For example, you could tag resources with key-value pairs like "backup:yes" and have your backup plan select all resources with this tag.

For your second question about automatically applying backup plans to newly created resources:

1. Implement a tagging strategy where all new resources of specific types automatically receive the backup tags. This can be enforced through:

• AWS Organizations service control policies (SCPs)
• AWS Config rules
• Custom automation using AWS Lambda and EventBridge

2. When using tag-based resource selection, ensure you're applying tags at the appropriate level. For example, with S3, tags must be applied at the bucket level, not the object level, as AWS Backup doesn't support selection of objects based on their individual tags.

3. Make sure the IAM role used for tag-based backup plans has the necessary permissions to access all tagged resources. If AWS Backup encounters a resource it doesn't have permission to access, the backup plan may fail.

This approach will allow you to scale your backup strategy across your current resources and automatically include new resources as they're created, while staying within AWS Backup service limits.
Sources
Does AWS Backup charge premium on tag-based resource selection for backups? | AWS re:Post
Community | Protecting Amazon S3 Using AWS Backup
Community | Protecting Amazon DynamoDB Using AWS Backup
Community | Protecting Amazon DynamoDB Using AWS Backup
Resolve tag-based resource assignment issues in AWS Backup | AWS re:Post