Cross accounts backups

Question

I have multiple AWS accounts (they're under Organizations) and I'd like to keep a backup of my data in a separate account.
I saw that AWS Backup allows you to do this, but all accounts must be from the same Organizaiton. In this case, I wanted to backup to a separate account outside the Organization, because if someone gets access to my root/management account (accidentally or not), they can gain access to other accounts inside the Organization and delete my backups .

What other forms of backup besides AWS Backup are there? I know it has DLM or Lambda scripts however they would be hard to manage. Is there any way to do what I want?

Answer

One possible option would be to use AWS DataSync to replicate data to the separate backup account. Schedule it to run automatically and handle encryption. Less centralized management than AWS Backup though.

However, having backup accounts outside the Org does add complexity. I'd try to evaluate the real risks - a malicious actor with root access could likely impact backups in many cases even across accounts. So focusing on prevention via IAM, MFA, monitoring etc may be a preferred approach vs complex cross-account backups.

Answer

Depending on what you are backing up you can use S3 and have the data replicated to another account that is locked down and outside of the organization.

https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication-walkthrough-2.html

Cross accounts backups

Relevant content