Logically air-gapped vaults

Overview

AWS Backup is previewing a secondary type of vault which can store copies of backups in other vaults. A logically air-gapped vault is a specialized vault which offers increased security features in addition to those of a backup vault as well as the ability to share vault access to other accounts and organizations so that recovery time (RTO) can be faster and more flexible in case of an incident that requires rapid restoration of resources.

Logically air-gapped vaults come equipped with additional protection features: each of these vaults is encrypted with an AWS owned key, and each vault has a vault lock set in compliance mode.

You can choose to share a logically air-gapped vault across organizations and accounts so that the backups stored within can be restored from an account with which the vault is shared, if needed.

There are no additional charges for storage in logically air-gapped vaults during the preview period. Backups in standard backup vaults and cross-Region copies will still be charged at published rates (see pricing) even though any copies of those backups in logically air-gapped vaults are not charged.

Use case

A logically air-gapped vault is a secondary vault that serves as part of a data protection strategy. This vault can help enhance your organizational retention and recovery when you desire a vault for your backups that

Resources supported in a logically air-gapped vault include

This preview of logically air-gapped vaults is only available in US East (N. Virginia) Region. Because this feature is currently only in one Region, cross-Region copy is not supported during this preview period.

Compare and contrast with a standard backup vault

A backup vault is the primary and standard type of vault used in AWS Backup. Each backup is stored in a backup vault when the backup is created. You can assign resource-based policies to manage backups stored in the vault, such as the lifecycle of backups stored within the vault.

A logically air-gapped vault is a specialized vault with additional security and flexible sharing for faster recovery time (RTO). This vault stores copies of backups that were initially created and stored within a standard backup vault.

Backup vaults can be encrypted with a key, a security mechanism that limits access to intended users. These keys can be customer managed or AWS managed. Additionally, a backup vault can be even more secured by a vault lock; logically air-gapped vaults come equipped by a vault lock in compliance mode.

If the AWS KMS key was not manually changed or set as a KMS key at the time the initial resource was created, a backup cannot be copied into a logically air-gapped vault.