# Monitoring AWS Backup
AWS Backup works with other AWS tools to empower you to monitor its workloads. These tools include the following:
+ [AWS Backup console dashboards](backup-dashboards.md)
+ The jobs dashboard brings job health monitoring, where you can view metrics showing job successes and failures, filtered by reasons, accounts, Region, and resource type.
+ The jobs dashboard is available in Regions where AWS Backup Audit Manager is supported. See [Feature availability by AWS Region](backup-feature-availability.md#features-by-region) for those Regions. All other Regions will be able to access the [CloudWatch Dashboard](cloudwatch.md#cloudwatch-dashboard).
+ **Amazon CloudWatch** and **Amazon EventBridge** to monitor AWS Backup processes.
+ You can use CloudWatch to track metrics, create alarms, and view dashboards. For more information, see [AWS Backup metrics with Amazon CloudWatch](cloudwatch.md).
+ You can use EventBridge to view and monitor AWS Backup events. For more information, see [Monitoring AWS Backup events using Amazon EventBridge](eventbridge.md).
+ **AWS CloudTrail** to monitor AWS Backup API calls. You can identify the time, source IP, users, and accounts making those calls. For more information, see [Logging AWS Backup API calls with CloudTrail](logging-using-cloudtrail.md).
+ **Amazon Simple Notification Service** (Amazon SNS) to subscribe to AWS Backup-related topics such as backup, restore, and copy events. For more information, see [Notification options with AWS Backup](backup-notifications.md).
# AWS Backup console dashboards
**Note**
The jobs dashboard is available in all Regions where AWS Backup Audit Manager is supported. See [Feature availability by AWS Region](backup-feature-availability.md#features-by-region) for those Regions. All other Regions will be able to access the [CloudWatch Dashboard](cloudwatch.md#cloudwatch-dashboard).
**Topics**
+ [Backup dashboards overview](#backup-dashboards-overview)
+ [Viewing the jobs dashboard](#backup-dashboards-viewing)
+ [Reasons for problematic jobs](#problematic-reasons)
+ [Obtaining dashboard data through AWS CLI](#dashboard-data-cli)
## Backup dashboards overview
AWS Backup provides a Jobs dashboard in the console to help you monitor the health of your backup, copy, and restore jobs. The same data that is visually displayed in the console can be retrieved in the command line through AWS CLI.
The jobs dashboard can be used to identify issues with backup, copy, and restore jobs through organization level or member account monitoring. With this information, you can identify and diagnose events and possible issues to help ensure fidelity in your activities.
The jobs dashboard can display two timeframes. By default, data from the latest 14 days are displayed, but you can change the view to show the latest 7 days. If you change the timeframe, the data will update to reflect to new time interval.
Note the dashboard displays data until the most recent 0:00 UTC; that is, the current day's data is not included. The dashboard updates daily during approximately 1:30 - 2:30 UTC.
## Viewing the jobs dashboard
To view the jobs dashboard, [log into the AWS Backup console](https://console.aws.amazon.com/backup/) and select **Jobs dashboards** in the left navigation bar.
On the jobs dashboard page, you can select from the backup, copy, or restore jobs tab.
The jobs dashboard overview displays the aggregated view over the specified timeframe for job activity, including completed, completed with issues, expired, and failed jobs. By default, data from the latest 14 days are displayed, but you can change the view to show 7 days.
**Note**
`Completed with issues` is a status of a job displayed in the console that denotes a completed job with a status message.
### Job health
The line chart displays the successful and unsuccessful jobs rate lines over time. The successful rate line shows an aggregation of completed and completed with issues jobs. The unsuccessful rate line shows the sum of failed and expired jobs according to the specified time range.
Jobs in a non-completed or non-failed state (jobs with a status of created, pending, running, aborted, aborting, or partial) are not included; percentage totals may not equal 100%.
### Job status over time
With the bar chart, you can generate a custom bar chart that shows the number of jobs in each category (Completed, Complete with issues, Failed, and Expired), distributed by days.
With the dropdown menus, choose the status(es), resource types, and AWS Regions you want to see in the chart. If you want to explore your selection further, select **View jobs** to see a pre-filtered portion of the jobs/cross-account monitoring page.
You can hover the mouse over a bar to display a popover that shows detailed job data for the selected date.
### Problematic jobs
A **problematic** job is a job that has the status Failed, Expired, or Completed with issues. Each chart displays the corresponding metric that contains either the accounts, resource types, or top reasons that contain the highest number of problematic jobs.
The default display sorts the dashboard widget by the specified metric in descending order, starting with the metric with the highest number of problematic jobs that belong to the metric.
The top problematic accounts display will only be visible in accounts that have access through Organizations, such as administrative accounts and delegated administrator accounts. If visible, you can hover over an account to display the number of problematic jobs that belong to the chosen account.
You can select a bar within the graph to open a popup window. In this window, you can select a job status to open a jobs/cross-account monitoring table filtered by the status selected.
## Reasons for problematic jobs
The **Top problematic reasons** widget shows the message code category to which error messages belong. However, the category might not explain the issues a job experiences. Expand the message code categories below to see more details about the specific messages or errors your jobs could be encountering. All error messages not belonging to the message code categories below will fall under "MISCELLANEOUS".
### "VSS\$1ERROR"
+ "Windows VSS Backup attempt failed because either Instance or SSM Agent has invalid state or insufficient privileges."
+ "Windows VSS Backup attempt failed because of insufficient privileges to perform this operation"
+ "Windows VSS Backup attempt failed because ec2-vss-agent.exe is not installed in the Instance"
+ "Windows VSS Backup Job Error encountered, trying for regular backup"
+ "Windows VSS Backup attempt failed because of timeout on VSS enabled snapshot creation"
+ "Windows VSS Backup attempt failed because of unsupported Windows Server version. Supported Versions are Windows Server 2012 or later."
+ "Windows VSS Backup attempt failed because of timeout on VSS enabled snapshot creation"
### "LIMIT\$1EXCEEDED"
+ "Subscriber limit exceeded: You have reached the maximum concurrent number of backups, which is 300. Wait until other jobs finish, and try again. You can also reach out to Support to request a quota increase."
+ "Maximum allowed in-progress snapshots for a single volume exceeded."
+ "Maximum allowed active snapshot limit exceeded."
+ "Image creation throttled due to maximum number of concurrent snapshots on an EBS volume."
+ "Cannot create more than 20 user snapshots"
+ "The resultant tag set must not have more than 50 user tags."
+ "You have reached the maximum supported backups for your account/database. See Quotas in the Timestream developer guide for additional information."
+ "You have reached your quota of 50,000 for the number of public and private images allowed in this Region. Deregister unused images, or request an increase in your AMI quota."
+ "Your backup succeeded, but we were unable to persist NetworkInterfaces metadata as its size exceeded our internal limits."
+ "REGEX\$1subscriber limit exceeded"
+ "REGEX\$1More than 50 tags specified"
+ "REGEX\$1can have at most"
### "ACCESS\$1DENIED"
+ "You are not authorized to perform this operation."
+ "Access Denied trying to call AWS Backup service"
+ "Customer credential miss permission to get bucket versioning for bucket."
+ "Images from AWS Marketplace cannot be copied to another AWS account."
+ "Copy job failed because the destination Backup vault is encrypted with the default Backup service managed key. The contents of this vault cannot be copied. Only the contents of a Backup vault encrypted by an AWS KMS key may be copied.
+ Snapshots encrypted with the AWS managed key can't be shared. Specify another snapshot.
+ "Encrypted snapshots with Amazon EBS default key cannot be shared
+ "Copy job failed. Both source and destination account must be a member of the same organization."
+ "REGEX\$1access denied"
+ "REGEX\$1not authorized to"
+ "REGEX\$1cannot be assumed by AWS Backup
+ "REGEX\$1does not have permission"
+ "REGEX\$1missing permission"
### "CONCURRENT\$1JOB"
+ "Backup job failed because there was a running job for the same resource."
+ "There are too many copy jobs running for resource."
### "FEATURE\$1NOT\$1ENABLED"
+ "Copy job failed. Cross-account copy feature is not enabled for the current organization."
### "JOB\$1EXPIRED"
+ "Backup job expired before completion."
### "INVALID\$1LIFECYCLE"
+ "Copy job failed. The retention specified in the job is not within the range specified for the target Backup Vault."
+ "REGEX\$1could not start because it is either inside or too close to the weekly maintenance window configured"
+ "REGEX\$1could not start because it is either inside or too close to the automated backup window configured"
### "INVALID\$1STATE"
+ "REGEX\$1Instance is not in state"
+ "REGEX\$1not in the available state"
+ "REGEX\$1not in available state"
+ "REGEX\$1Cannot snapshot volume"
### "KMS\$1KEY\$1ERROR"
+ "KMS key is either disabled or pending deletion or access to KMS key is denied"
+ "Given key ID is not accessible"
+ "AMI snapshot copy failed with error: Given key ID is not accessible. You must have DescribeKey permissions on the default key"
+ "REGEX\$1kms key"
### "ACCESS\$1KEY\$1ERROR"
+ "The AWS Access Key Id needs a subscription for the service"
### "HYPERVISOR\$1OFFLINE"
+ "This operation is not valid for the specified hypervisor because it is not online"
### "RESOURCE\$1NOT\$1FOUND"
+ "The specified volume was not found."
+ "The virtual machine is not found."
+ "Given key ID does not exist"
+ "Table not found."
+ "REGEX\$1does not exist"
+ "REGEX\$1Could not find resource"
+ "REGEX\$1Could not find cryopod"
+ "REGEX\$1Cannot find recovery point"
+ "REGEX\$1resource not found"
+ "REGEX\$1no longer available"
+ "REGEX\$1is invalid"
### "RESOURCE\$1NOT\$1SUPPORTED"
+ "REGEX\$1unsupported resource type"
+ "REGEX\$1Unsupported resource type"
### "TAG\$1COPY\$1ERROR"
+ "We are unable to copy resource tags to your backup because of the Internal Failure."
+ "We are unable to copy resource tags to your backup because source or destination recovery point is unavailable"
### "TOKEN\$1EXPIRED"
+ "Token expired. Try again."
### "UNSUPPORTED\$1OPERATION"
+ "CreateSnapshot method not supported on hypervisor during snapshot creation. Aborted backup job"
+ "UnsupportedOperation : Storage Gateway backup copies require a user-created backup vault and key at destination."
+ "REGEX\$1Feature is not supported for provided resource type."
### "FATAL\$1ERROR"
+ "An internal error occurred."
+ "Copy job encountered a fatal error. Please contact AWS Support for further assistance."
+ "Copy job encountered a fatal error."
+ "REGEX\$1Backup job encountered a fatal error"
## Obtaining dashboard data through AWS CLI
You can use the command line to retrieve the same data which appears in the console. Use one of the following CLI commands:
+ [https://awscli.amazonaws.com/v2/documentation/api/latest/reference/backup/list-backup-job-summaries.html](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/backup/list-backup-job-summaries.html)
+ [https://awscli.amazonaws.com/v2/documentation/api/latest/reference/backup/list-copy-job-summaries.html](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/backup/list-copy-job-summaries.html)
+ [https://awscli.amazonaws.com/v2/documentation/api/latest/reference/backup/list-restore-job-summaries.html](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/backup/list-restore-job-summaries.html)
There are the valid parameters you can include in each command:
```
BackupJobSummaries (list)
Region (string),
Account (string),
State (string),
ResourceType (string),
MessageCategory (string),
AggregationPeriod: (string),
NextToken (string),
MaxResults (number)
CopyJobSummaries (list)
Region (string),
Account (string),
State (string),
ResourceType (string),
MessageCategory (string),
AggregationPeriod: (string),
NextToken (string),
MaxResults (number)
RestoreJobSummaries (list)
Region (string),
Account (string),
State (string),
ResourceType (string),
AggregationPeriod: (string),
NextToken (string)
```
This example shows a sample request where the a user has input `list-backup-job-summaries` where the request asks to return all available accounts with a state of `FAILED` over the prior 14 days:
```
GET /audit/backup-job-summaries/
?accountId=ANY
&state=FAILED
&aggregationPeriod=FOURTEEN_DAYS
```
To obtain a job count for jobs with a status of `completed with issues`, subtract the job count of `COMPLETED` jobs with a `MessageCategory` of `SUCCESS` from the total number of `COMPLETED`.
# Monitoring AWS Backup events using Amazon EventBridge
AWS Backup sends events to Amazon EventBridge when the state of a backup or copy job changes. You can use EventBridge to monitor AWS Backup events. For example, you can receive an alarm when a backup job fails. AWS Backup emits events to EventBridge in a best-effort manner every 5 minutes.
To track events using EventBridge, see the following:
+ [Creating a rule that reacts to events](https://docs.aws.amazon.com/eventbridge/latest/userguide/create-eventbridge-rule.html) (*Amazon EventBridge User Guide*)
+ [Amazon CloudWatch Events and Metrics for AWS Backup](https://aws.amazon.com/blogs/storage/amazon-cloudwatch-events-and-metrics-for-aws-backup/) (blog - see *Configure AWS Backup events to send to Amazon EventBridge*)
Some events report `status: COMPLETED` whereas other events report `state: COMPLETED`. This is consistent with the AWS Backup API. Some statuses are specific to the AWS Backup console: the status `Completed with issues` status is a representation of `Completed` jobs with status messages. To monitor `Completed with issues` events, monitor `COMPLETED` jobs that have a status message. Please note this is only specific to backup jobs.
You can alternatively use the AWS Backup notification API to track AWS Backup events with Amazon Simple Notification Service (Amazon SNS). However, EventBridge tracks more changes than the notification API does, including changes to backup vaults, copy job state, Region settings, and the number of cold or warm recovery points.
**Topics**
+ [Backup Job events](#aws-backup-events-backup-job)
+ [Backup Plan events](#aws-backup-events-backup-plan)
+ [Backup Vault events](#aws-backup-events-backup-vault)
+ [Copy Job events](#aws-backup-events-copy-job)
+ [Recovery Point events](#aws-backup-events-recovery-point)
+ [Region Settings events](#aws-backup-events-region-settings)
+ [Restore Job events](#aws-backup-events-restore-job)
+ [Recovery point indexing events](#aws-backup-recovery-point-indexing)
+ [Malware scan Job events](#aws-backup-events-malware-scan-job)
## Backup Job events
The following are example events.
**Topics**
+ [FAILED](#backup-job-state-change-failed)
+ [COMPLETED](#backup-job-state-change-completed)
+ [RUNNING](#backup-job-state-change-running)
+ [ABORTED](#backup-job-state-change-aborted)
+ [EXPIRED](#backup-job-state-change-expired)
+ [PENDING](#backup-job-state-change-pending)
+ [CREATED](#backup-job-state-change-created)
### State: FAILED
```
{
"version": "0",
"id": "710b0398-d48e-f3c3-afca-cfeb2fdaa656",
"detail-type": "Backup Job State Change",
"source": "aws.backup",
"account": "1112233445566",
"time": "2020-07-29T20:15:26Z",
"region": "us-west-2",
"resources": [],
"detail": {
"backupJobId": "34176239-e96d-4e1d-9fad-529dbb3c3556",
"backupVaultArn": "arn:aws:backup:us-west-2:1112233445566:backup-vault:9ab3e749-82c6-4342-9320-5edbf4918b86",
"backupVaultName": "9ab3e749-82c6-4342-9320-5edbf4918b86",
"bytesTransferred": "0",
"creationDate": "2020-07-29T20:13:07.392Z",
"iamRoleArn": "arn:aws:iam::1112233445566:role/MockRCBackupTestRole",
"resourceArn": "arn:aws:service:us-west-2:1112233445566:resource-type/resource-id",
"resourceType": "type",
"state": "FAILED",
"statusMessage": "\"Backup job failed because backup vault arn:aws:backup:us-west-2:1112233445566:backup-vault:9ab3e749-82c6-4342-9320-5edbf4918b86 does not exist.\"",
"startBy": "2020-07-30T04:13:07.392Z",
"percentDone": 0,
"retryCount": 3
}
}
```
### State: COMPLETED
```
{
"version": "0",
"id": "dafac799-9b88-0134-26b7-fef4d54a134f",
"detail-type": "Backup Job State Change",
"source": "aws.backup",
"account": "1112233445566",
"time": "2020-07-15T21:41:17Z",
"region": "us-west-2",
"resources": [
"arn:aws:backup:us-west-2:1112233445566:recovery-point:f1d966fe-a3bd-410b-b292-99f442d13b56"
],
"detail": {
"backupJobId": "a827233a-d405-4a86-a440-759fa94f34dd",
"backupSizeInBytes": "36048",
"backupVaultArn": "arn:aws:backup:us-west-2:1112233445566:backup-vault:9732c1b4-1091-472a-9d9f-52e0565ee39a",
"backupVaultName": "9732c1b4-1091-472a-9d9f-52e0565ee39a",
"bytesTransferred": "36048",
"creationDate": "2020-07-15T21:40:31.207Z",
"iamRoleArn": "arn:aws:iam::1112233445566:role/MockRCBackupTestRole",
"resourceArn": "arn:aws:service:us-west-2:1112233445566:resource-type/resource-id",
"resourceType": "type",
"state": "COMPLETED",
"completionDate": "2020-07-15T21:41:05.921Z",
"startBy": "2020-07-16T05:40:31.207Z",
"percentDone": 100,
"retryCount": 3
}
}
```
### State: RUNNING
```
{
"version": "0",
"id": "44946c39-b519-3505-44e6-ba74afeb2e30",
"detail-type": "Backup Job State Change",
"source": "aws.backup",
"account": "1112233445566",
"time": "2020-07-15T21:39:13Z",
"region": "us-west-2",
"resources": [],
"detail": {
"backupJobId": "B6EC38D2-CB3C-EF0A-F5A4-3CF324EF4945",
"backupSizeInBytes": "3221225472",
"backupVaultArn": "arn:aws:backup:us-west-2:1112233445566:backup-vault:e6625738-0655-4aa9-bd37-6ec1dd183b15",
"backupVaultName": "e6625738-0655-4aa9-bd37-6ec1dd183b15",
"bytesTransferred": "0",
"creationDate": "2020-07-15T21:38:31.152Z",
"iamRoleArn": "arn:aws:iam::1112233445566:role/FullBackupTestRole",
"resourceArn": "arn:aws:ec2:us-west-2:1112233445566:volume/vol-0b5ae24f2ee72d926",
"resourceType": "EBS",
"state": "RUNNING",
"startBy": "2020-07-16T05:00:00Z",
"expectedCompletionDate": "Jul 15, 2020 9:39:07 PM",
"percentDone": 99,
"createdBy": {
"backupPlanId": "bde0f455-4e24-4668-aeaa-4932a97f5cc5",
"backupPlanArn": "arn:aws:backup:us-west-2:1112233445566:backup-plan:bde0f455-4e24-4668-aeaa-4932a97f5cc5",
"backupPlanVersion": "YTkzNmM0MmUtMWRhNS00Y2RkLThmZGUtNjA5NTc4NGM1YTc5",
"backupPlanRuleId": "1f97bafa-14d6-4f39-94fd-94b51bd6d0d5"
}
}
}
```
### State: ABORTED
```
{
"version": "0",
"id": "4c91ceb0-b798-da82-6818-c29b3dce7543",
"detail-type": "Backup Job State Change",
"source": "aws.backup",
"account": "1112233445566",
"time": "2020-07-15T21:33:16Z",
"region": "us-west-2",
"resources": [],
"detail": {
"backupJobId": "58cdef95-7680-4c74-80d5-1b64093999c8",
"backupVaultArn": "arn:aws:backup:us-west-2:1112233445566:backup-vault:f59bffcd-2538-4bbe-8343-1c60dae27c27",
"backupVaultName": "f59bffcd-2538-4bbe-8343-1c60dae27c27",
"bytesTransferred": "0",
"creationDate": "2020-07-15T21:33:00.803Z",
"iamRoleArn": "arn:aws:iam::1112233445566:role/MockRCBackupTestRole",
"resourceArn": "arn:aws:service:us-west-2:1112233445566:resource-type/resource-id",
"resourceType": "type",
"state": "ABORTED",
"statusMessage": "\"Backup job was stopped by user.\"",
"completionDate": "2020-07-15T21:33:01.621Z",
"startBy": "2020-07-16T05:33:00.803Z",
"percentDone": 0
}
}
```
### State: EXPIRED
```
{
"version": "0",
"id": "1d7bbc04-6120-1145-13b9-49b0af465328",
"detail-type": "Backup Job State Change",
"source": "aws.backup",
"account": "1112233445566",
"time": "2020-07-29T13:04:57Z",
"region": "us-west-2",
"resources": [],
"detail": {
"backupJobId": "01EE26DC-7107-4D8E-0C54-EAC27C662BA4",
"backupVaultArn": "arn:aws:backup:us-west-2:1112233445566:backup-vault:aws/backup/AutomatedBackupVaultDel2",
"backupVaultName": "aws/backup/AutomatedBackupVaultDel2",
"bytesTransferred": "0",
"creationDate": "2020-07-29T05:10:20.077Z",
"iamRoleArn": "arn:aws:iam::1112233445566:role/MockRCBackupTestRole",
"resourceArn": "arn:aws:service:us-west-2:1112233445566:resource-type/resource-id",
"resourceType": "type",
"state": "EXPIRED",
"statusMessage": "\"Backup job failed because there was a running job for the same resource.\"",
"completionDate": "2020-07-29T13:02:15.234Z",
"startBy": "2020-07-29T13:00:00Z",
"percentDone": 0,
"createdBy": {
"backupPlanId": "aws/efs/414a5bd4-f880-47ad-95f3-f085108a4c3b",
"backupPlanArn": "arn:aws:backup:us-west-2:1112233445566:backup-plan:aws/efs/414a5bd4-f880-47ad-95f3-f085108a4c3b",
"backupPlanVersion": "NjBjOTUzZjYtYzZiNi00NjhlLWIzMTEtNWRjOWY0YTNjN2Vj",
"backupPlanRuleId": "3eb0017c-f262-4211-a802-302cebb11dc2"
}
}
}
```
### State: PENDING
```
{
"version": "0",
"id": "64dd1897-f863-31a3-9ee5-b05e306d81ff",
"detail-type": "Backup Job State Change",
"source": "aws.backup",
"account": "1112233445566",
"time": "2020-07-29T20:03:30Z",
"region": "us-west-2",
"resources": [],
"detail": {
"backupJobId": "2cffdb68-d6ed-485f-9f9b-8b530749f1c2",
"backupVaultArn": "arn:aws:backup:us-west-2:1112233445566:backup-vault:ed1f2661-5587-48bf-8a98-fadb977bf975",
"backupVaultName": "ed1f2661-5587-48bf-8a98-fadb977bf975",
"bytesTransferred": "0",
"creationDate": "2020-07-29T20:01:06.224Z",
"iamRoleArn": "arn:aws:iam::1112233445566:role/MockRCBackupTestRole",
"resourceArn": "arn:aws:service:us-west-2:1112233445566:resource-type/resource-id",
"resourceType": "type",
"state": "PENDING",
"statusMessage": "",
"startBy": "2020-07-30T04:01:06.224Z",
"percentDone": 0
}
}
```
### State: CREATED
```
{
"version": "0",
"id": "29af2bf2-eace-58ab-da3a-8c0bf738d692",
"detail-type": "Backup Job State Change",
"source": "aws.backup",
"account": "1112233445566",
"time": "2020-06-22T20:32:53Z",
"region": "us-west-2",
"resources": [],
"detail": {
"backupJobId": "7e8845b5-ca30-415f-a842-e0152bf4d0ca",
"state": "CREATED",
"creationDate": "2020-06-22T20:32:47.466Z"
}
}
```
## Backup Plan events
The following are example events.
**Topics**
+ [MODIFIED](#backup-plan-state-change-modified)
+ [DELETED](#backup-plan-state-change-deleted)
+ [CREATED](#backup-plan-state-change-created)
### State: MODIFIED
```
{
"version": "0",
"id": "2895aefb-dd4a-0a23-6071-2652abd92c3f",
"detail-type": "Backup Plan State Change",
"source": "aws.backup",
"account": "1112233445566",
"time": "2020-06-24T23:18:25Z",
"region": "us-west-2",
"resources": [
"arn:aws:backup:us-west-2:1112233445566:backup-plan:83fcb8ee-2d93-42ac-b06f-591563f3f8de"
],
"detail": {
"backupPlanId": "83fcb8ee-2d93-42ac-b06f-591563f3f8de",
"versionId": "NjIwNDFjMDEtNmZlNC00M2JmLTkzZDgtNzNkZjQyNzkxNDk0",
"modifiedAt": "2020-06-24T23:18:19.168Z",
"state": "MODIFIED"
}
}
```
### State: DELETED
```
{
"version": "0",
"id": "33fc5c1d-6db2-b3d9-1e70-1c9a2c23645c",
"detail-type": "Backup Plan State Change",
"source": "aws.backup",
"account": "1112233445566",
"time": "2020-06-24T23:18:25Z",
"region": "us-west-2",
"resources": [
"arn:aws:backup:us-west-2:1112233445566:backup-plan:83fcb8ee-2d93-42ac-b06f-591563f3f8de"
],
"detail": {
"backupPlanId": "83fcb8ee-2d93-42ac-b06f-591563f3f8de",
"versionId": "NjIwNDFjMDEtNmZlNC00M2JmLTkzZDgtNzNkZjQyNzkxNDk0",
"deletionDate": "2020-06-24T23:18:19.411Z",
"state": "DELETED"
}
}
```
### State: CREATED
```
{
"version": "0",
"id": "b64fb2d0-ae16-ff9a-faf6-0bdd0d4bfdef",
"detail-type": "Backup Plan State Change",
"source": "aws.backup",
"account": "1112233445566",
"time": "2020-06-24T23:18:19Z",
"region": "us-west-2",
"resources": [
"arn:aws:backup:us-west-2:1112233445566:backup-plan:2c103c5f-6d6e-4cac-9147-d3afa4c84f59"
],
"detail": {
"backupPlanId": "2c103c5f-6d6e-4cac-9147-d3afa4c84f59",
"versionId": "N2Q4OTczMzEtZmY1My00N2UwLWE3ODUtMjViYWYyOTUzZWY4",
"creationDate": "2020-06-24T23:18:15.318Z",
"state": "CREATED"
}
}
```
## Backup Vault events
The following are example events.
**Topics**
+ [CREATED](#backup-vault-state-change-created)
+ [MODIFIED](#backup-vault-state-change-modified)
+ [DELETED](#backup-vault-state-change-deleted)
### State: CREATED
```
{
"version": "0",
"id": "d415609e-5f35-d9a2-76d1-613683e4e024",
"detail-type": "Backup Vault State Change",
"source": "aws.backup",
"account": "1112233445566",
"time": "2020-06-24T23:18:19Z",
"region": "us-west-2",
"resources": [
"arn:aws:backup:us-west-2:1112233445566:backup-vault:d8864642-155c-4283-a168-a04f40e12c97"
],
"detail": {
"backupVaultName": "d8864642-155c-4283-a168-a04f40e12c97",
"state": "CREATED"
}
}
```
### State: MODIFIED
```
{
"version": "0",
"id": "1a2b3cd4-5e6f-7g8h-9i0j-123456k7l890",
"detail-type": "Backup Vault State Change",
"source": "aws.backup",
"account": "1112233445566",
"time": "2020-06-24T23:18:19Z",
"region": "us-west-2",
"resources": [
"arn:aws:backup:us-west-2:1112233445566:backup-vault:nameOfTestBackup"
],
"detail": {
"backupVaultName": "vaultName",
"state": "MODIFIED",
"isLocked": "true"
}
}
```
### State: DELETED
```
{
"version": "0",
"id": "344bccc1-6d2e-da93-3adf-b3f82460294d",
"detail-type": "Backup Vault State Change",
"source": "aws.backup",
"account": "1112233445566",
"time": "2020-06-22T02:42:37Z",
"region": "us-west-2",
"resources": [
"arn:aws:backup:us-west-2:1112233445566:backup-vault:e8189629-1f8e-4ed2-af7d-b32415d04db1"
],
"detail": {
"backupVaultName": "e8189629-1f8e-4ed2-af7d-b32415d04db1",
"state": "DELETED"
}
}
```
## Copy Job events
The following are example events.
**Topics**
+ [FAILED](#copy-job-state-change-failed)
+ [RUNNING](#copy-job-state-change-running)
+ [COMPLETED](#copy-job-state-change-completed)
+ [CREATED](#copy-job-state-change-created)
### State: FAILED
```
{
"version": "0",
"id": "4660bc92-a44d-c939-4542-cda503f14855",
"detail-type": "Copy Job State Change",
"source": "aws.backup",
"account": "1112233445566",
"time": "2020-07-15T20:37:34Z",
"region": "us-west-2",
"resources": [
"arn:aws:ec2:us-west-2::image/ami-00179b33a7a88cac5"
],
"detail": {
"copyJobId": "47C8EF56-74D8-059D-1301-C5BE1D5C926E",
"backupSizeInBytes": 22548578304,
"creationDate": "2020-07-15T20:36:13.239Z",
"iamRoleArn": "arn:aws:iam::1112233445566:role/RoleForEc2BackupWithNoDescribeTagsPermissions",
"resourceArn": "arn:aws:ec2:us-west-2:1112233445566:instance/i-0515aee7de03f58e1",
"resourceType": "EC2",
"sourceBackupVaultArn": "arn:aws:backup:us-west-2:1112233445566:backup-vault:55aa945e-c46a-421b-aa27-f94b074e31b7",
"state": "FAILED",
"statusMessage": "Access denied exception while trying to list tags",
"completionDate": "2020-07-15T20:37:28.704Z",
"destinationBackupVaultArn": "arn:aws:backup:us-west-2:1112233445566:backup-vault:55aa945e-c46a-421b-aa27-f94b074e31b7",
"destinationRecoveryPointArn": {}
}
}
```
### State: RUNNING
```
{
"version": "0",
"id": "d17480ae-7042-edb2-0ff5-8b94822c58e4",
"detail-type": "Copy Job State Change",
"source": "aws.backup",
"account": "1112233445566",
"time": "2020-07-15T22:07:48Z",
"region": "us-west-2",
"resources": [
"arn:aws:ec2:us-west-2::snapshot/snap-03886bc8d6ef3a1f9"
],
"detail": {
"copyJobId": "0175DE71-5784-589F-D8AC-541ACCB4CAC8",
"backupSizeInBytes": 3221225472,
"creationDate": "2020-07-15T22:06:27.234Z",
"iamRoleArn": "arn:aws:iam::1112233445566:role/OrganizationCanaryTestRole",
"resourceArn": "arn:aws:ec2:us-west-2:1112233445566:volume/vol-050eba21ee4d3c001",
"resourceType": "EBS",
"sourceBackupVaultArn": "arn:aws:backup:us-west-2:1112233445566:backup-vault:846869de-4589-45c3-ab60-4fbbabcdd3ec",
"state": "RUNNING",
"destinationBackupVaultArn": "arn:aws:backup:us-west-2:1112233445566:backup-vault:846869de-4589-45c3-ab60-4fbbabcdd3ec",
"destinationRecoveryPointArn": {},
"createdBy": {
"backupPlanId": "b58e3621-1c53-4997-ad8a-afc3347a850e",
"backupPlanArn": "arn:aws:backup:us-west-2:1112233445566:backup-plan:b58e3621-1c53-4997-ad8a-afc3347a850e",
"backupPlanVersion": "Mjc4ZTRhMzUtMGE5Ni00NmQ5LWE1YmMtOWMwY2IwMTY4NWQ4",
"backupPlanRuleId": "78e356d3-1a11-4f61-8585-af5d6b69bb18"
}
}
}
```
### State: COMPLETED
```
{
"version": "0",
"id": "47deb974-6473-aef1-56c2-52c3eaedfceb",
"detail-type": "Copy Job State Change",
"source": "aws.backup",
"account": "1112233445566",
"time": "2020-07-15T22:08:04Z",
"region": "us-west-2",
"resources": [
"arn:aws:ec2:us-west-2::snapshot/snap-03886bc8d6ef3a1f9"
],
"detail": {
"copyJobId": "0175DE71-5784-589F-D8AC-541ACCB4CAC8",
"backupSizeInBytes": 3221225472,
"creationDate": "2020-07-15T22:06:27.234Z",
"iamRoleArn": "arn:aws:iam::1112233445566:role/OrganizationCanaryTestRole",
"resourceArn": "arn:aws:ec2:us-west-2:1112233445566:volume/vol-050eba21ee4d3c001",
"resourceType": "EBS",
"sourceBackupVaultArn": "arn:aws:backup:us-west-2:1112233445566:backup-vault:846869de-4589-45c3-ab60-4fbbabcdd3ec",
"state": "COMPLETED",
"completionDate": "2020-07-15T22:07:58.111Z",
"destinationBackupVaultArn": "arn:aws:backup:us-west-2:1112233445566:backup-vault:846869de-4589-45c3-ab60-4fbbabcdd3ec",
"destinationRecoveryPointArn": "arn:aws:ec2:us-west-2::snapshot/snap-0726fe70935586180",
"createdBy": {
"backupPlanId": "b58e3621-1c53-4997-ad8a-afc3347a850e",
"backupPlanArn": "arn:aws:backup:us-west-2:1112233445566:backup-plan:b58e3621-1c53-4997-ad8a-afc3347a850e",
"backupPlanVersion": "Mjc4ZTRhMzUtMGE5Ni00NmQ5LWE1YmMtOWMwY2IwMTY4NWQ4",
"backupPlanRuleId": "78e356d3-1a11-4f61-8585-af5d6b69bb18"
}
}
}
```
### State: CREATED
```
{
"version": "0",
"id": "8398a4c4-8fe8-2b49-a4b9-fd4fdcd34a4e",
"detail-type": "Copy Job State Change",
"source": "aws.backup",
"account": "1112233445566",
"time": "2020-06-22T21:06:32Z",
"region": "us-west-2",
"resources": [
"arn:aws:ec2:us-west-2::image/ami-0888b126e2170b98e"
],
"detail": {
"creationDate": "2020-06-22T21:06:25.754Z",
"state": "CREATED",
"sourceBackupVaultArn": "arn:aws:backup:us-west-2:1112233445566:backup-vault:ef09da5a-21a6-461f-a98f-857e9e621a17",
"destinationBackupVaultArn": "arn:aws:backup:us-west-2:1112233445566:backup-vault:ef09da5a-21a6-461f-a98f-857e9e621a17"
}
}
```
## Recovery Point events
The following are the events.
**State**
+ [COMPLETED](#recovery-point-state-change-completed)
+ PARTIAL
+ DELETING
+ EXPIRED
+ AVAILABLE
+ STOPPED
+ CREATING
### State: COMPLETED
```
{
"version": "0",
"id": "ab32977c-378d-2122-e985-fgh4596f0709",
"detail-type": "Recovery Point State Change",
"source": "aws.backup",
"account": "1112233445566",
"time": "2020-07-15T21:39:07Z",
"region": "us-west-2",
"resources": [
"arn:aws:rds:us-west-2:1112233445566:cluster-snapshot:awsbackup:job-4ece7121-d60e-00c2-5c3b-49960142d03b"
],
"detail": {
"backupVaultName": "e6625738-0655-4aa9-bd37-6ec1dd183b15",
"backupVaultArn": "arn:aws:backup:us-west-2:496821122410:backup-vault:e6625738-0655-4aa9-bd37-6ec1dd183b15",
"creationDate": "2020-07-15T21:38:31.152Z",
"iamRoleArn": "arn:aws:iam::1112233445566:role/FullBackupTestRole",
"resourceType": "Aurora",
"resourceArn": "arn:aws:rds:us-west-2:1112233445566:cluster:id",
"status": "COMPLETED",
"isEncrypted": "false",
"storageClass": "WARM",
"completionDate": "2020-07-15T21:39:05.689Z",
"createdBy": {
"backupPlanId": "bde0f455-4e24-4668-aeaa-4932a97f5cc5",
"backupPlanArn": "arn:aws:backup:us-west-2:1112233445566:backup-plan:bde0f455-4e24-4668-aeaa-4932a97f5cc5",
"backupPlanVersion": "YTkzNmM0MmUtMWRhNS00Y2RkLThmZGUtNjA5NTc4NGM1YTc5",
"backupPlanRuleId": "1f97bafa-14d6-4f39-94fd-94b51bd6d0d5"
},
"lifecycle": {
"deleteAfterDays": 100
},
"calculatedLifeCycle": {
"deleteAt": "2020-10-23T21:38:31.152Z"
}
}
}
```
## Region Settings events
The following is an example event.
```
{
"version": "0",
"id": "e7ed82ba-4955-4de5-10d6-dbafcfb68b4f",
"detail-type": "Region Setting State Change",
"source": "aws.backup",
"account": "1112233445566",
"time": "2020-06-24T22:55:03Z",
"region": "us-west-2",
"resources": [],
"detail": {
"modifiedAt": "2020-06-24T22:54:57.161Z",
"ResourceTypeOptInPreference": {
"Aurora": true
},
"state": "MODIFIED"
}
}
```
## Restore Job events
The following are example events. Note that your use case of a restore job will determine the required and optional parameters to include. For example, if your restore job is part of a restore testing plan, the parameter `restoreTestingPlanArn` is included. See `DescribeRestoreJob` for possible parameters.
**Topics**
+ [FAILED](#restore-job-state-change-failed)
+ [RUNNING](#restore-job-state-change-running)
+ [COMPLETED](#restore-job-state-change-completed)
+ [PENDING](#restore-job-state-change-pending)
+ [CREATED](#restore-job-state-change-created)
### State: FAILED
```
{
"version": "0",
"id": "ab32977c-378d-2122-e985-fgh4596f0709",
"detail-type": "Restore Job State Change",
"source": "aws.backup",
"account": "1112233445566",
"time": "2020-07-15T20:19:29Z",
"region": "us-west-2",
"resources": [
"arn:aws:ec2:us-west-2::image/ami-12b3456dfb7f8cf90"
],
"detail": {
"restoreJobId": "1B234A56-789B-01CD-2A34-4567A08901FD",
"backupSizeInBytes": "22548578304",
"creationDate": "2020-07-15T20:19:07.303Z",
"iamRoleArn": "arn:aws:iam::1112233445566:role/TestAWSBackupRole",
"percentDone": 0,
"resourceType": "EC2",
"status": "FAILED",
"statusMessage": "AWS Backup does not permit attaching a new instance profile to an EC2 instance. Please restore using the backed up instance profile."
}
}
```
### State: RUNNING
```
{
"version": "0",
"id": "ab32977c-378d-2122-e985-fgh4596f0709",
"detail-type": "Restore Job State Change",
"source": "aws.backup",
"account": "1112233445566",
"time": "2020-07-29T20:26:06Z",
"region": "us-west-2",
"resources": [
"arn:aws:ec2:us-west-2::snapshot/snap-0fe123ca456cfad7c"
],
"detail": {
"restoreJobId": "1B234A56-789B-01CD-2A34-4567A08901FD",
"backupSizeInBytes": "3221225472",
"creationDate": "2020-07-29T20:26:00.098Z",
"iamRoleArn": "arn:aws:iam::1112233445566:role/RestoreTestRole",
"percentDone": 0,
"resourceType": "EBS",
"status": "RUNNING"
}
}
```
### State: COMPLETED
```
{
"version":"0",
"id":"ab32977c-378d-2122-e985-fgh4596f0709",
"detail-type":"Restore Job State Change",
"source":"aws.backup",
"account":"1112233445566",
"time":"2020-07-15T03:14:58Z",
"region":"us-west-2",
"resources":[
"arn:aws:rds:us-west-2:1112233445566:snapshot:awsbackup:job-1a2bcd34-567e-8901-23f4-5g6hijkl7890"
],
"detail":{
"restoreJobId":"AB123456-78C9-0123-456D-789012E34567",
"backupVaultArn":"arn:aws:backup:us-west-2:1112233445566:backup-vault:ExampleVault",
"recoveryPointArn":"arn:aws:backup:us-west-2:1112233445566:recovery-point:6f7fc1f8-2f2e-40ac-943b-8f8efa9ba99d",
"sourceResourceArn":"arn:aws:rds:us-west-2:1112233445566:db:example-database",
"backupSizeInBytes":"0",
"creationDate":"2020-07-15T03:10:01.742Z",
"iamRoleArn":"arn:aws:iam::1112233445566:role/RestoreTestRole",
"percentDone":0,
"resourceType":"RDS",
"status":"COMPLETED",
"createdResourceArn":"arn:aws:rds:us-west-2:1112233445566:db:testinginstance1a2bcd34-567e-8901-23f4-5g6hijkl7890",
"completionDate":"2020-07-15T03:14:53.128Z"
}
}
```
### State: PENDING
```
{
"version": "0",
"id": "ab32977c-378d-2122-e985-fgh4596f0709",
"detail-type": "Restore Job State Change",
"source": "aws.backup",
"account": "1112233445566",
"time": "2020-07-29T20:08:26Z",
"region": "us-west-2",
"resources": [
"arn:aws:backup:us-west-2:1112233445566:recovery-point:42bb8260-92cd-46a2-ab8d-b29f4edb47b1"
],
"detail": {
"restoreJobId": "123EA45F-C678-EFE9-0123-4D56FC0E789A",
"backupSizeInBytes": "36048",
"creationDate": "2020-07-29T20:08:21.083Z",
"iamRoleArn": "arn:aws:iam::1112233445566:role/RestoreTestRole",
"percentDone": 0,
"resourceType": "EC2",
"status": "PENDING"
}
}
```
### State: CREATED
```
{
"version": "0",
"id": "ab32977c-378d-2122-e985-fgh4596f0709",
"detail-type": "Restore Job State Change",
"source": "aws.backup",
"account": "1112233445566",
"time": "2020-06-22T18:50:49Z",
"region": "us-west-2",
"resources": [
"arn:aws:backup:us-west-2:1112233445566:recovery-point:a6560b33-3660-494c-8d47-efgh939ij32k"
],
"detail": {
"restoreJobId": "123EA45F-C678-EFE9-0123-4D56FC0E789A",
"creationDate": "2020-06-22T18:50:46.407Z",
"state": "CREATED"
}
}
```
## Recovery point indexing events
The following are example events.
**Topics**
+ [ACTIVE](#recovery-point-indexing-active)
+ [DELETED](#recovery-point-indexing-deleted)
+ [FAILED](#recovery-point-indexing-failed)
### State: ACTIVE
```
{
"version":"0",
"id":"ab32977c-378d-2122-e985-fgh4596f0709",
"detail-type":"Recovery Point Index State Change",
"source":"aws.backup",
"account":"1112233445566",
"time":"2023-12-15T21:39:07Z",
"region":"us-west-2",
"resources":[
"arn":"aws:backup:us-west-2:1112233445566:recovery-point:abcd1234-5678-abcd-9012-abcdef123456"
],
"detail":{
"recoveryPointArn":"arn:aws:backup:us-west-2:1112233445566:recovery-point:abcd1234-5678-abcd-9012-abcdef123456",
"accountId":"1112233445566",
"indexStatus":"ACTIVE",
"iamRoleArn":"arn:aws:iam::1112233445566:role/BackupIndexRole",
"resourceType":"EBS",
"backupVaultArn":"arn:aws:cryo:us-west-2:1112233445566:pod/backup-pod-12345",
"indexCreationTime":"2025-05-25T21:38:31.152Z",
"isIndexingContinuous":false,
"sourceResourceArn":"arn:aws:ec2:us-west-2:1112233445566:volume/vol-01234567890abcdef",
"backupCreationTime":"2023-12-15T21:38:00.000Z",
"indexStatusMessage":"An AWS Backup recovery point index was successfully completed. Indexed recovery point arn : arn:aws:backup:us-west-2:1112233445566:recovery-point:abcd1234-5678-abcd-9012-abcdef123456",
"indexCompletionTime":"2025-05-25T21:39:05.689Z",
}
}
```
### State: DELETED
```
{
"version":"0",
"id":"ab32977c-378d-2122-e985-fgh4596f0709",
"detail-type":"Recovery Point Index State Change",
"source":"aws.backup",
"account":"1112233445566",
"time":"2023-12-15T21:39:07Z",
"region":"us-west-2",
"resources":[
"arn":"aws:backup:us-west-2:1112233445566:recovery-point:abcd1234-5678-abcd-9012-abcdef123456"
],
"detail":{
"recoveryPointArn":"arn:aws:backup:us-west-2:1112233445566:recovery-point:abcd1234-5678-abcd-9012-abcdef123456",
"accountId":"1112233445566",
"indexStatus":"DELETED",
"iamRoleArn":"arn:aws:iam::1112233445566:role/BackupIndexRole",
"resourceType":"EBS",
"backupVaultArn":"arn:aws:cryo:us-west-2:1112233445566:pod/backup-pod-12345",
"indexCreationTime":"2025-05-25T21:38:31.152Z",
"isIndexingContinuous":false,
"sourceResourceArn":"arn:aws:ec2:us-west-2:1112233445566:volume/vol-01234567890abcdef",
"backupCreationTime":"2023-12-15T21:38:00.000Z",
"indexStatusMessage":"An AWS Backup recovery point index was deleted. Indexed recovery point arn : arn:aws:backup:us-west-2:1112233445566:recovery-point:abcd1234-5678-abcd-9012-abcdef123456",
"indexDeletionTime":"2025-05-27T22:39:05.689Z",
}
}
```
### State: FAILED
```
{
"version":"0",
"id":"ab32977c-378d-2122-e985-fgh4596f0709",
"detail-type":"Recovery Point Index State Change",
"source":"aws.backup",
"account":"1112233445566",
"time":"2023-12-15T21:39:07Z",
"region":"us-west-2",
"resources":[
"arn":"aws:backup:us-west-2:1112233445566:recovery-point:abcd1234-5678-abcd-9012-abcdef123456"
],
"detail":{
"recoveryPointArn":"arn:aws:backup:us-west-2:1112233445566:recovery-point:abcd1234-5678-abcd-9012-abcdef123456",
"accountId":"1112233445566",
"indexStatus":"FAILED",
"iamRoleArn":"arn:aws:iam::1112233445566:role/BackupIndexRole",
"resourceType":"EBS",
"backupVaultArn":"arn:aws:cryo:us-west-2:1112233445566:pod/backup-pod-12345",
"indexCreationTime":"2025-05-25T21:38:31.152Z",
"isIndexingContinuous":false,
"sourceResourceArn":"arn:aws:ec2:us-west-2:1112233445566:volume/01234567890abcdef",
"backupCreationTime":"2023-12-15T21:38:00.000Z",
"indexStatusMessage":"An AWS Backup recovery point index failed to create. Indexed recovery point arn : arn:aws:backup:us-west-2:1112233445566:recovery-point:abcd1234-5678-abcd-9012-abcdef123456",
}
}
```
## Malware scan Job events
The following are example events.
**Topics**
+ [CREATED](#malware-scan-job-state-change-created)
+ [RUNNING](#malware-scan-job-state-change-running)
+ [COMPLETED](#malware-scan-job-state-change-completed)
+ [COMPLETED WITH ISSUES](#malware-scan-job-state-change-completed-with-issues)
+ [FAILED](#malware-scan-job-state-change-failed)
+ [CANCELED](#malware-scan-job-state-change-canceled)
### State: CREATED
```
{
"version": "0",
"id": "60ce181d-67c7-496b-90fb-69636b42daee",
"detail-type": "Scan Job State Change",
"source": "aws.backup",
"account": "1112233445566",
"time": "2025-12-12T12:12:12Z",
"region": "us-west-2",
"resources": [
"arn:aws:backup:us-west-2:1112233445566:recovery-point:abcd1234-5678-abcd-9012-abcdef123456"
],
"detail": {
"accountId": "1112233445566",
"backupVaultArn": "arn:aws:backup:us-west-2:1112233445566:backup-vault:9ab3e749-82c6-4342-9320-5edbf4918b86",
"backupVaultName": "9ab3e749-82c6-4342-9320-5edbf4918b86",
"createdBy": {
"backupPlanArn": "arn:aws:backup:us-west-2:1112233445566:backup-plan:5d5a14cc-4ee2-4b9f-beb6-4afa998bb98f",
"backupPlanId": "5d5a14cc-4ee2-4b9f-beb6-4afa998bb98f",
"backupPlanVersion": "Mjc4ZTRhMzUtMGE5Ni00NmQ5LWE1YmMtOWMwY2IwMTY4NWQ4",
"backupRuleId": "256ad167-f523-4cb9-93f3-f0c933efd97f"
},
"creationDate": "2025-12-12T12:12:00Z",
"iamRoleArn": "arn:aws:iam::1112233445566:role/RoleForEc2BackupWithNoDescribeTagsPermissions",
"scannerRoleArn": "arn:aws:iam::1112233445566:role/RoleForAwsBackupGuarddutyScanner",
"recoveryPointArn": "arn:aws:backup:us-west-2:1112233445566:recovery-point:abcd1234-5678-abcd-9012-abcdef123456",
"resourceArn": "arn:aws:ec2:us-west-2:1112233445566:instance/i-0515aee7de03f58e1",
"resourceType": "EC2",
"scanId": "43bc14a6-03e0-436a-abf5-8825d3aa6835",
"scanJobId": "4d5fc12e-7e33-4336-a981-bbe43c300298",
"scanBaseRecoveryPointArn": "arn:aws:backup:us-west-2:1112233445566:recovery-point:46bd3edb-a499-4db1-8f8f-269a2ff76fab",
"malwareScanner": "GUARDDUTY",
"state": "CREATED"
}
}
```
### State: RUNNING
```
{
"version": "0",
"id": "60ce181d-67c7-496b-90fb-69636b42daee",
"detail-type": "Scan Job State Change",
"source": "aws.backup",
"account": "1112233445566",
"time": "2025-12-12T12:12:12Z",
"region": "us-west-2",
"resources": [
"arn:aws:backup:us-west-2:1112233445566:recovery-point:abcd1234-5678-abcd-9012-abcdef123456"
],
"detail": {
"accountId": "1112233445566",
"backupVaultArn": "arn:aws:backup:us-west-2:1112233445566:backup-vault:9ab3e749-82c6-4342-9320-5edbf4918b86",
"backupVaultName": "9ab3e749-82c6-4342-9320-5edbf4918b86",
"createdBy": {
"backupPlanArn": "arn:aws:backup:us-west-2:1112233445566:backup-plan:5d5a14cc-4ee2-4b9f-beb6-4afa998bb98f",
"backupPlanId": "5d5a14cc-4ee2-4b9f-beb6-4afa998bb98f",
"backupPlanVersion": "Mjc4ZTRhMzUtMGE5Ni00NmQ5LWE1YmMtOWMwY2IwMTY4NWQ4",
"backupRuleId": "256ad167-f523-4cb9-93f3-f0c933efd97f"
},
"creationDate": "2025-12-12T12:12:00Z",
"iamRoleArn": "arn:aws:iam::1112233445566:role/RoleForEc2BackupWithNoDescribeTagsPermissions",
"scannerRoleArn": "arn:aws:iam::1112233445566:role/RoleForAwsBackupGuarddutyScanner",
"recoveryPointArn": "arn:aws:backup:us-west-2:1112233445566:recovery-point:abcd1234-5678-abcd-9012-abcdef123456",
"resourceArn": "arn:aws:ec2:us-west-2:1112233445566:instance/i-0515aee7de03f58e1",
"resourceType": "EC2",
"scanId": "43bc14a6-03e0-436a-abf5-8825d3aa6835",
"scanJobId": "4d5fc12e-7e33-4336-a981-bbe43c300298",
"scanBaseRecoveryPointArn": "arn:aws:backup:us-west-2:1112233445566:recovery-point:46bd3edb-a499-4db1-8f8f-269a2ff76fab",
"malwareScanner": "GUARDDUTY",
"state": "RUNNING"
}
}
```
### State: COMPLETED
```
{
"version": "0",
"id": "60ce181d-67c7-496b-90fb-69636b42daee",
"detail-type": "Scan Job State Change",
"source": "aws.backup",
"account": "1112233445566",
"time": "2025-12-12T12:12:12Z",
"region": "us-west-2",
"resources": [
"arn:aws:backup:us-west-2:1112233445566:recovery-point:abcd1234-5678-abcd-9012-abcdef123456"
],
"detail": {
"accountId": "1112233445566",
"backupVaultArn": "arn:aws:backup:us-west-2:1112233445566:backup-vault:9ab3e749-82c6-4342-9320-5edbf4918b86",
"backupVaultName": "9ab3e749-82c6-4342-9320-5edbf4918b86",
"completionDate": "2025-12-12T12:12:12Z",
"createdBy": {
"backupPlanArn": "arn:aws:backup:us-west-2:1112233445566:backup-plan:5d5a14cc-4ee2-4b9f-beb6-4afa998bb98f",
"backupPlanId": "5d5a14cc-4ee2-4b9f-beb6-4afa998bb98f",
"backupPlanVersion": "Mjc4ZTRhMzUtMGE5Ni00NmQ5LWE1YmMtOWMwY2IwMTY4NWQ4",
"backupRuleId": "256ad167-f523-4cb9-93f3-f0c933efd97f"
},
"creationDate": "2025-12-12T12:12:00Z",
"iamRoleArn": "arn:aws:iam::1112233445566:role/RoleForEc2BackupWithNoDescribeTagsPermissions",
"scannerRoleArn": "arn:aws:iam::1112233445566:role/RoleForAwsBackupGuarddutyScanner",
"recoveryPointArn": "arn:aws:backup:us-west-2:1112233445566:recovery-point:abcd1234-5678-abcd-9012-abcdef123456",
"resourceArn": "arn:aws:ec2:us-west-2:1112233445566:instance/i-0515aee7de03f58e1",
"resourceType": "EC2",
"scanId": "43bc14a6-03e0-436a-abf5-8825d3aa6835",
"scanJobId": "4d5fc12e-7e33-4336-a981-bbe43c300298",
"scanBaseRecoveryPointArn": "arn:aws:backup:us-west-2:1112233445566:recovery-point:46bd3edb-a499-4db1-8f8f-269a2ff76fab",
"malwareScanner": "GUARDDUTY",
"scanResult": {
"scanResultStatus": "THREATS_FOUND"
},
"state": "COMPLETED",
"statusMessage": "An AWS Backup scan job was successful completed."
}
}
```
### State: COMPLETED WITH ISSUES
```
{
"version": "0",
"id": "60ce181d-67c7-496b-90fb-69636b42daee",
"detail-type": "Scan Job State Change",
"source": "aws.backup",
"account": "1112233445566",
"time": "2025-12-12T12:12:12Z",
"region": "us-west-2",
"resources": [
"arn:aws:backup:us-west-2:1112233445566:recovery-point:abcd1234-5678-abcd-9012-abcdef123456"
],
"detail": {
"accountId": "1112233445566",
"backupVaultArn": "arn:aws:backup:us-west-2:1112233445566:backup-vault:9ab3e749-82c6-4342-9320-5edbf4918b86",
"backupVaultName": "9ab3e749-82c6-4342-9320-5edbf4918b86",
"completionDate": "2025-12-12T12:12:12Z",
"createdBy": {
"backupPlanArn": "arn:aws:backup:us-west-2:1112233445566:backup-plan:5d5a14cc-4ee2-4b9f-beb6-4afa998bb98f",
"backupPlanId": "5d5a14cc-4ee2-4b9f-beb6-4afa998bb98f",
"backupPlanVersion": "Mjc4ZTRhMzUtMGE5Ni00NmQ5LWE1YmMtOWMwY2IwMTY4NWQ4",
"backupRuleId": "256ad167-f523-4cb9-93f3-f0c933efd97f"
},
"creationDate": "2025-12-12T12:12:00Z",
"iamRoleArn": "arn:aws:iam::1112233445566:role/RoleForEc2BackupWithNoDescribeTagsPermissions",
"scannerRoleArn": "arn:aws:iam::1112233445566:role/RoleForAwsBackupGuarddutyScanner",
"recoveryPointArn": "arn:aws:backup:us-west-2:1112233445566:recovery-point:abcd1234-5678-abcd-9012-abcdef123456",
"resourceArn": "arn:aws:ec2:us-west-2:1112233445566:instance/i-0515aee7de03f58e1",
"resourceType": "EC2",
"scanId": "43bc14a6-03e0-436a-abf5-8825d3aa6835",
"scanJobId": "4d5fc12e-7e33-4336-a981-bbe43c300298",
"scanBaseRecoveryPointArn": "arn:aws:backup:us-west-2:1112233445566:recovery-point:46bd3edb-a499-4db1-8f8f-269a2ff76fab",
"malwareScanner": "GUARDDUTY",
"scanResult": {
"scanResultStatus": "NO_THREATS_FOUND"
},
"state": "COMPLETED_WITH_ISSUES",
"statusMessage": "Scan job partially completed. View more details in Amazon GuardDuty"
}
}
```
### State: FAILED
```
{
"version": "0",
"id": "60ce181d-67c7-496b-90fb-69636b42daee",
"detail-type": "Scan Job State Change",
"source": "aws.backup",
"account": "1112233445566",
"time": "2025-12-12T12:12:12Z",
"region": "us-west-2",
"resources": [
"arn:aws:backup:us-west-2:1112233445566:recovery-point:abcd1234-5678-abcd-9012-abcdef123456"
],
"detail": {
"accountId": "1112233445566",
"backupVaultArn": "arn:aws:backup:us-west-2:1112233445566:backup-vault:9ab3e749-82c6-4342-9320-5edbf4918b86",
"backupVaultName": "9ab3e749-82c6-4342-9320-5edbf4918b86",
"completionDate": "2025-12-12T12:12:12Z",
"createdBy": {
"backupPlanArn": "arn:aws:backup:us-west-2:1112233445566:backup-plan:5d5a14cc-4ee2-4b9f-beb6-4afa998bb98f",
"backupPlanId": "5d5a14cc-4ee2-4b9f-beb6-4afa998bb98f",
"backupPlanVersion": "Mjc4ZTRhMzUtMGE5Ni00NmQ5LWE1YmMtOWMwY2IwMTY4NWQ4",
"backupRuleId": "256ad167-f523-4cb9-93f3-f0c933efd97f"
},
"creationDate": "2025-12-12T12:12:00Z",
"iamRoleArn": "arn:aws:iam::1112233445566:role/RoleForEc2BackupWithNoDescribeTagsPermissions",
"scannerRoleArn": "arn:aws:iam::1112233445566:role/RoleForAwsBackupGuarddutyScanner",
"recoveryPointArn": "arn:aws:backup:us-west-2:1112233445566:recovery-point:abcd1234-5678-abcd-9012-abcdef123456",
"resourceArn": "arn:aws:ec2:us-west-2:1112233445566:instance/i-0515aee7de03f58e1",
"resourceType": "EC2",
"scanId": "43bc14a6-03e0-436a-abf5-8825d3aa6835",
"scanJobId": "4d5fc12e-7e33-4336-a981-bbe43c300298",
"scanBaseRecoveryPointArn": "arn:aws:backup:us-west-2:1112233445566:recovery-point:46bd3edb-a499-4db1-8f8f-269a2ff76fab",
"malwareScanner": "GUARDDUTY",
"state": "FAILED",
"statusMessage": ""
}
}
```
### State: CANCELED
```
{
"version": "0",
"id": "60ce181d-67c7-496b-90fb-69636b42daee",
"detail-type": "Scan Job State Change",
"source": "aws.backup",
"account": "1112233445566",
"time": "2025-12-12T12:12:12Z",
"region": "us-west-2",
"resources": [
"arn:aws:backup:us-west-2:1112233445566:recovery-point:abcd1234-5678-abcd-9012-abcdef123456"
],
"detail": {
"accountId": "1112233445566",
"backupVaultArn": "arn:aws:backup:us-west-2:1112233445566:backup-vault:9ab3e749-82c6-4342-9320-5edbf4918b86",
"backupVaultName": "9ab3e749-82c6-4342-9320-5edbf4918b86",
"completionDate": "2025-12-12T12:12:12Z",
"createdBy": {
"backupPlanArn": "arn:aws:backup:us-west-2:1112233445566:backup-plan:5d5a14cc-4ee2-4b9f-beb6-4afa998bb98f",
"backupPlanId": "5d5a14cc-4ee2-4b9f-beb6-4afa998bb98f",
"backupPlanVersion": "Mjc4ZTRhMzUtMGE5Ni00NmQ5LWE1YmMtOWMwY2IwMTY4NWQ4",
"backupRuleId": "256ad167-f523-4cb9-93f3-f0c933efd97f"
},
"creationDate": "2025-12-12T12:12:00Z",
"iamRoleArn": "arn:aws:iam::1112233445566:role/RoleForEc2BackupWithNoDescribeTagsPermissions",
"scannerRoleArn": "arn:aws:iam::1112233445566:role/RoleForAwsBackupGuarddutyScanner",
"recoveryPointArn": "arn:aws:backup:us-west-2:1112233445566:recovery-point:abcd1234-5678-abcd-9012-abcdef123456",
"resourceArn": "arn:aws:ec2:us-west-2:1112233445566:instance/i-0515aee7de03f58e1",
"resourceType": "EC2",
"scanId": "43bc14a6-03e0-436a-abf5-8825d3aa6835",
"scanJobId": "4d5fc12e-7e33-4336-a981-bbe43c300298",
"scanBaseRecoveryPointArn": "arn:aws:backup:us-west-2:1112233445566:recovery-point:46bd3edb-a499-4db1-8f8f-269a2ff76fab",
"malwareScanner": "GUARDDUTY",
"state": "CANCELED",
"statusMessage": "Scan job was stopped by user."
}
}
```
# AWS Backup metrics with Amazon CloudWatch
**Topics**
+ [CloudWatch Dashboard](#cloudwatch-dashboard)
+ [Metrics with CloudWatch](#monitoring-metrics-with-cloudwatch)
## CloudWatch Dashboard
**Note**
The console dashboard depends on which Region is accessing the console. See [Feature availability by AWS Region](backup-feature-availability.md#features-by-region) to see which Regions have access to the Jobs dashboard. Regions not listed will be able to access the CloudWatch dashboard.
Your AWS Backup console includes a dashboard to see metrics on completed or failed backup, copy, and restore jobs. Within this dashboard, you can view job status by time period, customized to the time frame you desire.
**TO ACCESS THE DASHBOARD**
1. Open the AWS Backup console at [https://console.aws.amazon.com/backup](https://console.aws.amazon.com/backup).
1. Select **Dashboard** in the left-hand navigation pane.
**VIEW AND UNDERSTAND THE DASHBOARD**
The CloudWatch dashboard displays several widgets. Each widget shows job metrics by count. Each widget shows several line graphs. Each line corresponds to a protected resource (if you do not see an expected resource displayed, ensure the resource is turned on in **Settings**). The displays do not show in-progress jobs.
The y-axis (vertical values) shows the count. The x-axis (horizontal values) shows points in time. If there are no data points to visualize in the selected job status, the value will be set to 0 with a horizontal line on the x-axis. The legend showing the resources will still be visible.
The metrics display account-specific and Region-specific information related to the current login. To see other accounts or Regions, you must login under the chosen account.
**CUSTOMIZE THE DASHBOARD**
By default, the displayed time frame is one week. Along the top menu, there are options for redefining the displayed time frame. You can choose from among 1 hour, 3 hours, 12 hours, 1 day, 3 days, and 1 week. Additionally, you can select **Custom** to specify a different value. Customization will temporarily change the current view to your specifications.
You can hover over a widget, which will display a **Enlarge** button in the top right of the widget. Click on **Enlarge** to open the widget in full-screen view. In full screen, there are more options for customizing the graph display, such as changing the period (the time between every data point). Any changes will not be retained once the full-screen view is closed.
To view only one resource type at a time, click on the label text of the resource type you wish to view in the graph legend. This will deselect other all resource types. To reverse this, click on a resource type color box in the legend. To go back to default view of all resource types with all the labels selected, click again on the label text of any resource type selected.
Clicking the three vertical dots in the top right corner of a widgets opens up a drop down menu with options to refresh, enlarge, view in metrics and view in logs. “View in metrics” opens up the metric used in the widget in CloudWatch console. You can make any changes to the widget there and add the widget to a custom dashboard in CloudWatch dashboard. Any changes you make in the CloudWatch dashboard will not be reflected on the dashboard in AWS Backup Console. “View as logs” opens up the logs view page in CloudWatch console.
To add widgets displayed to your own custom CloudWatch dashboard, click on the **Add to dashboard** button located on the top right of the dashboard. This will open up the CloudWatch console where you can select in which custom dashboard to add all the six widgets.
For more information, see [ Using Amazon CloudWatch metrics](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/working_with_metrics.html).
## Metrics with CloudWatch
You can use CloudWatch to monitor AWS Backup metrics. The `AWS/Backup` namespace allows you to track the following metrics. AWS Backup emits updated metrics to CloudWatch every 5 minutes.
The purpose of this documentation page is to provide you with the reference materials to use CloudWatch to monitor AWS Backup. To learn how to monitor a metric using CloudWatch, see the blog [Amazon CloudWatch Events and Metrics for AWS Backup](https://aws.amazon.com/blogs/storage/amazon-cloudwatch-events-and-metrics-for-aws-backup/) or [Focus on Metrics and Alarms in a Single AWS Service](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Automatic_Dashboards_Focus_Service.html) in the *CloudWatch User Guide*. To set alarms, see [Using Amazon CloudWatch Alarms](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html) in the *CloudWatch User Guide*.
| Category | Metrics | Example dimensions | Example use case |
| --- | --- | --- | --- |
| Jobs | Number of backup, restore, and copy jobs across each state, including `CREATED`, `PENDING`, `RUNNING`, `ABORTED`, `COMPLETED`, `FAILED`, and `EXPIRED`. Different job types have different available states. | Resource type, vault name.The vault name of copy jobs is that of their destination vault. | Monitor the number of failed backup jobs within one or more specific backup vaults. When there are more than five failed jobs within 1 hour, send an email or SMS using Amazon SNS or open a ticket to the engineering team to investigate. **Reporting criteria**: There is a nonzero value |
| Recovery points | Number of warm and cold recovery points across each state: MODIFIED, COMPLETED, PARTIAL, EXPIRED, DELETED. | Resource type, vault name. | Track the number of deleted recovery points for your Amazon EBS volumes, and separately track the number of warm and cold recovery points in each backup vault. **Reporting criteria**: There is a nonzero value |
**Note**
The job status of `Completed with issues` is specific to only the AWS Backup console; it cannot be tracked via CloudWatch.
The following table lists all the metrics available to you.
| Metric | Description |
| --- | --- |
| NumberOfBackupJobsCreated | The number of backup jobs that AWS Backup created. |
| NumberOfBackupJobsPending | The number of backup jobs about to run in AWS Backup. |
| NumberOfBackupJobsRunning | The number of backup jobs currently running in AWS Backup. |
| NumberOfBackupJobsAborted | The number of user cancelled backup jobs. |
| NumberOfBackupJobsCompleted | The number of backup jobs that AWS Backup finished. |
| NumberOfBackupJobsFailed | The number of backup jobs with status of Failed. Often caused by scheduling a backup job during or 1 hour before a database resource or 3 hours before or during a Amazon FSx maintenance window or automated backup window and not using AWS Backup to perform continuous backup for point-in-time restores. See [Point-in-Time Recovery](https://docs.aws.amazon.com/aws-backup/latest/devguide/point-in-time-recovery.html) for a list of supported services and instructions on how to use AWS Backup to take continuous backups, or reschedule your backup jobs. |
| NumberOfBackupJobsExpired | The number of backup jobs that have a status of `EXPIRED`. A backup job changes from status `CREATED` to `EXPIRED` if a backup cannot begin within the start window time. |
| NumberOfCopyJobsCreated | The number of cross-account and cross-Region copy jobs that AWS Backup created. |
| NumberOfCopyJobsRunning | The number of cross-account and cross-Region copy jobs currently running in AWS Backup. |
| NumberOfCopyJobsCompleted | The number of cross-account and cross-Region copy jobs that AWS Backup finished. |
| NumberOfCopyJobsFailed | The number of cross-account and cross-Region copy jobs that AWS Backup attempted but could not complete. |
| NumberOfRestoreJobsPending | The number of restore jobs about to run in AWS Backup. |
| NumberOfRestoreJobsRunning | The number of restore jobs currently running in AWS Backup. |
| NumberOfRestoreJobsCompleted | The number of restore jobs that AWS Backup finished. |
| NumberOfRestoreJobsFailed | The number of restore jobs that AWS Backup attempted but could not complete. |
| NumberOfRecoveryPointsCompleted | The number of recovery points that AWS Backup created. |
| NumberOfRecoveryPointsPartial | The number of recovery points that AWS Backup started to create but could not finish. AWS retries the process later, but because the retry occurs at the later time, it retains the partial recovery point. |
| NumberOfRecoveryPointsExpired | The number of recovery points that AWS Backup attempted to delete based on your backup retention lifecycle, but could not delete. You are billed for the storage that expired backups consume and should delete them manually. |
| NumberOfRecoveryPointsDeleting | The number of recovery points that AWS Backup is deleting. |
| NumberOfRecoveryPointsCold | The number of recovery points that AWS Backup tiered to cold storage. |
More dimensions are available beyond those listed in the table. To view all the dimensions of a metric, type the name of that metric into the `AWS/Backup` namespace of the **Metrics** section of the CloudWatch console.
# Logging AWS Backup API calls with CloudTrail
AWS Backup is integrated with [AWS CloudTrail](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html) a service that provides a record of actions taken by a user, role, or an AWS service service. CloudTrail captures all API calls for AWS Backup as events. The calls captured include calls from the AWS Backup console and code calls to the AWS Backup API operations. Using the information collected by CloudTrail, you can determine the request that was made to AWS Backup, the IP address from which the request was made, when it was made, and additional details.
Every event or log entry contains information about who generated the request. The identity information helps you determine the following:
+ Whether the request was made with root user or user credentials.
+ Whether the request was made on behalf of an IAM Identity Center user.
+ Whether the request was made with temporary security credentials for a role or federated user.
+ Whether the request was made by another AWS service.
CloudTrail is active in your AWS account when you create the account and you automatically have access to the CloudTrail **Event history**. The CloudTrail **Event history** provides a viewable, searchable, downloadable, and immutable record of the past 90 days of recorded management events in an AWS Region. For more information, see [Working with CloudTrail Event history](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/view-cloudtrail-events.html) in the *AWS CloudTrail User Guide*. There are no CloudTrail charges for viewing the **Event history**.
For an ongoing record of events in your AWS account past 90 days, create a trail or a [CloudTrail Lake](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-lake.html) event data store.
**CloudTrail trails**
A *trail* enables CloudTrail to deliver log files to an Amazon S3 bucket. All trails created using the AWS Management Console are multi-Region. You can create a single-Region or a multi-Region trail by using the AWS CLI. Creating a multi-Region trail is recommended because you capture activity in all AWS Regions in your account. If you create a single-Region trail, you can view only the events logged in the trail's AWS Region. For more information about trails, see [Creating a trail for your AWS account](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-create-and-update-a-trail.html) and [Creating a trail for an organization](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/creating-trail-organization.html) in the *AWS CloudTrail User Guide*.
You can deliver one copy of your ongoing management events to your Amazon S3 bucket at no charge from CloudTrail by creating a trail, however, there are Amazon S3 storage charges. For more information about CloudTrail pricing, see [AWS CloudTrail Pricing](https://aws.amazon.com/cloudtrail/pricing/). For information about Amazon S3 pricing, see [Amazon S3 Pricing](https://aws.amazon.com/s3/pricing/).
**CloudTrail Lake event data stores**
*CloudTrail Lake* lets you run SQL-based queries on your events. CloudTrail Lake converts existing events in row-based JSON format to [ Apache ORC](https://orc.apache.org/) format. ORC is a columnar storage format that is optimized for fast retrieval of data. Events are aggregated into *event data stores*, which are immutable collections of events based on criteria that you select by applying [advanced event selectors](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-lake-concepts.html#adv-event-selectors). The selectors that you apply to an event data store control which events persist and are available for you to query. For more information about CloudTrail Lake, see [Working with AWS CloudTrail Lake](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-lake.html) in the *AWS CloudTrail User Guide*.
CloudTrail Lake event data stores and queries incur costs. When you create an event data store, you choose the [pricing option](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-lake-manage-costs.html#cloudtrail-lake-manage-costs-pricing-option) you want to use for the event data store. The pricing option determines the cost for ingesting and storing events, and the default and maximum retention period for the event data store. For more information about CloudTrail pricing, see [AWS CloudTrail Pricing](https://aws.amazon.com/cloudtrail/pricing/).
## AWS Backup events in CloudTrail
AWS Backup generates these CloudTrail events when it performs backups, restores, copies, scans or notifications. These events are not necessarily generated by use of the AWS Backup public APIs. For more information, see [AWS service events](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/non-api-aws-service-events.html) in the *AWS CloudTrail User Guide*.
+ `AssociateBackupVaultMpaApprovalTeamCompleted`
+ `AssociateBackupVaultMpaApprovalTeamFailed`
+ `BackupDeleted`
+ `BackupJobCompleted`
+ `BackupJobStarted`
+ `BackupSelectionDeletedDueToSLRDeletion`
+ `BackupTransitionedToCold`
+ `CopyJobCompleted`
+ `CopyJobStarted`
+ `CreateRestoreAccessBackupVaultFailed`
+ `DisassociateBackupVaultMpaApprovalTeamFailed`
+ `PutBackupVaultNotifications`
+ `RecoveryPointCreated`
+ `ReportJobCompleted`
+ `ReportJobStarted`
+ `RestoreAccessBackupVaultDeleted`
+ `RestoreCompleted`
+ `RestoreStarted`
+ `RevokeRestoreAccessBackupVaultFailed`
+ `ScanJobCompleted`
+ `ScanJobCreated`
+ `ScanJobFailed`
+ `ScanJobStarted`
## Understanding AWS Backup log file entries
A trail is a configuration that enables delivery of events as log files to an Amazon S3 bucket that you specify. CloudTrail log files contain one or more log entries. An event represents a single request from any source and includes information about the requested action, the date and time of the action, request parameters, and so on. CloudTrail log files aren't an ordered stack trace of the public API calls, so they don't appear in any specific order.
The following example shows a CloudTrail log entry that demonstrates the `StartBackupJob`, `StartRestoreJob`, and `DeleteRecoveryPoint` actions and also the `BackupJobCompleted` event.
```
{
"eventVersion": "1.05",
"userIdentity": {
"type": "Root",
"principalId": "123456789012",
"arn": "arn:aws:iam::123456789012:root",
"accountId": "123456789012",
"accessKeyId": "AKIAI44QH8DHBEXAMPLE",
"sessionContext": {
"attributes": {
"mfaAuthenticated": "false",
"creationDate": "2019-01-10T12:24:50Z"
}
}
},
"eventTime": "2019-01-10T13:45:24Z",
"eventSource": "backup.amazonaws.com",
"eventName": "StartBackupJob",
"awsRegion": "us-east-1",
"sourceIPAddress": "12.34.567.89",
"userAgent": "aws-internal/3 aws-sdk-java/1.11.465 Linux/4.9.124-0.1.ac.198.73.329.metal1.x86_64 OpenJDK_64-Bit_Server_VM/25.192-b12 java/1.8.0_192",
"requestParameters": {
"backupVaultName": "Default",
"resourceArn": "arn:aws:ec2:us-east-1:123456789012:volume/vol-00a422a05b9c6asd3",
"iamRoleArn": "arn:aws:iam::123456789012:role/AWSBackup",
"startWindowMinutes": 60
},
"responseElements": {
"backupJobId": "8a3c2a87-b23e-4d56-b045-fa9e88ede4e6",
"creationDate": "Jan 10, 2019 1:45:24 PM"
},
"requestID": "98cf4d59-8c76-49f7-9201-790743931234",
"eventID": "fe8146a5-7812-4a95-90ad-074498be1234",
"eventType": "AwsApiCall",
"recipientAccountId": "account-id"
},
{
"eventVersion": "1.05",
"userIdentity": {
"type": "Root",
"principalId": "123456789012",
"arn": "arn:aws:iam::123456789012:root",
"accountId": "123456789012",
"accessKeyId": "AKIAI44QH8DHBEXAMPLE",
"sessionContext": {
"attributes": {
"mfaAuthenticated": "false",
"creationDate": "2019-01-10T12:24:50Z"
}
}
},
"eventTime": "2019-01-10T13:49:50Z",
"eventSource": "backup.amazonaws.com",
"eventName": "StartRestoreJob",
"awsRegion": "us-east-1",
"sourceIPAddress": "12.34.567.89",
"userAgent": "aws-internal/3 aws-sdk-java/1.11.465 Linux/4.9.124-0.1.ac.198.73.329.metal1.x86_64 OpenJDK_64-Bit_Server_VM/25.192-b12 java/1.8.0_192",
"requestParameters": {
"recoveryPointArn": "arn:aws:ec2:us-east-1::snapshot/snap-00a129455bdbc9d99",
"metadata": {
"volumeType": "gp2",
"availabilityZone": "us-east-1b",
"volumeSize": "100"
},
"iamRoleArn": "arn:aws:iam::123456789012:role/AWSBackup",
"idempotencyToken": "a9c8b4fb-d369-4a58-944b-942e442a8fe3",
"resourceType": "EBS"
},
"responseElements": {
"restoreJobId": "9808E090-8C76-CCB8-4CEA-407CF6AC4C43"
},
"requestID": "783ddddc-6d7e-4539-8fab-376aa9668543",
"eventID": "ff35ddea-7577-4aec-a132-964b7e9dd423",
"eventType": "AwsApiCall",
"recipientAccountId": "account-id"
},
{
"eventVersion": "1.05",
"userIdentity": {
"type": "Root",
"principalId": "123456789012",
"arn": "arn:aws:iam::123456789012:root",
"accountId": "123456789012",
"accessKeyId": "AKIAI44QH8DHBEXAMPLE",
"sessionContext": {
"attributes": {
"mfaAuthenticated": "false",
"creationDate": "2019-01-10T12:24:50Z"
}
}
},
"eventTime": "2019-01-10T14:52:42Z",
"eventSource": "backup.amazonaws.com",
"eventName": "DeleteRecoveryPoint",
"awsRegion": "us-east-1",
"sourceIPAddress": "12.34.567.89",
"userAgent": "aws-internal/3 aws-sdk-java/1.11.465 Linux/4.9.124-0.1.ac.198.73.329.metal1.x86_64 OpenJDK_64-Bit_Server_VM/25.192-b12 java/1.8.0_192",
"requestParameters": {
"backupVaultName": "Default",
"recoveryPointArn": "arn:aws:ec2:us-east-1::snapshot/snap-05f426fd9daab3433"
},
"responseElements": null,
"requestID": "f1f1b33a-48da-436c-9a8f-7574f1ab5fd7",
"eventID": "2dd70080-5aba-4a79-9a0f-92647c9f0846",
"eventType": "AwsApiCall",
"recipientAccountId": "account-id"
},
{
"eventVersion": "1.05",
"userIdentity": {
"accountId": "123456789012",
"invokedBy": "backup.amazonaws.com"
},
"eventTime": "2019-01-10T08:24:39Z",
"eventSource": "backup.amazonaws.com",
"eventName": "BackupJobCompleted",
"awsRegion": "us-east-1",
"sourceIPAddress": "backup.amazonaws.com",
"userAgent": "backup.amazonaws.com",
"requestParameters": null,
"responseElements": null,
"eventID": "2e7e4fcf-0c52-467f-9fd0-f61c2fcf7d17",
"eventType": "AwsServiceEvent",
"recipientAccountId": "account-id",
"serviceEventDetails": {
"completionDate": {
"seconds": 1547108091,
"nanos": 906000000
},
"state": "COMPLETED",
"percentDone": 100,
"backupJobId": "8A8E738B-A8C5-E058-8224-90FA323A3C0E",
"backupVaultName": "BackupVault",
"backupVaultArn": "arn:aws:backup:us-east-1:123456789012:backup-vault:BackupVault",
"recoveryPointArn": "arn:aws:ec2:us-east-1::snapshot/snap-07ce8c3141d361233",
"resourceArn": "arn:aws:ec2:us-east-1:123456789012:volume/vol-06692095a6a421233",
"creationDate": {
"seconds": 1547101638,
"nanos": 272000000
},
"backupSizeInBytes": 8589934592,
"iamRoleArn": "arn:aws:iam::123456789012:role/AWSBackup",
"resourceType": "EBS"
}
}
```
## Logging cross-account management events
With AWS Backup, you can manage your backups across all AWS accounts inside your [AWS Organizations](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_introduction.html) structure. AWS Backup generates these CloudTrail events in your member account when you create, update, or delete an AWS Organizations backup policy (that applies backup plans to your member accounts) or when there is an invalid organization backup plan:
+ `CreateOrganizationalBackupPlan`
+ `UpdateOrganizationalBackupPlan`
+ `DeleteOrganizationalBackupPlan`
+ `InvalidOrganizationBackupPlan`
### Example: AWS Backup log file entries for cross-account management
A trail is a configuration that enables delivery of events as log files to an Amazon S3 bucket that you specify. CloudTrail log files contain one or more log entries. An event represents a single request from any source and includes information about the requested action, the date and time of the action, request parameters, and so on. CloudTrail log files aren't an ordered stack trace of the public API calls, so they don't appear in any specific order.
The following example shows a CloudTrail log entry that demonstrates the `CreateOrganizationalBackupPlan` action.
```
{
"eventVersion": "1.05",
"userIdentity": {
"accountId": "123456789012",
"invokedBy": "backup.amazonaws.com"},
"eventTime": "2020-06-02T00:34:00Z",
"eventSource": "backup.amazonaws.com",
"eventName": "CreateOrganizationalBackupPlan",
"awsRegion": "ca-central-1",
"sourceIPAddress": "backup.amazonaws.com",
"userAgent": "backup.amazonaws.com",
"requestParameters": null,
"responseElements": null,
"eventID": "f2642255-af77-4203-8c37-7ca19d898e84",
"readOnly": false,
"eventType": "AwsServiceEvent",
"recipientAccountId": "account-id",
"serviceEventDetails": {
"backupPlanId": "orgs/544033d1-b19c-3f2a-9c20-40bcfa82ca68",
"backupPlanVersionId": "ZTA1Y2ZjZDYtNmRjMy00ZTA1LWIyNTAtM2M1NzQ4OThmNzRj",
"backupPlanArn": "arn:aws:backup:ca-central-1:123456789012:backup-plan:orgs/544033d1-b19c-3f2a-9c20-40bcfa82ca68",
"backupPlanName": "mybackupplan",
"backupRules": "[{\"id\":\"745fd0ea-7f57-3f35-8a0e-ed4b8c48a8e2\",\"name\":\"hourly\",\"description\":null,\"cryopodArn\":\"arn:aws:backup:ca-central-1:123456789012:backup-vault:ControllerCAMTestBackupVault\",\"scheduleExpression\":\"cron(0 0/1 ? * * *)\",\"startWindow\":\"PT1H\",\"completionWindow\":\"PT2H\",\"lifecycle\":{\"moveToColdStorageAfterDays\":null,\"deleteAfterDays\":\"7\"},\"tags\":null,\"copyActions\":[]}]",
"backupSelections": "[{\"name\":\"selectiondatatype\",\"arn\":\"arn:aws:backup:ca-central-1:123456789012:selection:8b40c6d9-3641-3d49-926d-a075ea715686\",\"role\":\"arn:aws:iam::123456789012:role/OrganizationmyRoleTestRole\",\"resources\":[],\"notResources\":[],\"conditions\":[{\"type\":\"STRINGEQUALS\",\"key\":\"dataType\",\"value\":\"PII\"},{\"type\":\"STRINGEQUALS\",\"key\":\"dataType\",\"value\":\"RED\"}],\"creationDate\":\"2020-06-02T00:34:00.695Z\",\"creatorRequestId\":null}]",
"creationDate": {
"seconds": 1591058040,
"nanos": 695000000
},
"organizationId": "org-id",
"accountId": "123456789012"
}
}
```
The following example shows a CloudTrail log entry that demonstrates the `DeleteOrganizationalBackupPlan` action.
```
{
"eventVersion": "1.05",
"userIdentity": {
"accountId": "123456789012",
"invokedBy": "backup.amazonaws.com"
},
"eventTime": "2020-06-02T00:34:25Z",
"eventSource": "backup.amazonaws.com",
"eventName": "DeleteOrganizationalBackupPlan",
"awsRegion": "ca-central-1",
"sourceIPAddress": "backup.amazonaws.com",
"userAgent": "backup.amazonaws.com",
"requestParameters": null,
"responseElements": null,
"eventID": "5ce66cd0-b90c-4957-8e00-96ea1077b4fa",
"readOnly": false,
"eventType": "AwsServiceEvent",
"recipientAccountId": "account-id",
"serviceEventDetails": {
"backupPlanId": "orgs/544033d1-b19c-3f2a-9c20-40bcfa82ca68",
"backupPlanVersionId": "ZTA1Y2ZjZDYtNmRjMy00ZTA1LWIyNTAtM2M1NzQ4OThmNzRj",
"backupPlanArn": "arn:aws:backup:ca-central-1:123456789012:backup-plan:orgs/544033d1-b19c-3f2a-9c20-40bcfa82ca68",
"backupPlanName": "mybackupplan",
"deletionDate": {
"seconds": 1591058065,
"nanos": 519000000
},
"organizationId": "org-id",
"accountId": "123456789012"
}
}
```
The following example shows a CloudTrail log entry that demonstrates the event `InvalidOrganizationBackupPlan`, which is sent when AWS Backup receives an invalid backup plan from Organizations.
```
{
"eventVersion": "1.08",
"userIdentity": {
"accountId": "123456789012",
"invokedBy": "backup.amazonaws.com"
},
"eventTime": "2022-06-11T13:29:23Z",
"eventSource": "backup.amazonaws.com",
"eventName": "InvalidOrganizationBackupPlan",
"awsRegion": "Region",
"sourceIPAddress": "backup.amazonaws.com",
"userAgent": "backup.amazonaws.com",
"requestParameters": null,
"responseElements": null,
"eventID": "ab1de234-fg56-7890-h123-45ij678k9l01",
"readOnly": false,
"eventType": "AwsServiceEvent",
"managementEvent": true,
"recipientAccountId": "987654321098",
"serviceEventDetails": {
"effectivePolicyVersion": 7,
"effectivePolicyId": "12345678-a9b0-123c-45d6-78e901f23456",
"lastUpdatedTimestamp": "Jun 11, 2022 1:29:22 PM",
"policyType": "BACKUP_POLICY",
"effectiveBackupPlan": {
"logicalName": "logical-name",
"regions": [
"Region"
],
"rules": [
{
"name": "test-orgs",
"targetBackupVaultName": "vault-name",
"ruleLifecycle": {
"deleteAfterDays": 100
},
"copyActions": [],
"enableContinuousBackup": true
}
],
"selections": {
"tagSelections": [
{
"selectionName": "selection-name",
"iamRoleArn": "arn:aws:iam::$account:role/role",
"targetedTags": [
{
"tagKey": "key",
"tagValue": "value"
}
]
}
]
},
"backupPlanTags": {
"key": "value"
}
},
"organizationId": "org-id",
"accountId": "123456789012"
},
"eventCategory": "Management"
}
```
# Notification options with AWS Backup
There are two ways to receive notifications about AWS Backup:
+ User Notifications can send notifications, including Amazon CloudWatch alarms, AWS Support, and other services' notifications.
+ Amazon Simple Notification Service can notify you of AWS Backup events.
## User Notifications and AWS Backup
AWS Backup supports management of your backup notifications from the [User Notifications console](https://console.aws.amazon.com//notifications/home?notifications#/notifications). With [User Notifications](https://docs.aws.amazon.com/notifications/latest/userguide/getting-started.html), you can view the progress of your backup, copy, and restore jobs and changes to your backup policies, vaults, recovery points, and settings from the User Notifications Notification Center.
Amazon CloudWatch, Amazon EventBridge alarms, and AWS Support case updates are among other types of notifications you can manage from the console. Additionally, you can set up several delivery options, including email, Amazon Q Developer in chat applications notifications, and AWS Console Mobile Application push notifications.
## Amazon SNS and AWS Backup events
AWS Backup takes advantage of the robust notifications delivered by Amazon Simple Notification Service (Amazon SNS). You can configure Amazon SNS to notify you of AWS Backup events from the Amazon SNS console.
**Limitations**
+ While the Amazon SNS service allows cross-account notifications, AWS Backup does not currently support this feature. You must specify your own AWS account ID and the resource ARN of your topic.
+ AWS Backup supports Standard topics for SNS best-effort deduplication, but AWS Backup does not currently support SNS FIFO topics for Strict deduplication.
### Common use cases
+ Set up notifications for failed backup jobs by following the steps in [How can I get notifications for AWS Backup jobs that failed?](https://repost.aws/knowledge-center/aws-backup-failed-job-notification) from AWS Premium Support.
+ Review sample Amazon SNS notification JSONs for completed, failed, and expired backup jobs in the Examples of events table below.
For more information about Amazon SNS generally, see [Getting Started with Amazon SNS](https://docs.aws.amazon.com/sns/latest/dg/sns-getting-started.html) in the *Amazon Simple Notification Service Developer Guide*.
### AWS Backup notification APIs
After creating your topics using the Amazon SNS console or AWS Command Line Interface (AWS CLI), you can use the following AWS Backup API operations to manage your backup notifications.
+ [DeleteBackupVaultNotifications](API_DeleteBackupVaultNotifications.md) — Deletes event notifications for the specified backup vault.
+ [GetBackupVaultNotifications](API_GetBackupVaultNotifications.md) — Lists all event notifications for the specified backup vault.
+ [PutBackupVaultNotifications](API_PutBackupVaultNotifications.md) — Turns on notifications for the specified topic and events.
AWS Backup supports the following events:
| Job type | Event |
| --- | --- |
| Backup job | BACKUP\$1JOB\$1STARTED \$1 BACKUP\$1JOB\$1COMPLETED \$1 CONTINUOUS\$1BACKUP\$1INTERRUPTED |
| Copy job | COPY\$1JOB\$1STARTED \$1 COPY\$1JOB\$1SUCCESSFUL \$1 COPY\$1JOB\$1FAILED |
| Restore job | RESTORE\$1JOB\$1STARTED \$1 RESTORE\$1JOB\$1COMPLETED |
| Recovery point | RECOVERY\$1POINT\$1MODIFIED |
| Recovery point indexing | RECOVERY\$1POINT\$1INDEX\$1COMPLETED \$1 RECOVERY\$1POINT\$1INDEX\$1DELETED \$1 RECOVERY\$1POINT\$1INDEXING\$1FAILED |
AWS Backup for S3 supports two additional events:
+ `S3_BACKUP_OBJECT_FAILED` notifies you of any S3 object that AWS Backup failed to back up during a backup job.
+ `S3_RESTORE_OBJECT_FAILED` notifies you of any S3 object that AWS Backup failed to restore during a restore job.
AWS Backup for EKS supports three additional events:
+ `EKS_BACKUP_OBJECT_FAILED` notifies you of any EKS objects that AWS Backup failed to back up during a backup job.
+ `EKS_RESTORE_OBJECT_FAILED` notifies you of any EKS objects that AWS Backup failed to restore during a restore job.
+ `EKS_RESTORE_OBJECT_SKIPPED` notifies you of any EKS objects that AWS Backup skipped during a restore job.
### Examples of events
**Example: Backup job completed**
```
{
"Records": [{
"EventSource": "aws:sns",
"EventVersion": "1.0",
"EventSubscriptionArn": "arn:aws:sns:...-a3802aa1ed45",
"Sns": {
"Type": "Notification",
"MessageId": "12345678-abcd-123a-def0-abcd1a234567",
"TopicArn": "arn:aws:sns:us-west-1:123456789012:backup-2sqs-sns-topic",
"Subject": "Notification from AWS Backup",
"Message": "An AWS Backup job was completed successfully. Recovery point ARN: arn:aws:ec2:us-west-1:123456789012:volume/vol-012f345df6789012d. Resource ARN : arn:aws:ec2:us-west-1:123456789012:volume/vol-012f345df6789012e. BackupJob ID : 1b2345b2-f22c-4dab-5eb6-bbc7890ed123",
"Timestamp": "2019-08-02T18:46:02.788Z",
...
"MessageAttributes": {
"EventType": {"Type":"String","Value":"BACKUP_JOB"},
"State": {"Type":"String","Value":"COMPLETED"},
"AccountId": {"Type":"String","Value":"123456789012"},
"Id": {"Type":"String","Value":"1b2345b2-f22c-4dab-5eb6-bbc7890ed123"},
"StartTime": {"Type":"String","Value":"2019-09-02T13:48:52.226Z"}
}
}
}]
}
```
**Example: Backup job failed**
```
{
"Records": [{
"EventSource": "aws:sns",
"EventVersion": "1.0",
"EventSubscriptionArn": "arn:aws:sns:...-a3802aa1ed45",
"Sns": {
"Type": "Notification",
"MessageId": "12345678-abcd-123a-def0-abcd1a234567",
"TopicArn": "arn:aws:sns:us-west-1:123456789012:backup-2sqs-sns-topic",
"Subject": "Notification from AWS Backup",
"Message": "An AWS Backup job failed. Resource ARN : arn:aws:ec2:us-west-1:123456789012:volume/vol-012f345df6789012e. BackupJob ID : 1b2345b2-f22c-4dab-5eb6-bbc7890ed123",
"Timestamp": "2019-08-02T18:46:02.788Z",
...
"MessageAttributes": {
"EventType": {"Type":"String","Value":"BACKUP_JOB"},
"State": {"Type":"String","Value":"FAILED"},
"AccountId": {"Type":"String","Value":"123456789012"},
"Id": {"Type":"String","Value":"1b2345b2-f22c-4dab-5eb6-bbc7890ed123"},
"StartTime": {"Type":"String","Value":"2019-09-02T13:48:52.226Z"}
}
}
}]
}
```
**Example: Backup job could not complete during the backup window**
```
{
"Records": [{
"EventSource": "aws:sns",
"EventVersion": "1.0",
"EventSubscriptionArn": "arn:aws:sns:...-a3802aa1ed45",
"Sns": {
"Type": "Notification",
"MessageId": "12345678-abcd-123a-def0-abcd1a234567",
"TopicArn": "arn:aws:sns:us-west-1:123456789012:backup-2sqs-sns-topic",
"Subject": "Notification from AWS Backup",
"Message": "An AWS Backup job failed to complete in time. Resource ARN : arn:aws:ec2:us-west-1:123456789012:volume/vol-012f345df6789012e. BackupJob ID : 1b2345b2-f22c-4dab-5eb6-bbc7890ed123",
"Timestamp": "2019-08-02T18:46:02.788Z",
...
"MessageAttributes" : {
"EventType" : {"Type":"String","Value":"BACKUP_JOB"},
"State" : {"Type":"String","Value":"EXPIRED"},
"AccountId" : {"Type":"String","Value":"123456789012"},
"Id" : {"Type":"String","Value":"1b2345b2-f22c-4dab-5eb6-bbc7890ed123"},
"StartTime" : {"Type":"String","Value":"2019-09-02T13:48:52.226Z"}
}
}
}]
}
```
**Example: Recovery point indexing completed**
```
{
"Records": [{
"EventSource": "aws:sns",
"EventVersion": "1.0",
"EventSubscriptionArn": "arn:aws:sns:...-a3802aa1ed45",
"Sns": {
"Type": "Notification",
"MessageId": "12345678-abcd-123a-def0-abcd1a234567",
"TopicArn": "arn:aws:sns:us-west-1:123456789012:backup-2sqs-sns-topic",
"Subject": "Notification from AWS Backup",
"Message": "An AWS Backup backup index job was completed. Indexed recovery point arn: arn:aws:backup:us-west-2:1112233445566:recovery-point:abcd1234-5678-abcd-9012-abcdef123456",
"Timestamp": "2025-05-25T18:46:02.788Z",
...
"MessageAttributes" : {
"EventType" : {"Type":"String","Value":"RECOVERY_POINT_INDEXING_COMPLETED"},
"AccountId" : {"Type":"String","Value":"123456789012"},
"IndexStatus" : {"Type":"String","Value":"ACTIVE"},
"IsIndexingContinuous" : {"Type":"String","Value":"false"},
"RecoveryPointArn" : {"Type":"String","Value":"arn:aws:backup:us-west-2:1112233445566:recovery-point:abcd1234-5678-abcd-9012-abcdef123456"}
}
}
}]
}
```
**Example: EKS backup object failed**
```
{
"Records": [{
"EventSource": "aws:sns",
"EventVersion": "1.0",
"EventSubscriptionArn": "arn:aws:sns:...-a3802aa1ed45",
"Sns": {
"Type": "Notification",
"MessageId": "12345678-abcd-123a-def0-abcd1a234567",
"TopicArn": "arn:aws:sns:us-west-1:123456789012:backup-2sqs-sns-topic",
"Subject": "Notification from AWS Backup",
"Message": "A Kubernetes resource failed to backup from your Amazon EKS Backup. Resource: example.resource.io/v1. EKS Cluster Name: eks-cluster-name. BackupJob ID: 1b2345b2-f22c-4dab-5eb6-bbc7890ed123",
"Timestamp": "2025-05-25T18:46:02.788Z",
...
"MessageAttributes" : {
"eventType" : {"Type":"String","Value":"EKS_BACKUP_OBJECT_FAILED"},
"backupJobId" : {"Type":"String","Value":"1b2345b2-f22c-4dab-5eb6-bbc7890ed123"},
"clusterName" : {"Type":"String","Value":"eks-cluster-name"},
"reason" : {"Type":"String","Value":"Example failure reason."},
"resourceName" : {"Type":"String","Value":"example.resource.io/v1"}
}
}
}]
}
```
**Example: EKS restore object failed**
```
{
"Records": [{
"EventSource": "aws:sns",
"EventVersion": "1.0",
"EventSubscriptionArn": "arn:aws:sns:...-a3802aa1ed45",
"Sns": {
"Type": "Notification",
"MessageId": "12345678-abcd-123a-def0-abcd1a234567",
"TopicArn": "arn:aws:sns:us-west-1:123456789012:backup-2sqs-sns-topic",
"Subject": "Notification from AWS Backup",
"Message": "A Kubernetes resource failed to restore from your Amazon EKS Backup. Resource: apiextensions.k8s.io/v1/customresourcedefinitions. Resource Name: exampleresource. Destination EKS Cluster Name: eks-restore-target-cluster-name. RestoreJob ID: 1b2345b2-f22c-4dab-5eb6-bbc7890ed123",
"Timestamp": "2025-05-25T18:46:02.788Z",
...
"MessageAttributes" : {
"eventType" : {"Type":"String","Value":"EKS_RESTORE_OBJECT_FAILED"},
"clusterName" : {"Type":"String","Value":"eks-restore-target-cluster-name"},
"parentRestoreJobId" : {"Type":"String","Value":"12345678-abcd-123a-def0-abcd1a234567"},
"reason" : {"Type":"String","Value":"Example failure reason."},
"resourceName" : {"Type":"String","Value":"exampleresourceio"},
"resourceType" : {"Type":"String","Value":"apiextensions.k8s.io/v1/customresourcedefinitions"},
"restoreJobId" : {"Type":"String","Value":"1b2345b2-f22c-4dab-5eb6-bbc7890ed123"}
}
}
}]
}
```
**Example: EKS restore object skipped**
```
{
"Records": [{
"EventSource": "aws:sns",
"EventVersion": "1.0",
"EventSubscriptionArn": "arn:aws:sns:...-a3802aa1ed45",
"Sns": {
"Type": "Notification",
"MessageId": "12345678-abcd-123a-def0-abcd1a234567",
"TopicArn": "arn:aws:sns:us-west-1:123456789012:backup-2sqs-sns-topic",
"Subject": "Notification from AWS Backup",
"Message": "A Kubernetes resource was skipped from restore from your Amazon EKS Backup. This Kubernetes resource already exists in your target EKS cluster. Resource: apiextensions.k8s.io/v1/customresourcedefinitions. Resource Name: exampleresource. Destination EKS Cluster Name: eks-restore-target-cluster-name. RestoreJob ID: 1b2345b2-f22c-4dab-5eb6-bbc7890ed123",
"Timestamp": "2025-05-25T18:46:02.788Z",
...
"MessageAttributes" : {
"eventType" : {"Type":"String","Value":"EKS_RESTORE_OBJECT_SKIPPED"},
"clusterName" : {"Type":"String","Value":"eks-restore-target-cluster-name"},
"parentRestoreJobId" : {"Type":"String","Value":"12345678-abcd-123a-def0-abcd1a234567"},
"reason" : {"Type":"String","Value":"Already exists."},
"resourceName" : {"Type":"String","Value":"exampleresource"},
"resourceType" : {"Type":"String","Value":"apiextensions.k8s.io/v1/customresourcedefinitions"},
"restoreJobId" : {"Type":"String","Value":"1b2345b2-f22c-4dab-5eb6-bbc7890ed123"}
}
}
}]
}
```
### AWS Backup notification command examples
You can use AWS CLI commands to subscribe to, list, and delete Amazon SNS notifications for your AWS Backup events.
#### Example put backup vault notification
The following command subscribes to an Amazon SNS topic for the specified backup vault that notifies you when a restore job is started or completed, or when a recovery point is modified.
```
aws backup put-backup-vault-notifications
--backup-vault-name myBackupVault
--sns-topic-arn arn:aws:sns:region:account-id:myBackupTopic
--backup-vault-events RESTORE_JOB_STARTED RESTORE_JOB_COMPLETED RECOVERY_POINT_MODIFIED
```
#### Example get backup vault notification
The following command lists all events currently subscribed to an Amazon SNS topic for the specified backup vault.
```
aws backup get-backup-vault-notifications
--backup-vault-name myVault
```
The sample output is as follows:
```
{
"SNSTopicArn": "arn:aws:sns:region:account-id:myBackupTopic",
"BackupVaultEvents": [
"RESTORE_JOB_STARTED",
"RESTORE_JOB_COMPLETED",
"RECOVERY_POINT_MODIFIED"
],
"BackupVaultName": "myVault",
"BackupVaultArn": "arn:aws:backup:region:account-id:backup-vault:myVault"
}
```
#### Example delete backup vault notification
The following command unsubscribes from an Amazon SNS topic for the specified backup vault.
```
aws backup delete-backup-vault-notifications
--backup-vault-name myVault
```
### Specifying AWS Backup as a service principal
**Note**
To allow AWS Backup to publish SNS topics on your behalf, you must specify AWS Backup as a service principal.
Include the following JSON in the access policy of the Amazon SNS topic that you use to track AWS Backup events. You must specify the resource Amazon Resource Name (ARN) of your topic.
```
{
"Sid": "My-statement-id",
"Effect": "Allow",
"Principal": {
"Service": "backup.amazonaws.com"
},
"Action": "SNS:Publish",
"Resource": "arn:aws:sns:region:account-id:myTopic"
}
```
For more information about specifying a service principal in an Amazon SNS access policy, see [Allowing Any AWS Resource to Publish to a Topic](https://docs.aws.amazon.com/sns/latest/dg/AccessPolicyLanguage_UseCases_Sns.html#AccessPolicyLanguage_UseCase4_Sns) in the *Amazon Simple Notification Service Developer Guide*.
**Note**
If your topic is encrypted, you must include additional permissions in your policy to allow AWS Backup to publish to it. For more information about enabling services to publish to encrypted topics, see [Enable Compatibility between Event Sources from AWS Services and Encrypted Topics](https://docs.aws.amazon.com//sns/latest/dg/sns-key-management.html#sns-what-permissions-for-sse) in the *Amazon Simple Notification Service Developer Guide*.