AWS aws-backup documentation change
Summary
Added malware scanning context, API references, and migration guidance enhancements
Security assessment
The addition of 'malware scanning' in lifecycle management and explicit documentation about scanning limitations indicates enhanced security controls. However, there is no evidence this addresses an existing vulnerability.
Diff
diff --git a/aws-backup/latest/devguide/lag-vault-primary-backup.md b/aws-backup/latest/devguide/lag-vault-primary-backup.md index c65ce8d66..cfac22a8d 100644 --- a//aws-backup/latest/devguide/lag-vault-primary-backup.md +++ b//aws-backup/latest/devguide/lag-vault-primary-backup.md @@ -28 +28 @@ We recommend integrating your logically air-gapped vaults with [Multi-party appr -There is no new pricing for this feature. You are only charged for backups stored in logically air-gapped vaults and for temporary snapshots (during their retention period in the system) for applicable resources at prevailing rates. See AWS Backup pricing for storage pricing. +There is no new pricing for this feature. You are only charged for backups stored in logically air-gapped vaults and for temporary snapshots (during their retention period in the system) for applicable resources at prevailing rates. See [AWS Backup pricing](https://aws.amazon.com/backup/pricing/) for details. @@ -78 +78 @@ Resources not currently supported for this feature may have their support enable - * **Restore testing, and indexing** – Restore testing, and recovery point indexing will ignore temporary recovery points with a `DELETE_AFTER_COPY` lifecycle. + * **Restore testing, indexing, and scanning** – Restore testing, recovery point indexing, and malware scanning will ignore temporary recovery points with a `DELETE_AFTER_COPY` lifecycle. Recovery point indexing does not support recovery points in logically air-gapped vault. Malware scanning does not support scheduled scans of copied recovery points, which includes automatic copies taken as part of primary backups to logically air-gapped vault. @@ -160 +160 @@ Console - 1. Open the AWS Backup console at [https://console.aws.amazon.com/backup](https://console.aws.amazon.com/backup). + 1. Open the AWS Backup console at [https://console.aws.amazon.com/backup](https://console.aws.amazon.com//backup). @@ -219 +219 @@ Console - 1. Open the AWS Backup console at [https://console.aws.amazon.com/backup](https://console.aws.amazon.com/backup). + 1. Open the AWS Backup console at [https://console.aws.amazon.com/backup](https://console.aws.amazon.com//backup). @@ -255 +255 @@ You can monitor the status of your backups and copy jobs using the AWS Backup co -Monitor backup job status to ensure your resources remain protected. A failed backup job indicates no recovery point was created. +Monitor backup job status ([`DescribeBackupJob`](https://docs.aws.amazon.com/aws-backup/latest/devguide/API_DescribeBackupJob.html)) to ensure your resources remain protected. A failed backup job indicates no recovery point was created. @@ -268 +268 @@ Monitor backup job status to ensure your resources remain protected. A failed ba -Monitor copy jobs to your logically air-gapped vault for failures. A failed copy job means your recovery point remains in your standard backup vault without logically air-gapped vault protection. +Monitor copy jobs ([`ListCopyJobs`](https://docs.aws.amazon.com/aws-backup/latest/devguide/API_ListCopyJobs.html)) to your logically air-gapped vault for failures. A failed copy job means your recovery point remains in your standard backup vault without logically air-gapped vault protection. @@ -272 +272 @@ Monitor copy jobs to your logically air-gapped vault for failures. A failed copy - * **Verify copies for a source recovery point** \- Use the `ListCopyJobs` API with the new `BySourceRecoveryPointArn` filter to find all copy jobs associated with a specific recovery point, including both automatic copies to your logically air-gapped vault and scheduled copies to other destinations. + * **Verify copies for a source recovery point** \- Use the [`ListCopyJobs`](https://docs.aws.amazon.com/aws-backup/latest/devguide/API_ListCopyJobs.html) API with the new `BySourceRecoveryPointArn` filter to find all copy jobs associated with a specific recovery point, including both automatic copies to your logically air-gapped vault and scheduled copies to other destinations. @@ -285 +285 @@ Copy job records expire and are removed 30 days after they finish. After this pe -Monitor for `EXPIRED` recovery points, which may indicate AWS Backup could not delete them (possibly due to missing permissions). `EXPIRED` recovery points can have cost implications. +Monitor for `EXPIRED` recovery points ([`ListRecoveryPointsByBackupVault`](https://docs.aws.amazon.com/aws-backup/latest/devguide/API_ListRecoveryPointsByBackupVault.html)), which may indicate AWS Backup could not delete them (possibly due to missing permissions). `EXPIRED` recovery points can have cost implications. @@ -296 +296 @@ Monitor for `EXPIRED` recovery points, which may indicate AWS Backup could not d -If you currently use copy actions to copy backups to a logically air-gapped vault, you can migrate to logically air-gapped vault primary backup to reduce costs. This guide explains the prerequisites and steps required to migrate to the logically air-gapped vault primary backup feature. +If you currently use copy actions to copy backups to a logically air-gapped vault, you can migrate to logically air-gapped vault primary backup to reduce costs. You can also migrate your existing Amazon S3 continuous backups from a backup vault to a logically air-gapped vault. This guide explains the prerequisites and steps required to migrate to the logically air-gapped vault primary backup feature.