AWS aws-backup documentation change
Summary
Updated documentation for logically air-gapped vaults to support primary backups (not just copies), added encryption key configuration during vault creation, expanded unsupported regions list, and clarified encryption requirements for backups.
Security assessment
The changes enhance security documentation by explicitly requiring encryption key selection during vault creation (step 9) and recommending AWS-owned keys. They also clarify that logically air-gapped vaults always use compliance-mode vault locking. However, there's no evidence of a specific security vulnerability being patched.
Diff
diff --git a/aws-backup/latest/devguide/logicallyairgappedvault.md b/aws-backup/latest/devguide/logicallyairgappedvault.md index c58e35ba3..edea39a9a 100644 --- a//aws-backup/latest/devguide/logicallyairgappedvault.md +++ b//aws-backup/latest/devguide/logicallyairgappedvault.md @@ -5 +5 @@ -Overview of logically air-gapped vaultsUse case for logically air-gapped vaultsCompare and contrast with a standard backup vaultCreate a logically air-gapped vaultView logically air-gapped vault detailsCopy to a logically air-gapped vaultShare a logically air-gapped vaultRestore a backup from a logically air-gapped vaultDelete a logically air-gapped vaultAdditional programmatic options for logically air-gapped vaultsUnderstanding encryption key types for logically air-gapped vaultsTroubleshoot a logically air-gapped vault issue +Overview of logically air-gapped vaultsUse case for logically air-gapped vaultsCompare and contrast with a standard backup vaultCreate a logically air-gapped vaultView logically air-gapped vault detailsCreating backups in a logically air-gapped vaultShare a logically air-gapped vaultRestore a backup from a logically air-gapped vaultDelete a logically air-gapped vaultAdditional programmatic options for logically air-gapped vaultsUnderstanding encryption key types for logically air-gapped vaultsTroubleshoot a logically air-gapped vault issue @@ -11 +11 @@ Overview of logically air-gapped vaultsUse case for logically air-gapped vaultsC -AWS Backup offers a secondary type of vault which can store copies of backups in a container with additional security features. A **logically air-gapped vault** is a specialized vault which provides increased security beyond a standard backup vault, as well as the ability to share vault access to other accounts so that recovery time objectives (RTOs) can be faster and more flexible in case of an incident that requires rapid restoration of resources. +AWS Backup offers a secondary type of vault which can store backups in a container with additional security features. A **logically air-gapped vault** is a specialized vault which provides increased security beyond a standard backup vault, as well as the ability to share vault access to other accounts so that recovery time objectives (RTOs) can be faster and more flexible in case of an incident that requires rapid restoration of resources. @@ -13 +13 @@ AWS Backup offers a secondary type of vault which can store copies of backups in -Logically air-gapped vaults come equipped with additional protection features; each vault is encrypted with either an [AWS owned key](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-mgmt) (default) or optionally with a customer-managed KMS key, and each vault is equipped with [AWS Backup Vault Lock](https://docs.aws.amazon.com/aws-backup/latest/devguide/vault-lock.html)'s compliance mode. The encryption key type information is visible through AWS Backup APIs and console for transparency and compliance reporting. +Logically air-gapped vaults come equipped with additional protection features; each vault is encrypted with either an [AWS owned key](https://docs.aws.amazon.com//kms/latest/developerguide/concepts.html#key-mgmt) (default) or optionally with a customer-managed KMS key, and each vault is equipped with [AWS Backup Vault Lock](https://docs.aws.amazon.com/aws-backup/latest/devguide/vault-lock.html)'s compliance mode. The encryption key type information is visible through AWS Backup APIs and console for transparency and compliance reporting. @@ -33 +33 @@ See [Feature availability by resource](./backup-feature-availability.html#featur - * Copy to a logically air-gapped vault + * Creating backups in a logically air-gapped vault @@ -73 +73 @@ A logically air-gapped vault is a secondary vault that serves as part of a data - * Amazon EC2 offers [EC2 Allowed AMIs](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-allowed-amis.html). If this setting is enabled in your account, add the alias `aws-backup-vault` to your allowlist. + * Amazon EC2 offers [EC2 Allowed AMIs](https://docs.aws.amazon.com//AWSEC2/latest/UserGuide/ec2-allowed-amis.html). If this setting is enabled in your account, add the alias `aws-backup-vault` to your allowlist. @@ -88 +88 @@ A **backup vault** is the primary and standard type of vault used in AWS Backup. -A **logically air-gapped vault** is a specialized vault with additional security and flexible sharing for faster recovery time (RTO). This vault stores copies of backups that were initially created and stored within a standard backup vault. +A **logically air-gapped vault** is a specialized vault with additional security and flexible sharing for faster recovery time (RTO). This vault stores primary backups or copies of backups that were initially created and stored within a standard backup vault. @@ -98,5 +98,3 @@ Feature | Backup vault | Logically air-gapped vault -[AWS Backup Audit Manager](./aws-backup-audit-manager.html) | You can use AWS Backup Audit Manager [Controls and remediation](./controls-and-remediation.html) to monitor your backup vaults. | Ensure a copy of a backup of a specific resource has been copied to [at least one logically air-gapped vault](./controls-and-remediation.html#resources-in-lag-vault-control) on a schedule you determine, in addition to controls available to standard vaults. -[ Backup creation](https://docs.aws.amazon.com/aws-backup/latest/devguide/creating-a-backup.html) | When a backup is created, it is stored as a recovery point. | Backups are not stored in this vault upon creation. -[ Backup storage](https://docs.aws.amazon.com/aws-backup/latest/devguide/vaults.html) | Can store initial backups of resources and copies of backups | Can store copies of backups from other vaults -Billing | Storage and data transfer charges for resources fully managed by AWS Backup occur under "AWS Backup". Other resource type storage and data transfer charges will occur under their respective services. For example, Amazon EBS backups will show under "Amazon EBS"; Amazon S3 backups will show under "AWS Backup". | All billing charges from these vaults (storage or data transfer) occur under "AWS Backup". -[Regions](https://docs.aws.amazon.com/aws-backup/latest/devguide/whatisbackup.html#features-by-region) | Available in all Regions in which AWS Backup operates | Available in most Regions supported by AWS Backup. Not currently available in Asia Pacific (Malaysia), Canada West (Calgary), China (Beijing), China (Ningxia), AWS GovCloud (US-East), or AWS GovCloud (US-West). +[AWS Backup Audit Manager](./aws-backup-audit-manager.html) | You can use AWS Backup Audit Manager [Controls and remediation](./controls-and-remediation.html) to monitor your backup vaults. | Ensure a backup of a specific resource is stored in [at least one logically air-gapped vault](./controls-and-remediation.html#resources-in-lag-vault-control) on a schedule you determine, in addition to controls available to standard vaults. +[Billing](https://aws.amazon.com/backup/pricing/) | Storage and data transfer charges for resources fully managed by AWS Backup occur under "AWS Backup". Other resource type storage and data transfer charges will occur under their respective services. For example, Amazon EBS backups will show under "Amazon EBS"; Amazon S3 backups will show under "AWS Backup". | All billing charges from these vaults (storage or data transfer) occur under "AWS Backup". +[Regions](https://docs.aws.amazon.com/aws-backup/latest/devguide/whatisbackup.html#features-by-region) | Available in all Regions in which AWS Backup operates | Available in most Regions supported by AWS Backup. Not currently available in Asia Pacific (Malaysia), Canada West (Calgary), Mexico (Central), Asia Pacific (Thailand), Asia Pacific (Taipei), Asia Pacific (New Zealand), China (Beijing), China (Ningxia), AWS GovCloud (US-East), or AWS GovCloud (US-West). @@ -105 +103 @@ Billing | Storage and data transfer charges for resources fully managed by AWS B -[Security](https://docs.aws.amazon.com/aws-backup/latest/devguide/security-considerations.html) | Can optionally be encrypted with a key (customer managed or AWS managed) Can optionally use a vault lock in compliance or governance mode | Can be encrypted with an [AWS owned key](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-mgmt) or a customer managed key Is always locked with a [ vault lock](https://docs.aws.amazon.com/aws-backup/latest/devguide/vault-lock.html) in compliance mode Encryption key type information is preserved and visible when vaults are shared through AWS RAM or MPA +[Security](https://docs.aws.amazon.com/aws-backup/latest/devguide/security-considerations.html) | Can optionally be encrypted with a key (customer managed or AWS managed) Can optionally use a vault lock in compliance or governance mode | Can be encrypted with an [AWS owned key](https://docs.aws.amazon.com//kms/latest/developerguide/concepts.html#key-mgmt) or a customer managed key Is always locked with a [ vault lock](https://docs.aws.amazon.com/aws-backup/latest/devguide/vault-lock.html) in compliance mode Encryption key type information is preserved and visible when vaults are shared through AWS RAM or MPA @@ -141 +139 @@ This value (in days, months, or years) is the longest amount of time a backup ca - 9. _(Optional)_ Add tags that will help you search for and identify your logically air-gapped vault. For example, you could add a `BackupType:Financial` tag. + 9. _(Optional)_ Set the **Encryption key**. @@ -143 +141 @@ This value (in days, months, or years) is the longest amount of time a backup ca - 10. Select **Create vault**. +Specify the key to use with your vault. You can choose an **AWS owned key (managed by AWS Backup)** or enter the ARN for a **Customer managed key** that preferably belongs to a different account to which you have access. AWS Backup recommends using an AWS owned key. @@ -145 +143 @@ This value (in days, months, or years) is the longest amount of time a backup ca - 11. Review the settings. If all settings show as you intended, select **Create logically air-gapped vault**. + 10. _(Optional)_ Add tags that will help you search for and identify your logically air-gapped vault. For example, you could add a `BackupType:Financial` tag. @@ -147 +145 @@ This value (in days, months, or years) is the longest amount of time a backup ca - 12. The console will take you to the details page of your new vault. Verify the vault details are as expected. + 11. Select **Create vault**. @@ -149 +147,5 @@ This value (in days, months, or years) is the longest amount of time a backup ca - 13. Select **Vaults** to view vaults in your account. Your logically air-gapped vault will be displayed. The KMS key will be available approximately 1 to 3 minutes after the vault creation. Refresh the page to see the associated key. Once the key is visible, the vault is in an available state and can be used. + 12. Review the settings. If all settings show as you intended, select **Create logically air-gapped vault**. + + 13. The console will take you to the details page of your new vault. Verify the vault details are as expected. + + 14. Select **Vaults** to view vaults in your account. Your logically air-gapped vault will be displayed. The KMS key will be available approximately 1 to 3 minutes after the vault creation. Refresh the page to see the associated key. Once the key is visible, the vault is in an available state and can be used. @@ -210 +212 @@ Console - 3. Below the descriptions of vaults will be two lists, **Vaults owned by this account** and **Vaults shared with this account**. Select the desired tab to view the vaults. + 3. Below the descriptions of vaults will be three lists, **Vaults created by this account** , **Vaults shared through RAM** , and **Vaults accessible through Multi-party approval**. Select the desired tab to view the vaults. @@ -247 +249 @@ Example of response: -## Copy to a logically air-gapped vault +## Creating backups in a logically air-gapped vault @@ -249 +251 @@ Example of response: -Logically air-gapped vaults can only be a copy job destination target in a backup plan or a target for an on-demand copy job. +Logically air-gapped vaults can be a copy job destination target in a backup plan or a target for an on-demand copy job. It can also be used as a primary backup target. See [Primary backups to logically air-gapped vaults](./lag-vault-primary-backup.html). @@ -255 +257 @@ A successful copy job from a backup vault to a logically air-gapped vault requir -When you copy a backup of a [fully managed resource type](./backup-feature-availability.html#features-by-resource), the source backup in the (standard backup vault) can be encrypted by a customer managed key or by an AWS managed key. +When you create or copy a backup of a [fully managed resource type](./backup-feature-availability.html#features-by-resource), the source resource can be encrypted by a customer managed key or by an AWS managed key. @@ -257 +259 @@ When you copy a backup of a [fully managed resource type](./backup-feature-avail -When you copy a backup of other resource types (ones [not fully managed](./backup-feature-availability.html#features-by-resource)), the backup must be encrypted with a customer managed key. AWS managed keys for the resource types are not supported for copies. +When you create or copy a backup of other resource types (ones [not fully managed](./backup-feature-availability.html#features-by-resource)), the source must be encrypted with a customer managed key. AWS managed keys for not fully managed resources are not supported. @@ -259 +261 @@ When you copy a backup of other resource types (ones [not fully managed](./backu -**Copy to a logically air-gapped vault through a backup plan** +**Create or copy backups to a logically air-gapped vault through a backup plan** @@ -261 +263 @@ When you copy a backup of other resource types (ones [not fully managed](./backu -You can copy a backup (recovery point) from a standard backup vault to a logically air-gapped vault by [creating a new backup plan](./creating-a-backup-plan.html) or [updating an existing one](./updating-a-backup-plan.html) in the AWS Backup console or through the AWS CLI commands [`create-backup-plan`](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/backup/create-backup-plan.html) and [`update-backup-plan`](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/backup/update-backup-plan.html). +You can copy a backup (recovery point) from a standard backup vault to a logically air-gapped vault by [creating a new backup plan](./creating-a-backup-plan.html) or [updating an existing one](./updating-a-backup-plan.html) in the AWS Backup console or through the AWS CLI commands [`create-backup-plan`](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/backup/create-backup-plan.html) and [`update-backup-plan`](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/backup/update-backup-plan.html). You can also create backups directly in a logically air-gapped vault by using it as a primary target. See [Primary backups to logically air-gapped vaults](./lag-vault-primary-backup.html) for more details.