Logically air-gapped vault

Overview of logically air-gapped vaults

AWS Backup offers a secondary type of vault which can store backups in a container with additional security features. A logically air-gapped vault is a specialized vault which provides increased security beyond a standard backup vault, as well as the ability to share vault access to other accounts so that recovery time objectives (RTOs) can be faster and more flexible in case of an incident that requires rapid restoration of resources.

Logically air-gapped vaults come equipped with additional protection features; each vault is encrypted with either an AWS owned key (default) or optionally with a customer-managed KMS key, and each vault is equipped with AWS Backup Vault Lock's compliance mode. The encryption key type information is visible through AWS Backup APIs and console for transparency and compliance reporting.

You can integrate your logically air-gapped vaults with Multi-party approval (MPA) to enable recovery of backups in the vaults even if the vault-owning account is inaccessible, which helps to maintain business continuity. Further more, you can choose to integrate with AWS Resource Access Manager (RAM) to share a logically air-gapped vault with other AWS accounts (including accounts in other organizations) so that the backups stored within the vault can be restored from an account with which the vault is shared, if needed for data loss recovery or restore testing. As part of this added security, a logically air-gapped vault stores its backups in an AWS Backup service owned account (which results in backups shown as shared outside your organization in modify attribute items in AWS CloudTrail logs).

In the scenario where your logically air-gapped vault owning account is closed (maliciously or otherwise), you can still access backups in the vault (restore or copy them) via MPA until the post-closure period ends. After the post-closure period expires, the backups are no longer accessible. During the post-closure period, you can reference the AWS Account Management documentation to regain control of your account while working on recovery.

For greater resiliency, we recommend creating cross-Region copies in logically air-gapped vaults in same or separate accounts. However, if you want to reduce storage costs by maintaining just a single copy, you can use Primary backups to logically air-gapped vaults, after onboarding to AWS MPA.

You can view the storage pricing for backups of supported services in a logically air-gapped vault on the AWS Backup pricing page.

See Feature availability by resource for resource types you can copy to a logically air-gapped vault.

Use case for logically air-gapped vaults

A logically air-gapped vault is a secondary vault that serves as part of a data protection strategy. This vault can help enhance your organization's retention strategy and recovery when you desire a vault for your backups that

Considerations and limitations

Compare and contrast with a standard backup vault

A backup vault is the primary and standard type of vault used in AWS Backup. Each backup is stored in a backup vault when the backup is created. You can assign resource-based policies to manage backups stored in the vault, such as the lifecycle of backups stored within the vault.

A logically air-gapped vault is a specialized vault with additional security and flexible sharing for faster recovery time (RTO). This vault stores primary backups or copies of backups that were initially created and stored within a standard backup vault.

Backup vaults are encrypted with a key, a security mechanism that limits access to intended users. These keys can be customer managed or AWS managed. See Copy encryption for encryption behavior during copy jobs, including copying into a logically air-gapped vault.

Additionally, a backup vault can have additional security through a vault lock; logically air-gapped vaults come equipped by a vault lock in compliance mode.

Similar to backup vaults, logically air-gapped vaults also support restricted tags for Amazon EC2 backups.

Create a logically air-gapped vault

You can create a logically air-gapped vault either through the AWS Backup console or through a combination of AWS Backup and AWS RAM CLI commands.

Each logically air-gapped comes equipped with a vault lock in compliance mode. See AWS Backup Vault Lock to help determine the retention period values most appropriate for your operation

Console

Create a logically air-gapped vault from the console

1. Open the AWS Backup console at https://console.aws.amazon.com/backup.

2. In the navigation pane, select Vaults.

3. Both types of vaults will be displayed. Select Create new vault.

4. Enter a name for your backup vault. You can name your vault to reflect what you will store in it, or to make it easier to search for the backups you need. For example, you could name it FinancialBackups.

5. Select the radio button for Logically air-gapped vault.

6. (Optional) Choose an encryption key. You can select a customer-managed KMS key for additional control over encryption, or use the default AWS-owned key (recommended).

7. Set the Minimum retention period.

   This value (in days, months, or years) is the shortest amount of time a backup can be retained in this vault. Backups with retention periods shorter than this value cannot be copied to this vault.

   The minimum value allowed is 7 days. Values for months and years meet this minimum.

8. Set the Maximum retention period.

   This value (in days, months, or years) is the longest amount of time a backup can be retained in this vault. Backups with retention periods greater than this value cannot be copied to this vault.

9. (Optional) Set the Encryption key.

   Specify the key to use with your vault. You can choose an AWS owned key (managed by AWS Backup) or enter the ARN for a Customer managed key that preferably belongs to a different account to which you have access. AWS Backup recommends using an AWS owned key.

10. (Optional) Add tags that will help you search for and identify your logically air-gapped vault. For example, you could add a BackupType:Financial tag.

11. Select Create vault.

12. Review the settings. If all settings show as you intended, select Create logically air-gapped vault.

13. The console will take you to the details page of your new vault. Verify the vault details are as expected.

14. Select Vaults to view vaults in your account. Your logically air-gapped vault will be displayed. The KMS key will be available approximately 1 to 3 minutes after the vault creation. Refresh the page to see the associated key. Once the key is visible, the vault is in an available state and can be used.

AWS CLI

Create a logically air-gapped vault from CLI

You can use AWS CLI to programmatically carry out operations for logically air-gapped vaults. Each CLI is specific to the AWS service in which it originates. Commands related to sharing are prepended with aws ram; all other commands should be prepended with aws backup.

Use the CLI command create-logically-air-gapped-backup-vault, modified with the following parameters:

aws backup create-logically-air-gapped-backup-vault
--region us-east-1 // optional
--backup-vault-name sampleName // required
--min-retention-days 7 // required Value must be an integer 7 or greater
--max-retention-days 35 // required
--encryption-key-arn arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012 // optional
--creator-request-id 123456789012-34567-8901 // optional

The optional --encryption-key-arn parameter allows you to specify a customer-managed KMS key for vault encryption. If not provided, the vault will use an AWS-owned key.

Example CLI command to create a logically air-gapped vault:

aws backup create-logically-air-gapped-backup-vault
--region us-east-1
--backup-vault-name sampleName
--min-retention-days 7
--max-retention-days 35
--creator-request-id 123456789012-34567-8901 // optional

Example CLI command to create a logically air-gapped vault with customer-managed encryption:

aws backup create-logically-air-gapped-backup-vault
--region us-east-1
--backup-vault-name sampleName
--min-retention-days 7
--max-retention-days 35
--encryption-key-arn arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012
--creator-request-id 123456789012-34567-8901 // optional

See CreateLogicallyAirGappedBackupVault API response elements for information after the create operation. If the operation was successful, the new logically air-gapped vault will have the VaultState of CREATING.

Once the creation is complete and the KMS encrypted key has been assigned, the VaultState will transition to AVAILABLE. Once available, the vault can be used. VaultState can be retrieved by calling DescribeBackupVault or ListBackupVaults.

View logically air-gapped vault details

You can see the vault details such as summary, the recovery points, the protected resources, account sharing, access policy, and tags through the AWS Backup console or the AWS Backup CLI.

Console

1. Open the AWS Backup console at https://console.aws.amazon.com/backup.

2. Select Vaults from the left-hand navigation.

3. Below the descriptions of vaults will be three lists, Vaults created by this account, Vaults shared through RAM, and Vaults accessible through Multi-party approval. Select the desired tab to view the vaults.

4. Under Vault name, click on the name of the vault to open the details page. You can see the summary, the recovery points, the protected resources, account sharing, access policy, and tag details.

   Details display depending on account type: Accounts which own a vault can view account sharing; accounts which do not own a vault will not be able to view account sharing. For shared vaults, the encryption key type (AWS-owned or customer-managed KMS key) is displayed in the vault summary.

AWS CLI

View details of a logically air-gapped vault through CLI

The CLI command describe-backup-vault can be used to obtain details about a vault. Parameter backup-vault-name is required; region is optional.

aws backup describe-backup-vault
--region us-east-1
--backup-vault-name testvaultname

Example of response:

{
            "BackupVaultName": "LOG-AIR-GAP-VAULT-TEST",
            "BackupVaultArn": "arn:aws:backup:us-east-1:234567890123:backup-vault:IAD-LAGV-01",
            "VaultType": "LOGICALLY_AIR_GAPPED_BACKUP_VAULT",
            "EncryptionKeyType": "AWS_OWNED_KMS_KEY",
            "CreationDate": "2024-07-25T16:05:23.554000-07:00",
            "NumberOfRecoveryPoints": 0,
            "Locked": true,
            "MinRetentionDays": 8,
            "MaxRetentionDays": 30,
            "LockDate": "2024-07-25T16:05:23.554000-07:00"
}

Note

The VaultType field is not included in the API response in regions where logically air-gapped vaults are not available.

Creating backups in a logically air-gapped vault

Logically air-gapped vaults can be a copy job destination target in a backup plan or a target for an on-demand copy job. It can also be used as a primary backup target. See Primary backups to logically air-gapped vaults.

Compatible encryption

A successful copy job from a backup vault to a logically air-gapped vault requires an encryption key that is determined by the resource type being copied.

When you create or copy a backup of a fully managed resource type, the source resource can be encrypted by a customer managed key or by an AWS managed key.

When you create or copy a backup of other resource types (ones not fully managed), the source must be encrypted with a customer managed key. AWS managed keys for not fully managed resources are not supported.

Create or copy backups to a logically air-gapped vault through a backup plan

You can copy a backup (recovery point) from a standard backup vault to a logically air-gapped vault by creating a new backup plan or updating an existing one in the AWS Backup console or through the AWS CLI commands create-backup-plan and update-backup-plan. You can also create backups directly in a logically air-gapped vault by using it as a primary target. See Primary backups to logically air-gapped vaults for more details.

You can copy a backup from one logically air-gapped vault to another logically air-gapped vault on-demand (this type of backup cannot be scheduled in a backup plan). You can copy a backup from a logically air-gapped vault to a standard backup vault as long as the copy is encrypted with a customer managed key.

On-demand backup copy to a logically air-gapped vault

To create a one-time on-demand copy of a backup to a logically air-gapped vault, you can copy from a standard backup vault. Cross-Region or cross-account copies are available if the resource type supports the copy type.

Copy availability

A copy of a backup can be created from the account to which the vault belongs. Accounts with which the vault has been shared have the ability to view or a restore a backup, but not to create a copy.

Only resource types that support cross-Region or cross-account copy can be included.

Console

1. Open the AWS Backup console at https://console.aws.amazon.com/backup.

2. Select Vaults from the left-hand navigation.

3. In the vault detail page, all recovery points within that vault are displayed. Place a check mark next to the recovery point you wish to copy.

4. Select Actions, and then select Copy from the drop-down menu.

5. On the next screen, input the details of the destination.

   1. Specify the destination Region.

   2. Destination backup vault drop-down menu displays eligible destination vaults. Select one with the type logically air-gapped vault

6. Select Copy once all details are set to your preferences.

On the Jobs page in the console, you can select Copy jobs to see current copy jobs.

AWS CLI

Use start-copy-job to copy an existing backup in a backup vault to a logically air-gapped vault.

Sample CLI input:

aws backup start-copy-job
--region us-east-1
--recovery-point-arn arn:aws:resourcetype:region::snapshot/snap-12345678901234567
--source-backup-vault-name sourcevaultname
--destination-backup-vault-arn arn:aws:backup:us-east-1:123456789012:backup-vault:destinationvaultname
--iam-role-arn arn:aws:iam::123456789012:role/service-role/servicerole

For more information, see Copying a backup, cross-Region backup, and Cross-account backup.

Share a logically air-gapped vault

You can use AWS Resource Access Manager (RAM) to share a logically air-gapped vault with other accounts you designate. When sharing vaults, the encryption key type information (AWS-owned or customer-managed KMS key) is preserved and visible to accounts with which the vault is shared.

A vault can be shared with individual AWS account IDs only. You can share with an account in your organization or with an account in another organization. The vault cannot be shared with an entire organization or with organizational units (OUs) — only individual account IDs are supported as share principals.

Only accounts with specific IAM privileges can share and manage the sharing of vaults.

To share using AWS RAM, ensure you have the following:

Console

1. Open the AWS Backup console at https://console.aws.amazon.com/backup.

2. Select Vaults from the left-hand navigation.

3. Below the descriptions of vaults will be two lists, Vaults owned by this account and Vaults shared with this account. Vaults owned by the account are eligible to be shared.

4. Under Vault name, select the name of the logically air-gapped vault to open the details page.

5. The Account sharing pane shows with which accounts the vault is being shared.

6. To begin sharing with another account or to edit accounts already being shared, select Manage sharing.

7. The AWS RAM console opens when Manage sharing is selected. For steps to share a resource using AWS RAM, see Creating a resource share in AWS RAM in the AWS RAM User Guide.

8. The account invited to accept an invitation to receive a share has 12 hours to accept the invitation. See Accepting and rejecting resource share invitations in the AWS RAM User Guide.

9. If the sharing steps are completed and accepted, the vault summary page will show under Account sharing = “Shared - see account sharing table below”.

AWS CLI

AWS RAM uses the CLI command create-resource-share. The access to this command is only available to accounts with sufficient permissions. See Creating a resource share in AWS RAM for CLI steps.