Guide to Configure NTC Backup
Getting centralized backup running touches three stacks: NTC Account Factory (to create the backup account and roll out the member-account side), NTC Organizations (to delegate backup administration and policy management to that account), and the backup account's own NTC Backup stack. This guide walks through all three, in order.
1. Account Factory
1a. Create the Backup Account
Add the backup account to your account list, the same way you'd add any other core account. It belongs alongside your other centralized-service accounts (Security, Log Archive, Connectivity) - see Organizational Structure.
{
"account_name": "aws-example-backup",
"account_email": "accounts+aws-example-backup@example.com",
"ou_path": "/root/core",
"close_on_deletion": false,
"account_tags": {
"AccountOwner": "platform-team@example.com",
"AccountAlias": "example-backup",
"AccountType": "core",
"AccountDescription": "This account manages the centralized backup vault",
"AccountDecommission": false,
"ManagedBy": "OpenTofu",
"ProvisionedBy": "mgmt-account-factory"
},
"alternate_contacts": [
{
"type": "SECURITY",
"name": "Security Operation Center",
"email_address": "security@example.com"
}
],
"customer_values": {
"additional_oidc_subjects": []
}
}
1b. Apply the Backup Baseline Template
Every member account that should be backed up needs the backup account baseline template applied first. It creates the local vault, its KMS key, and the two IAM roles (operator and restorer) that NTC Backup and the central account rely on. Add it to whichever account_baseline_scopes cover your target accounts/OUs:
Apply order matters
This template's central_backup_account_id (below) resolves the backup account's own account ID via ntc-parameters - that parameter only exists once the backup account has actually been created (step 1a above). Adding the account definition and this baseline template config in the same apply fails, since there's no account ID yet for ntc-parameters to resolve. Apply step 1a first, then apply this baseline template change in a separate, subsequent apply.
module "ntc_account_factory" {
source = "github.com/nuvibit-terraform-collection/terraform-aws-ntc-account-factory?ref=X.X.X"
# ...other account factory configuration
# -----------------------------------------------------------------------------------------------------------------
# ACCOUNT BASELINE SCOPES - Roll Out the Backup Template
# -----------------------------------------------------------------------------------------------------------------
account_baseline_scopes = [
{
scope_name = "workload-accounts"
# ...other scope configuration
baseline_terraform_files = [
# ...your other baseline templates (iam_role, aws_config, tfstate_backend, ...)
module.account_baseline_templates.account_baseline_terraform_files["backup"],
]
}
]
}
module "account_baseline_templates" {
source = "github.com/nuvibit-terraform-collection/terraform-aws-ntc-account-baseline-templates?ref=X.X.X"
account_baseline_templates = [
# -----------------------------------------------------------------------------------------------------------------
# AWS Backup - Local Vault per Baseline Region
# -----------------------------------------------------------------------------------------------------------------
# PURPOSE: Create a local AWS Backup vault (with its own KMS key) in every baseline region, ready to
# back up resources locally and copy recovery points to a central backup account
#
# WHAT IT DOES:
# - Creates one AWS Backup vault + KMS key per region in 'baseline_regions' (always, no override)
# - Creates an OPERATOR role (scheduled backups + copy-to-central) and a separate RESTORER role
# (restores only), kept apart for least privilege
# - Opts this account/region into the AWS Backup resource types the central backup policy expects
#
# USE CASES:
# ✓ Local, in-account recovery points for fast restores without cross-account dependencies
# ✓ Copy source for terraform-aws-ntc-backup's central backup plan, which targets this vault by
# name (target_backup_vault_name = "<vault_prefix_name>-<region>") to pull recovery points out
# ✓ Least-privilege separation between the always-on backup schedule and rarely-used restores
# ✓ Disaster-recovery restore path back from the central backup account into this account
#
# CONFIGURATION:
# backup_operator_iam_role_name
# - Assumed by AWS Backup for scheduled backups and the copy-to-central job
# - Configurable, if overridden, also update "member_account_backup_role_name" on the
# central backup account, or cross-account copy fails with AccessDenied
#
# backup_restorer_iam_role_name
# - Assumed by AWS Backup only for restores, so a compromised/misused operator role can never
# trigger one - purely local, nothing on the central side references this role's name
#
# malware_scan_scanner_iam_role_name
# - Assumed by GuardDuty (not AWS Backup) to read a recovery point's data during a malware scan -
# separate from backup_operator_iam_role_name, which can only START a scan, not read the data
# - Trusted exclusively by malware-protection.guardduty.amazonaws.com - purely local, nothing on
# the central side references this role's name
#
# vault_prefix_name: ntc-local-backup-vault
# - Prefix of the vault name - the region is always appended ("<vault_prefix_name>-<region>")
# - ⚠️ terraform-aws-ntc-backup's backup plan hardcodes this exact prefix as its copy source
# (target_backup_vault_name) - changing it here requires updating that central module too
#
# kms_deletion_window_in_days / kms_key_rotation_enabled
# - Standard KMS CMK settings for the vault's encryption key, one per region
#
# kms_key_owners: (optional) additional admin principals for the vault's KMS key. Wildard SSO role ARNs are supported.
#
# resource_types: which AWS services this account opts into for AWS Backup
# - Must use the SAME vocabulary as terraform-aws-ntc-backup's backup_definitions[].resource_types
# - The central backup policy only backs up a resource type here if this account's region settings
# also opted into it
# - Allowed values: "EC2", "EBS", "RDS", "Aurora", "Aurora DSQL",
# "Neptune", "DocumentDB", "DynamoDB", "EFS", "S3", "FSx", "CloudFormation", "Redshift",
# "Redshift Serverless", "SAP HANA on Amazon EC2", "Storage Gateway", "Timestream", "EKS"
#
# central_backup_account_id: account-level trust (root), not scoped to a specific role
# - Required for backups of not fully managed resource-types (RDS, EC2, EBS, ...) and to enable the reverse restore-copy path from the central backup account
# - Only leave empty for an account that never participates in central backup at all
#
# vault_lock_config: (optional) WORM compliance lock, disabled by default
# enabled: false
# - Set true to apply an aws_backup_vault_lock_configuration to every regional vault
# - ⚠️ AWS itself makes the lock permanent after 'changeable_for_days' - no Terraform operation
# can delete or loosen it after that point, so do not enable this in throwaway/test accounts
#
# min_retention_days: 7
# - Shortest retention any backup/copy job's lifecycle may specify - jobs requesting less fail
# - Lowest value AWS actually accepts is 1 (the API rejects 0 - omitting the lock entirely is
# the only way to have no minimum)
#
# max_retention_days: 30
# - Longest retention any backup/copy job's lifecycle may specify - jobs requesting more fail
# - Must be >= min_retention_days (enforced by this module's validation block)
#
# changeable_for_days: 30
# - Grace period after which the lock (and its min/max bounds) becomes permanent and immutable,
# even to the account root user - AWS requires at least 3 days here
#
# region_overrides: (optional) per-region override of aws_backup_region_settings - AWS Backup
# rejects a resource type it doesn't recognize in a given region outright. No entry for a region =
# module defaults apply.
# - resource_types_opt_in_preference / resource_type_management_preference: each REPLACES (not
# adds to) the module default for that region - repeat every type the region should still have.
# Both map directly to the two aws_backup_region_settings arguments of the same name, see:
# https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/backup_region_settings
# -----------------------------------------------------------------------------------------------------------------
{
file_name = "backup"
template_name = "backup"
backup_inputs = {
vault_prefix_name = "ntc-local-backup-vault"
backup_operator_iam_role_name = "ntc-local-backup-operator-role"
backup_restorer_iam_role_name = "ntc-local-backup-restorer-role"
malware_scan_scanner_iam_role_name = "ntc-local-backup-malware-scanner-role"
kms_deletion_window_in_days = 30
kms_key_rotation_enabled = true
kms_key_owners = [] # optional: additional admin principals for the vault's KMS key
central_backup_account_id = local.ntc_parameters["mgmt-account-factory"]["core_accounts"]["aws-example-backup"]
vault_lock_config = {
enabled = false # only activate if you want the local vault to have a lock config
min_retention_days = 7
max_retention_days = 30
changeable_for_days = 30
}
# Neptune and DSQL aren't in the module default (spotty regional availability) - repeat the full
# default list here since this REPLACES it for the region, not adds to it.
region_overrides = {
"eu-central-1" = {
resource_types_opt_in_preference = [
"Aurora", "DocumentDB", "DynamoDB", "EBS", "EC2", "EFS", "FSx", "Neptune", "RDS",
"Storage Gateway", "CloudFormation", "Redshift", "Redshift Serverless", "S3", "DSQL"
]
}
}
}
}
]
}
info
vault_prefix_name and backup_operator_iam_role_name here must match member_account_backup_role_name and the hardcoded ntc-local-backup-vault-<region> naming that backup_definitions expects in the backup account's own stack (step 3 below) - a mismatch on either side fails cross-account copy with AccessDenied.
This template covers the account-level setup. Individual resources still need further configuration before they can actually be backed up, see step 4 below.
2. Update the Management Account (NTC Organizations)
Four things need to be added to your ntc_organizations stack, all working together to let the backup account manage AWS Backup and its own BACKUP_POLICY documents organization-wide. See Delegation Policies for the full explanation of each.
2a. Add a Local for the Backup Account ID
The delegations below all target the backup account by ID, so main.tf needs a backup_account_id local resolving it from ntc-parameters, the same way the stack already resolves its Security, Log Archive, or Connectivity account IDs:
locals {
# -----------------------------------------------------------------------------------------------------------------
# BACKUP ACCOUNT ID
# -----------------------------------------------------------------------------------------------------------------
# ...your other account ID locals (security_account_id, log_archive_account_id, ...)
# NOTE: replace "aws-example-backup" with your backup account's account_name from step 1
backup_account_id = local.ntc_parameters["mgmt-account-factory"]["core_accounts"]["aws-example-backup"]
}
2b. Delegate Admin Access to the Backup Account
Registers the backup account as delegated administrator for the backup.amazonaws.com service itself:
module "ntc_organizations" {
source = "github.com/nuvibit-terraform-collection/terraform-aws-ntc-organizations?ref=X.X.X"
# ...other organization configuration
# -----------------------------------------------------------------------------------------------------------------
# DELEGATED ADMINISTRATORS - Register the Backup Account for backup.amazonaws.com
# -----------------------------------------------------------------------------------------------------------------
delegated_administrators = [
# ...your other delegations (Security Hub, GuardDuty, Config, ...)
{
service_principal = "backup.amazonaws.com"
admin_account_id = local.backup_account_id
regions = ["eu-central-1"]
},
]
}
2c. Delegate Creation of Backup Policies to the Backup Account
Grants the backup account rights over Organizations' own policy-management APIs, scoped to BACKUP_POLICY:
module "ntc_organizations" {
source = "github.com/nuvibit-terraform-collection/terraform-aws-ntc-organizations?ref=X.X.X"
# ...other organization configuration
# -------------------------------------------------------------------------------------------------------------------
# DELEGATION POLICIES - SCOPED ORGANIZATIONS POLICY MANAGEMENT
# -------------------------------------------------------------------------------------------------------------------
# Grants the backup account rights over Organizations' own policy-management APIs, scoped to BACKUP_POLICY -
# different from 'delegated_administrators' above, which only covers AWS Backup's own APIs.
#
# CONFIGURATION:
# - delegate_account_id: account receiving the delegated policy rights
# - policy_types: which policy type(s) the delegate may manage
# - target_ou_paths: OU paths delegate may attach/detach to - empty = all OUs
# - target_account_ids: individual accounts the delegate may target - empty = all accounts
# - include_root: whether delegate may ALSO attach/detach at the org Root, in addition to
# target_ou_paths/target_account_ids - not a restriction of them, since Root is inherited org-wide.
# Only needed for org-wide attachment or accounts placed directly under Root (outside any OU).
# -------------------------------------------------------------------------------------------------------------------
delegation_policies = [
{
delegate_account_id = local.backup_account_id
policy_types = ["BACKUP_POLICY"]
target_ou_paths = [] # restricts the delegate to attaching/detaching BACKUP_POLICY only within these OUs
target_account_ids = [] # restricts the delegate to attaching/detaching BACKUP_POLICY only on these accounts
include_root = false
},
]
}
2d. Activate Global Backup Settings
module "ntc_organizations" {
source = "github.com/nuvibit-terraform-collection/terraform-aws-ntc-organizations?ref=X.X.X"
# ...other organization configuration
# -------------------------------------------------------------------------------------------------------------------
# AWS BACKUP GLOBAL SETTINGS
# -------------------------------------------------------------------------------------------------------------------
# Org-wide AWS Backup settings - UpdateGlobalSettings only accepts calls from the management account.
#
# CONFIGURATION:
# - enabled: apply this block at all - REQUIRED true for central backup to work, false leaves existing
# global settings untouched (the other attributes below are then ignored)
# - enable_cross_account_backup: allow backup plans to copy recovery points into another account's vault
# - enable_delegated_administrator: let the delegated backup admin account manage org-wide backup policies
# - enable_multi_party_approval: require a second approver before destructive backup actions (e.g. vault deletion)
# -------------------------------------------------------------------------------------------------------------------
backup_global_settings = {
enabled = true
enable_cross_account_backup = true
enable_delegated_administrator = true
enable_multi_party_approval = false
}
}
delegated_administrators and delegation_policies are two different mechanisms that both need to be in place, see Delegation Policies if the distinction isn't clear yet. backup_global_settings can only be applied from the management account, AWS Backup rejects the call from anywhere else, including the delegated backup account itself.
3. Configure the Backup Account
With the account created and Organizations wired up, deploy NTC Backup in the backup account itself. Create a new file ntc_backup.tf in that account's stack and put the following into it, then adjust backup_definitions to your needs: which OUs/accounts it targets, resource types, schedule, retention, and tag-based selection defaults.
# =====================================================================================================================
# NTC BACKUP - CENTRALIZED AWS BACKUP
# =====================================================================================================================
# Central backup account: aggregates recovery points from member accounts into per-entry vaults, and owns
# the AWS Organizations BACKUP_POLICY that drives which resources those accounts back up.
#
# WHAT IS NTC BACKUP?
# --------------------
# A centralized backup account that orchestrates AWS Backup across the organization via AWS Organizations
# BACKUP_POLICY documents, instead of configuring AWS Backup separately in every member account:
# • Each backup_definitions[] entry defines one central vault + KMS key, its own tag-driven selection
# rules, and the OUs/accounts it applies to
# • Member accounts back up locally first (fast operational recovery), then optionally copy into this
# account's central vault (durability, plus isolation from the source account)
# • central_vault_lock_config gives a central vault WORM-style immutability once its grace period
# expires - the retention floor a ransomware or compliance-driven backup strategy needs
#
# WHY A SEPARATE BACKUP ACCOUNT?
# -------------------------------
# • Isolates recovery points from the accounts that produced them - a compromised or accidentally
# deleted workload account doesn't take its own backups down with it
# • Different account = different IAM trust boundary: the central vault policy grants workload
# accounts exactly one permission - backup:CopyIntoBackupVault. Even a fully compromised workload
# account (including its own admins) has no path to read, restore, or delete a recovery point once
# it has landed here
# • Decouples a recovery point's lifecycle from its source account's lifecycle - retention (and Vault
# Lock immutability) keeps running on this account's own schedule even if the workload account is
# later closed, suspended, or offboarded
# • Matches compliance frameworks (ISO 27001, FINMA) that expect backup/recovery to be demonstrably
# independent of the systems it protects
#
# PREREQUISITES:
# ---------------
# • AWS Organizations must delegate to this account three separate pieces, all required:
# - delegated_administrators: registers this account as delegated admin for the backup.amazonaws.com
# service itself - without it, this account cannot act as AWS Backup's admin at all
# - delegation_policies (policy_types = ["BACKUP_POLICY"]): grants this account rights over
# Organizations' OWN policy-management APIs, scoped to BACKUP_POLICY - without it, attaching a
# backup_definitions[] entry's policy to an OU/account fails
# - backup_global_settings.enable_delegated_administrator = true (plus enable_cross_account_backup
# = true) - the org-wide AWS Backup settings that actually let the delegated admin manage
# org-wide policies and let plans copy recovery points across accounts
# • Every target member/workload account must already have the account factory's "backup" baseline
# template applied. That template creates the two things this module depends on in each account:
# - the member_account_backup_role_name IAM role (default "ntc-local-backup-operator-role") -
# AWS Backup assumes this to copy a recovery point into this account's central vault
# - the LOCAL vault itself ("ntc-local-backup-vault-<region>") - this module's backup plans write
# the first, local recovery point there before any central copy_action can run. The prefix is
# hardcoded on both sides (baseline template + this module) - changing it in one requires
# changing it in the other
# Without either, backup jobs fail before a copy into this account's central vault is even possible.
#
# HOW SELECTION WORKS:
# ---------------------
# • backup_definitions[].resource_types (below) - which AWS services are eligible for backup, per entry
# • ntc:backup / ntc:backup-scope tags - per-resource opt-in/opt-out on top of that (or bypass entirely
# by setting backup_definitions[].tag_based_selection_enabled = false)
#
# HOW MULTI-REGION / CROSS-VAULT COPY WORKS:
# --------------------------------------------
# • One backup_definitions[] entry creates its own central vault + KMS key, named after that entry's
# `name` (not its `region`) - multiple entries CAN share a region if you ever need more than one
# central vault there (e.g. different retention/lock per workload tier)
# • backup_definitions[].copy_to_backup_definition_by_name is the opt-in exception that ALSO copies an entry's
# backups into another entry's vault (by name, not region) - destination must also have its own
# backup_definitions[] entry
#
# =====================================================================================================================
# =====================================================================================================================
# NTC BACKUP MODULE
# =====================================================================================================================
module "ntc_backup" {
source = "github.com/nuvibit-terraform-collection/terraform-aws-ntc-backup?ref=X.X.X"
# -----------------------------------------------------------------------------------------------------------------
# SERVICE-LINKED ROLES - Prerequisites for Cross-Service Backup/Copy Operations
# -----------------------------------------------------------------------------------------------------------------
# AWSServiceRoleForRDS: required before AWS Backup can copy an RDS/Aurora/Neptune/DocumentDB recovery
# point into a vault here; copy jobs fail without it.
# - true (current value): the module creates it.
# - false: use when it already exists in this account (creating it again errors with
# EntityAlreadyExists) or import the existing one instead:
# `tofu import aws_iam_service_linked_role.ntc_rds_service_linked_role
# arn:aws:iam::<ACCOUNT_ID>:role/aws-service-role/rds.amazonaws.com/AWSServiceRoleForRDS`.
# -----------------------------------------------------------------------------------------------------------------
create_rds_service_linked_role = true
# AWSServiceRoleForBackup: the role AWS Backup itself uses as caller identity for native-service
# copy/read and KMS grants in this account. Same true/false/import tradeoff as above, but for
# `tofu import aws_iam_service_linked_role.ntc_backup_service_linked_role
# arn:aws:iam::<ACCOUNT_ID>:role/aws-service-role/backup.amazonaws.com/AWSServiceRoleForBackup`.
create_backup_service_linked_role = true
# -----------------------------------------------------------------------------------------------------------------
# NOTIFICATIONS - Alert on Backup/Copy/Restore Job Failures
# -----------------------------------------------------------------------------------------------------------------
backup_notification_settings = {
org_identifier = "example" # Organization identifier for notification subjects
subscriptions = [
{
protocol = "email"
endpoints = ["operations@example.com"]
}
]
}
# =====================================================================================================================
# BACKUP DEFINITIONS - Per-Vault Backup Policy Configuration
# =====================================================================================================================
# One entry per central vault. `name` drives the actual AWS Backup vault name this module generates.
# Vault names can't be changed in place, so changing an existing entry's `name` destroys and recreates
# the live vault.
# =====================================================================================================================
backup_definitions = [
# =================================================================================================================
# BACKUP DEFINITION: NTC-CENTRAL-BACKUP-VAULT-EU-CENTRAL-1
# =================================================================================================================
{
name = "ntc-central-backup-vault-eu-central-1"
region = "eu-central-1"
# -----------------------------------------------------------------------------------------------------------
# Resource Types & Schedule
# -----------------------------------------------------------------------------------------------------------
# Centrally defined list of AWS services eligible for backup - keep in sync with the backup
# baseline-template rolled out to member accounts.
resource_types = ["EC2", "EBS", "RDS", "Aurora", "Neptune", "DocumentDB", "DynamoDB", "EFS", "S3"]
# AWS Backup's schedule only supports hourly-or-coarser granularity
cron_schedule = "cron(30 0/4 ? * * *)" # every 4 hours
# -----------------------------------------------------------------------------------------------------------
# Vault Lock - Compliance/Immutability (Optional)
# -----------------------------------------------------------------------------------------------------------
# Backup Vault Lock for this entry's CENTRAL vault only - the local vault is never locked by this
# module. The lock protects individual recovery points from deletion until their own retention
# expires, it does not pin the vault itself - the vault (locked or not) can only be deleted once it
# holds no recovery points anymore.
# - enabled: turns the lock on for this entry's central vault.
# - min_retention_days: shortest retention any backup/copy job's lifecycle may specify once the
# lock is active - jobs requesting less fail.
# - max_retention_days: longest retention any backup/copy job's lifecycle may specify once the
# lock is active - jobs requesting more fail. central_backup_vault_retention_days below must fall
# within [min_retention_days, max_retention_days].
# - changeable_for_days: grace period during which this lock config can still be freely tightened,
# loosened, or removed. WARNING: once it expires, the lock becomes PERMANENT - from then on it
# can only be tightened (raise min / lower max), never loosened or disabled, even by the account
# root user. Keep disabled until backup/restore workflows are validated.
# -----------------------------------------------------------------------------------------------------------
central_vault_lock_config = {
enabled = false
min_retention_days = 10
max_retention_days = 90
changeable_for_days = 30
}
# -----------------------------------------------------------------------------------------------------------
# Retention
# -----------------------------------------------------------------------------------------------------------
local_backup_vault_retention_days = 7
central_backup_vault_retention_days = 30
# -----------------------------------------------------------------------------------------------------------
# Member Account Role
# -----------------------------------------------------------------------------------------------------------
# The EXACT IAM role name that MUST exist in ALL member accounts targeted below, in order to copy
# backups into this vault. Not a role in this account - the role every member account creates via
# the backup baseline-template.
# -----------------------------------------------------------------------------------------------------------
member_account_backup_role_name = "ntc-local-backup-operator-role"
# Same idea as member_account_backup_role_name above, but the role AWS Backup passes to GuardDuty
# when initiating a scan - must match the local scanner role every member account creates via the
# backup baseline-template.
member_account_malware_scanner_role_name = "ntc-local-backup-malware-scanner-role"
# -----------------------------------------------------------------------------------------------------------
# Malware Scanning (Optional)
# -----------------------------------------------------------------------------------------------------------
# Amazon GuardDuty Malware Protection for this entry's LOCAL (member account) recovery points only -
# a copy into this entry's central vault is never automatically scanned, see the Malware Protection
# page. The scanner IAM roles are always created regardless of this setting, so an on-demand scan
# still works even while this is disabled.
# - enabled: turns automatic scanning on for this entry.
# - resource_types: only "EC2", "EBS", and "S3" support scanning today - matches this entry's own
# resource_types above (everything else here has nothing to scan).
# - scan_mode: "INCREMENTAL_SCAN" (only changed files since the last scan) vs "FULL_SCAN" (every
# file, every time) - incremental is cheaper and enough for a daily cadence.
# -----------------------------------------------------------------------------------------------------------
malware_scanning = {
enabled = true
resource_types = ["EC2", "EBS", "S3"]
scan_mode = "INCREMENTAL_SCAN"
}
# -----------------------------------------------------------------------------------------------------------
# Account Targeting
# -----------------------------------------------------------------------------------------------------------
# OU path IDs (without trailing "/*") in scope for this entry - used both for the vault/KMS trust
# policy condition (as the full path ID) and to attach the central BACKUP_POLICY document (the
# module derives the bare OU ID itself, so only the path ID format needs passing in here).
backup_target_ou_path_ids = [
local.ntc_parameters["mgmt-organizations"]["ou_path_ids"]["/root/workloads/test"]
]
# Explicitly listed member account IDs in scope for this entry - used both for the vault/KMS trust
# policy condition and to attach the central BACKUP_POLICY document. Can be empty if all member
# accounts are covered by the OU path(s) above.
backup_target_account_ids = []
# -----------------------------------------------------------------------------------------------------------
# Tag-Based Resource Selection
# -----------------------------------------------------------------------------------------------------------
# Namespaced tag keys driving resource selection, to avoid colliding with a customer's own
# pre-existing tagging scheme.
# - tag_key_to_enable_backup: tag value "true"/"false" - whether the resource is backed up at all
# (see backup_enabled_if_untagged for resources missing this tag).
# - tag_key_to_define_backup_scope: tag value "local-only"/"local-and-central" - whether a backed
# up resource also gets copied to this entry's central vault (see default_backup_scope for
# resources missing this tag).
# -----------------------------------------------------------------------------------------------------------
tag_key_to_enable_backup = "ntc:backup"
tag_key_to_define_backup_scope = "ntc:backup-scope"
# Whether a resource with NO tag_key_to_enable_backup tag at all is backed up by default.
# - false (current value): default-deny - a resource must be tagged ntc:backup=true to be backed
# up at all.
# - true: default-allow - a resource must be tagged ntc:backup=false to opt out.
backup_enabled_if_untagged = false
# Scope applied to a backed-up resource with no tag_key_to_define_backup_scope tag. Only matters
# while tag_based_selection_enabled is true; once that's false, this becomes the static, entry-wide
# scope for every selected resource regardless of tags.
default_backup_scope = "local-and-central"
# Whether the tag_key_to_enable_backup / tag_key_to_define_backup_scope tags above are consulted at
# all.
# - true (current value): per-resource tags decide inclusion/scope, falling back to
# backup_enabled_if_untagged / default_backup_scope for resources missing a tag.
# - false: escape hatch - tags are ignored entirely, default_backup_scope becomes the static,
# entry-wide scope for every resource matching resource_types, no exceptions.
tag_based_selection_enabled = true
# -----------------------------------------------------------------------------------------------------------
# Cross-Vault Copy (Optional)
# -----------------------------------------------------------------------------------------------------------
# Other backup_definitions[] entries (by `name`) whose central vault should ALSO receive a copy of
# this entry's "local-and-central"-scoped backups, on top of this entry's own central vault (which
# always gets a copy regardless of this list). "local-only" resources are never copied anywhere.
# This is how backup data crosses regions/vaults. The target name must reference another
# backup_definitions[] entry that also exists - left empty here since this example only defines one.
# -----------------------------------------------------------------------------------------------------------
copy_to_backup_definition_by_name = []
}
]
}
4. Configure Member Accounts
Applying the backup baseline template in step 1 is not enough on its own: any resource encrypted with a customer-managed KMS key still needs explicit key access granted before AWS Backup can actually back it up, and restoring later has its own per-service considerations. Complete Member Account Requirements for every account in scope, backups will fail for CMK-encrypted resources until this is done.