- BFSIBanking, Financial Services & Insurance
- HealthcareComing soon
- ManufacturingComing soon
- Retail & E-CommerceComing soon
AWS Backup
Your data sits across dozens of AWS accounts and a VMware cluster. Its backups shouldn’t depend on a script in each one — AWS Backup protects EC2, S3, RDS, DynamoDB, EFS and on-prem VMware from one set of policies, with free Vault Lock, an air-gapped vault and scheduled restore tests — in Mumbai or Hyderabad.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Quick answer
The AWS platform family
This page covers AWS Backup — including Vault Lock, the logically air-gapped vault, restore testing and the VMware Backup gateway. The rest:
Quick facts
30-second orientation- Product
- Managed, policy-based backup for AWS services and on-prem VMware
- Maker
- Amazon Web Services, Inc., a subsidiary of Amazon.com, Inc.
- Bought as
- A metered service on your AWS bill; no editions, seats or licence keys
- Price
- Warm storage $0.055 per GB-month in Mumbai; EC2/EBS bill as EBS snapshots
- Covers
- EC2, EBS, S3, RDS, Aurora, DynamoDB, EFS, FSx, EKS, Redshift, VMware
- Immutability
- Vault Lock, free; compliance mode cannot be undone, even by AWS
- Air gap
- Logically air-gapped vault, metered higher ($0.0633/GB-month Mumbai)
- Not covered
- Hyper-V, physical servers, Microsoft 365, Google Workspace, Salesforce
- India
- Mumbai has every feature; Hyderabad is opt-in and lacks the VMware gateway
- In India via
- TechBag — plan and vault design, an INR cost model, a first restore test
Understand policy-based cloud backup before you buy it
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is policy-based cloud backup?
Policy-based backup means one plan decides what is copied, how often and for how long, across every account.
Snapshot scripts per account vs AWS Backup — the honest table
What consolidation actually replaces, dimension by dimension.
| Dimension | Snapshot scripts per account | AWS Backup |
|---|---|---|
| Coverage | Snapshot scripts per service, per account | One plan across EC2, RDS, S3, EFS, DynamoDB and VMware |
| New accounts | Protected when someone remembers | An Organizations backup policy covers them from day one |
| Deletion risk | An admin or attacker can delete snapshots | Compliance-mode Vault Lock refuses every early delete |
| Isolation | Copies in the same account as production | An air-gapped vault in a service-owned account |
| Proof | A restore tried once, after the incident | Scheduled restore tests with timings and audit reports |
| What it is NOT | — | Backup for Hyper-V, physical servers or SaaS apps |
The cheapest test: lock one vault in governance mode, back up one RDS database to it, and schedule a weekly restore test.
The five pieces of the platform
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
Plans
Rules set frequency, lifecycle and copy actions; resources join by tag or ARN, and AWS Organizations backup policies push the same plan to every member account.
Vaults
Each Region holds vaults of recovery points, up to 1,000,000 per vault by default; Vault Lock in governance or compliance mode blocks deletes and early expiry.
Air-gapped vault
A vault locked in compliance mode by default and stored in an AWS Backup service-owned account, shareable through AWS RAM and recoverable via multi-party approval.
Gateway
A free VM on vSphere 6.7, 7 or 8 that backs VMware VMs up into AWS Backup, four jobs per gateway at a time; Hyper-V and physical servers are not supported.
Backup plans write into vaults in your account — locked by Vault Lock, isolated in an air-gapped vault, proven by restore tests.
Nine capabilities. Protect, isolate, prove.
AWS Backup puts every AWS account under one backup policy, with locks no one can lift early.
One plan, many AWS services
EC2, EBS, S3, RDS, Aurora, DynamoDB, EFS, FSx, Redshift, EKS and SAP HANA on EC2 are scheduled from the same backup plans.
Policies across every account
AWS Organizations backup policies apply a plan to member accounts, so a new account is protected without anyone writing a job.
On-prem VMs into AWS
The free Backup gateway VM protects vSphere 6.7, 7 and 8 VMs, and VMware Cloud on AWS, under the same plans as cloud resources.
Locks that even AWS cannot lift
In compliance mode, once a grace time of at least 72 hours ends, no user, root or AWS can delete recovery points before expiry.
Copies held outside your account
Air-gapped vaults sit in a service-owned account, locked by default, and multi-party approval restores them if your account is lost.
Another Region or account
Copy rules send recovery points across Regions or accounts; DynamoDB needs advanced features to copy, and Redshift Serverless cannot.
Scheduled test restores
Plans restore chosen or random recovery points on a schedule, time each job, optionally validate, then delete what they restored.
GuardDuty checks the backups
GuardDuty Malware Protection scans EC2, EBS and S3 recovery points for malware, billed by GuardDuty rather than AWS Backup.
Evidence an auditor can read
Backup Audit Manager checks controls such as retention and restore-test results and builds reports, at $0.00125 per evaluation.
Watch AWS Backup in action
An AWS Backup overview, the logically air-gapped vault, a restore testing plan, and a re:Invent 2025 session on ransomware recovery. All from AWS’s official channels.
Introducing AWS Backup | Amazon Web Services
What AWS Backup centralises: plans, vaults and policies across AWS services.
AWS Backup logically air-gapped vault demo | Amazon Web Services
Creating an air-gapped vault, copying into it and sharing it to another account.
AWS Backup Restore testing Demo | Amazon Web Services
Building a restore testing plan and reading the timed results it produces.
AWS re:Invent 2025 - Building resilience against ransomware using AWS Backup (STG412)
A ransomware-recovery design built on locked vaults, isolated copies and tested restores.
Want a live, India-context walkthrough for your environment?
Book a guided demo →Every new AWS account brings another set of snapshots to script. AWS Backup puts them all under one locked policy.
Here’s what genuinely sets it apart — and exactly where it stops.
One meter, no licence to count
There are no editions, seats or terms. AWS Backup bills storage per GB-month by Region (warm $0.055 and cold $0.011 in Mumbai) plus restores per GB and $1.65 per recovery point tested. Vault Lock adds nothing, and EC2 and EBS backups bill as EBS snapshots.
An air gap AWS runs for you
A logically air-gapped vault keeps copies in an AWS Backup service-owned account, compliance-locked by default and shareable to a clean account through AWS RAM. Since November 2025 it can be the primary target, so the one copy you keep can be the isolated one.
Restores you can prove, on a schedule
Restore testing plans restore recovery points on a cadence, record how long each took, optionally validate them and clean up afterwards. Backup Audit Manager turns the results into reports, which is the evidence an auditor or a cyber-recovery review asks for.
Where it stops
It protects AWS services and on-prem VMware only: no Hyper-V, physical servers, Microsoft 365, Google Workspace or Salesforce. Every copy stays inside AWS. Gartner names AWS a Leader for cloud platforms, but AWS is not in Gartner’s backup Magic Quadrant.
The numbers behind the platform
What your AWS Backup rollout looks like
Inventory accounts and services
List accounts, Regions and resource types, mark what is regulated, and note any VMware or Hyper-V hosts outside AWS.
Design plans, vaults and locks
Set rules and lifecycles, choose governance or compliance Vault Lock, and decide where the air-gapped copy lives.
Roll out through Organizations
Push backup policies to member accounts, tag resources into plans, and deploy the Backup gateway for vSphere in Mumbai.
Schedule restore tests
Create restore testing plans for EC2, RDS and S3, add validation, and record each restore time against your RTO.
Lock, share and report
Let the compliance lock pass its grace time, share the air-gapped vault to a recovery account, and turn on audit reports.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“Organizations backup policies meant the 40 accounts our platform team created last quarter were covered on day one, with no ticket raised.”
“We moved our second copy into a logically air-gapped vault and shared it to a recovery account. The tabletop finally had a clean answer.”
“Restore testing runs weekly against random RDS points. The audit pack used to take two days; now it is a report we download.”
“Our surprise was the EBS snapshot line, not the AWS Backup one. Model snapshot growth before you set daily retention to a year.”
“The gateway handles our vSphere 7 cluster, but the Hyper-V hosts needed a second product. Check every hypervisor before you commit.”
“We set compliance mode, then found test points marked to keep forever. Read the grace-time warning twice before it expires.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and G2 retired its Grid. So here’s TechBag’s synthesis of the AWS backup market — tap any vendor to see why it sits where it does.
TechBag Backup & Recovery Grid
Execution strength vs product vision — the classic market map, minus the paywall.
Metered per GB-month; warm storage $0.055 in Mumbai.
Account Isolation × AWS Service Breadth
The grid nobody publishes — how far the backup copy sits from the account an attacker could take vs how many AWS services one policy protects.
Air-gapped vault in a service-owned account; widest AWS list.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
AWS Backup vs the AWS backup field
Against Veeam Backup for AWS, N2W Backup & Recovery, Druva Cloud Workloads, Commvault Cloud (Clumio) and Rubrik Security Cloud — on deployment, coverage, price, isolation, support and India.
| Dimension | AWS Backup | Veeam Backup for AWS | N2W Backup & Recovery | Druva Cloud Workloads | Commvault Cloud (Clumio) | Rubrik Security Cloud |
|---|---|---|---|---|---|---|
| What it is | AWS’s own backup service | Backup inside your AWS | Policy snapshot platform | SaaS cloud backup | Serverless AWS backup | Cyber-resilience suite |
| Deployment | Nothing to deploy | Appliance you run | Server in your account | SaaS, agentless | SaaS, serverless | SaaS control plane |
| AWS services covered | Widest AWS list | EC2, RDS, DynamoDB… | EC2, EBS, RDS, S3… | EC2, EBS, RDS, S3 | S3, EBS, RDS, DynamoDB | EC2, RDS, S3, DynamoDB |
| Other clouds, on-prem | VMware only off AWS | Azure, GCP, on-prem | AWS, Azure, Google | Azure, data centre, SaaS | AWS-first; GCP coming | Azure, GCP, DC, SaaS |
| Pricing model | Per GB-month, metered | Per instance (VUL) | Flat monthly edition | Credits, on quote | Per GiB-month, public | Subscription, on quote |
| Published entry price | $0.055/GB-month Mumbai | Free for 10 instances | $249 a month | Not published | $0.025/GiB-month S3 | Not published |
| Included vs add-on | Lock free, tests metered | Free tier trims services | DR in every edition | Snapshots billed by AWS | Vault in the rate | Platform subscription |
| Scale limits | 1M points per vault | Units set the ceiling | Caps by edition | Not published | Petabyte-scale S3 | Not published |
| Air gap and immutability | Lock + air-gapped vault | Object Lock you set up | Immutable snapshots | Copies outside your AWS | Vault outside accounts | Immutable, MFA enforced |
| Governance and SSO | IAM, Org policies, audit | SAML SSO, MFA | SAML SSO; local root | SAML SSO | SSO and MFA settings | SAML SSO, RBAC |
| India storage | Mumbai, Hyderabad | Your bucket, your Region | Your Regions; confirm | Mumbai region; confirm | Not documented | Not documented |
| Support | Your AWS Support plan | Paid 24/7; free = forum | 24/7 on paid plans | 24/7, 1 h critical | Via Commvault | 24x7 by phone or web |
| Lock-in and exit | Copies stay in AWS | Your S3, portable units | Native snapshots kept | Copies in Druva’s cloud | History in SecureVault | 3-year platform terms |
| Best fit | AWS-first estates | Veeam shops on AWS | Fixed-price AWS backup | Druva estates in cloud | Big S3 and databases | Rubrik-wide resilience |
Which approach fits you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose AWS Backup if…
- ✓Most of your data lives in AWS services and you want one policy across every account, with nothing to deploy
- ✓You need an immutable, isolated copy: compliance-mode Vault Lock is free, and the air-gapped vault is a storage meter, not a licence
- ✓You must prove recoverability on a schedule — restore testing costs $1.65 per recovery point in Mumbai and feeds audit reports
Compare alternatives if…
- ✓You also run Hyper-V, physical servers or Microsoft 365 — Veeam, Druva and Rubrik reach beyond AWS
- ✓You want copies held by a third party outside AWS’s account model — Clumio and Druva keep them in their own clouds
- ✓You prefer a fixed monthly price to a per-GB meter — N2W Standard is $249 a month for 20 instances
Do not expect…
- ✓Backup for Hyper-V, physical servers, laptops or SaaS applications
- ✓An INR list price — AWS prices in USD, and AWS India invoices in rupees with GST
- ✓A Gartner backup Magic Quadrant placement — AWS was not evaluated in 2025 or 2026
AWS Backup is one of 27 backup & recovery products TechBag carries. The Backup & Recovery guide narrows them to a shortlist and shows the reasoning. →
What does scripting backup account by account cost you?
Drag the sliders (AWS resources you protect; cloud engineer-hour cost). Estimates model engineering time spent on per-account snapshot scripts, retention clean-up and manual restore checks at an assumed 1.5 hours per resource a year, with 70% of it removed by organisation-wide plans, locked vaults and scheduled restore tests. Both figures are assumptions. Illustrative.
Loaded cost = salary + overheads per productive hour. Illustrative only — your TechBag quote models your actual environment and modules.
Three ways to consume it
Published, in USD, per Region. In Mumbai, warm storage for S3, EFS and VMware backups is $0.055 per GB-month and cold storage $0.011; restores from warm storage cost $0.022 per GB; restore testing is $1.65 per recovery point tested; the logically air-gapped vault is metered higher, at $0.0633 per GB-month for S3, EFS and VMware. EC2 and EBS backups bill as EBS snapshots, not on the AWS Backup meter. Vault Lock is free; GuardDuty bills malware scans. There is no free tier and no INR list price — AWS India invoices in rupees with GST. TechBag models your bill in INR with GST before you commit.
Standard vault
Best for day-to-day backup and restore
- $0.055 per GB-month warm in Mumbai
- Cold tier $0.011 for EFS and VMware
- Vault Lock at no extra charge
+ Platform add-ons
Best for a broader rollout
- Scoped to your estate
- Add-on modules as needed
- Phased, right-sized deployment
Logically air-gapped vault
Best for the isolated, cyber-recovery copy
- $0.0633 per GB-month in Mumbai (S3, EFS, VMware)
- Compliance-locked by default
- Restore testing $1.65 per recovery point
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 8 questions to ask every vendor
Take this into your next vendor call — including ours.
Is everything in AWS or on VMware? Hyper-V, physical servers and SaaS apps need a different product.
Mumbai or Hyderabad? Hyderabad is opt-in and has no VMware gateway, SAP HANA or Neptune backups.
Governance or compliance Vault Lock? Compliance cannot be undone after a grace time of at least 72 hours.
Are any recovery points set to keep forever? In a compliance-locked vault they can never be deleted.
Is the isolated copy your primary target or a second copy, and which account will it be shared to via AWS RAM?
Have you modelled EBS snapshot growth? EC2 and EBS backups bill as snapshots, not on the AWS Backup meter.
Which resources get scheduled restore tests, how often, and who reads the timings against your RTO?
Will you scan recovery points with GuardDuty before a restore, and is that cost budgeted under GuardDuty?
Questions buyers ask
Ready to evaluate AWS Backup?
Map your accounts and services first, or let a TechBag advisor design the plans, the lock mode and the air-gapped copy, and model the bill in INR with GST.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.