AWS.Backup reference

BackupPlan

Source: src/AWS/Backup/BackupPlan.ts

An AWS Backup plan — a policy expression that defines when and how you want to back up your resources, composed of one or more scheduled rules that each target a backup vault.

Pair a plan with a BackupSelection to assign the AWS resources it protects.

BackupPlan: Creating a Plan

Daily backups retained for 30 days

import * as Backup from "alchemy/AWS/Backup";

const vault = yield* Backup.BackupVault("AppBackups");

const plan = yield* Backup.BackupPlan("DailyPlan", {
  rules: [
    {
      ruleName: "DailyBackups",
      targetBackupVaultName: vault.backupVaultName,
      scheduleExpression: "cron(0 5 ? * * *)",
      startWindow: "1 hour",
      completionWindow: "3 hours",
      lifecycle: { deleteAfter: "30 days" },
    },
  ],
});

Move to cold storage then delete

const plan = yield* Backup.BackupPlan("ArchivePlan", {
  rules: [
    {
      ruleName: "MonthlyArchive",
      targetBackupVaultName: vault.backupVaultName,
      scheduleExpression: "cron(0 5 1 * ? *)",
      lifecycle: {
        moveToColdStorageAfter: "30 days",
        deleteAfter: "365 days",
      },
    },
  ],
});

BackupSelection

Source: src/AWS/Backup/BackupSelection.ts

An AWS Backup selection — assigns AWS resources to a BackupPlan either by explicit ARN or by matching resource tags, using an IAM role that AWS Backup assumes to perform the backups.

A selection is immutable: any change to its name, role, or resource set replaces it.

BackupSelection: Assigning Resources

Assign resources by tag

import * as Backup from "alchemy/AWS/Backup";

const selection = yield* Backup.BackupSelection("TaggedResources", {
  backupPlanId: plan.backupPlanId,
  iamRoleArn: backupRole.roleArn,
  listOfTags: [
    {
      conditionType: "STRINGEQUALS",
      conditionKey: "aws:ResourceTag/backup",
      conditionValue: "daily",
    },
  ],
});

Assign resources by ARN

const selection = yield* Backup.BackupSelection("ExplicitResources", {
  backupPlanId: plan.backupPlanId,
  iamRoleArn: backupRole.roleArn,
  resources: [table.tableArn],
});

BackupVault

Source: src/AWS/Backup/BackupVault.ts

An AWS Backup vault — a logical container that stores and organizes recovery points created by backup jobs.

A vault name is auto-generated from the app, stage, and logical ID unless you provide one explicitly. Recovery points can optionally be encrypted with a customer-managed KMS key, and access to the vault can be restricted with a resource-based policy.

BackupVault: Creating a Vault

Basic Vault

import * as Backup from "alchemy/AWS/Backup";

const vault = yield* Backup.BackupVault("AppBackups");

Vault with a Customer-Managed KMS Key

const vault = yield* Backup.BackupVault("EncryptedBackups", {
  encryptionKeyArn: key.keyArn,
});

BackupVault: Vault Access Policy

const vault = yield* Backup.BackupVault("LockedBackups", {
  accessPolicy: {
    Version: "2012-10-17",
    Statement: [
      {
        Effect: "Deny",
        Principal: { AWS: "*" },
        Action: ["backup:DeleteRecoveryPoint"],
        Resource: "*",
      },
    ],
  },
});

DeleteRecoveryPoint

Source: src/AWS/Backup/DeleteRecoveryPoint.ts

Runtime binding for the DeleteRecoveryPoint operation (IAM action backup:DeleteRecoveryPoint).

Deletes a recovery point from the bound BackupVault — e.g. a retention janitor pruning on-demand backups. Provide the implementation with Effect.provide(AWS.Backup.DeleteRecoveryPointHttp).

DeleteRecoveryPoint: Recovery Points

const deleteRecoveryPoint = yield* AWS.Backup.DeleteRecoveryPoint(vault);

yield* deleteRecoveryPoint({ RecoveryPointArn: recoveryPointArn });

DescribeBackupJob

Source: src/AWS/Backup/DescribeBackupJob.ts

Runtime binding for the DescribeBackupJob operation (IAM action backup:DescribeBackupJob).

Returns the details of a backup job by its ID — poll a job started with StartBackupJob until it completes. Provide the implementation with Effect.provide(AWS.Backup.DescribeBackupJobHttp).

DescribeBackupJob: Monitoring Backup Jobs

const describeBackupJob = yield* AWS.Backup.DescribeBackupJob();

const job = yield* describeBackupJob({ BackupJobId: jobId });
if (job.State === "COMPLETED") {
  yield* Effect.log(`recovery point: ${job.RecoveryPointArn}`);
}

DescribeCopyJob

Source: src/AWS/Backup/DescribeCopyJob.ts

Runtime binding for the DescribeCopyJob operation (IAM action backup:DescribeCopyJob).

Returns the details of a copy job by its ID — poll a job started with StartCopyJob until it completes. Provide the implementation with Effect.provide(AWS.Backup.DescribeCopyJobHttp).

DescribeCopyJob: Copying Recovery Points

const describeCopyJob = yield* AWS.Backup.DescribeCopyJob();

const { CopyJob } = yield* describeCopyJob({ CopyJobId: jobId });

DescribeProtectedResource

Source: src/AWS/Backup/DescribeProtectedResource.ts

Runtime binding for the DescribeProtectedResource operation (IAM action backup:DescribeProtectedResource).

Returns backup metadata for a protected resource by its ARN — last backup time, resource type, and latest recovery point. Provide the implementation with Effect.provide(AWS.Backup.DescribeProtectedResourceHttp).

DescribeProtectedResource: Protected Resources

const describeProtectedResource =
  yield* AWS.Backup.DescribeProtectedResource();

const info = yield* describeProtectedResource({
  ResourceArn: tableArn,
});
yield* Effect.log(`last backup: ${info.LastBackupTime}`);

DescribeRecoveryPoint

Source: src/AWS/Backup/DescribeRecoveryPoint.ts

Runtime binding for the DescribeRecoveryPoint operation (IAM action backup:DescribeRecoveryPoint).

Returns metadata for a recovery point stored in the bound BackupVault — status, lifecycle, size, and restorability. Provide the implementation with Effect.provide(AWS.Backup.DescribeRecoveryPointHttp).

DescribeRecoveryPoint: Recovery Points

const describeRecoveryPoint = yield* AWS.Backup.DescribeRecoveryPoint(vault);

const point = yield* describeRecoveryPoint({
  RecoveryPointArn: recoveryPointArn,
});
yield* Effect.log(`status: ${point.Status}`);

DescribeRestoreJob

Source: src/AWS/Backup/DescribeRestoreJob.ts

Runtime binding for the DescribeRestoreJob operation (IAM action backup:DescribeRestoreJob).

Returns the details of a restore job by its ID — poll a job started with StartRestoreJob until it completes. Provide the implementation with Effect.provide(AWS.Backup.DescribeRestoreJobHttp).

DescribeRestoreJob: Restoring Recovery Points

const describeRestoreJob = yield* AWS.Backup.DescribeRestoreJob();

const job = yield* describeRestoreJob({ RestoreJobId: jobId });
if (job.Status === "COMPLETED") {
  yield* Effect.log(`restored: ${job.CreatedResourceArn}`);
}

GetRecoveryPointRestoreMetadata

Source: src/AWS/Backup/GetRecoveryPointRestoreMetadata.ts

Runtime binding for the GetRecoveryPointRestoreMetadata operation (IAM action backup:GetRecoveryPointRestoreMetadata).

Returns the restore metadata for a recovery point in the bound BackupVault — the key/value set passed to StartRestoreJob as its Metadata. Provide the implementation with Effect.provide(AWS.Backup.GetRecoveryPointRestoreMetadataHttp).

GetRecoveryPointRestoreMetadata: Restoring Recovery Points

const getRestoreMetadata =
  yield* AWS.Backup.GetRecoveryPointRestoreMetadata(vault);
const startRestoreJob = yield* AWS.Backup.StartRestoreJob(role);

const { RestoreMetadata } = yield* getRestoreMetadata({
  RecoveryPointArn: recoveryPointArn,
});
yield* startRestoreJob({
  RecoveryPointArn: recoveryPointArn,
  Metadata: RestoreMetadata!,
});

GetRestoreJobMetadata

Source: src/AWS/Backup/GetRestoreJobMetadata.ts

Runtime binding for the GetRestoreJobMetadata operation (IAM action backup:GetRestoreJobMetadata).

Returns the metadata of a restore job — the key/value set describing the restored resource. Together with PutRestoreValidationResult this is the restore-testing validation flow: AWS Backup invokes a validation Lambda after a restore-test job completes, the Lambda inspects the restored resource, then reports the verdict. Provide the implementation with Effect.provide(AWS.Backup.GetRestoreJobMetadataHttp).

GetRestoreJobMetadata: Restore Testing Validation

const getRestoreJobMetadata = yield* AWS.Backup.GetRestoreJobMetadata();

const { Metadata } = yield* getRestoreJobMetadata({
  RestoreJobId: restoreJobId,
});
yield* Effect.log(`restored resource metadata: ${JSON.stringify(Metadata)}`);

GetSupportedResourceTypes

Source: src/AWS/Backup/GetSupportedResourceTypes.ts

Runtime binding for the GetSupportedResourceTypes operation (IAM action backup:GetSupportedResourceTypes).

Returns the AWS resource types AWS Backup supports (e.g. DynamoDB, EBS, RDS). Provide the implementation with Effect.provide(AWS.Backup.GetSupportedResourceTypesHttp).

GetSupportedResourceTypes: Protected Resources

const getSupportedResourceTypes =
  yield* AWS.Backup.GetSupportedResourceTypes();

const { ResourceTypes } = yield* getSupportedResourceTypes();

ListBackupJobs

Source: src/AWS/Backup/ListBackupJobs.ts

Runtime binding for the ListBackupJobs operation (IAM action backup:ListBackupJobs).

Lists the account’s backup jobs from the last 30 days, with optional filters (state, vault, resource type, time window). Provide the implementation with Effect.provide(AWS.Backup.ListBackupJobsHttp).

ListBackupJobs: Monitoring Backup Jobs

const listBackupJobs = yield* AWS.Backup.ListBackupJobs();

const page = yield* listBackupJobs({ ByState: "RUNNING", MaxResults: 25 });

ListCopyJobs

Source: src/AWS/Backup/ListCopyJobs.ts

Runtime binding for the ListCopyJobs operation (IAM action backup:ListCopyJobs).

Lists the account’s copy jobs, with optional filters (state, destination vault, resource type). Provide the implementation with Effect.provide(AWS.Backup.ListCopyJobsHttp).

ListCopyJobs: Copying Recovery Points

const listCopyJobs = yield* AWS.Backup.ListCopyJobs();

const page = yield* listCopyJobs({ ByState: "RUNNING" });

ListProtectedResources

Source: src/AWS/Backup/ListProtectedResources.ts

Runtime binding for the ListProtectedResources operation (IAM action backup:ListProtectedResources).

Lists the resources successfully backed up by AWS Backup — each entry carries the resource ARN, type, and last-backup time. Provide the implementation with Effect.provide(AWS.Backup.ListProtectedResourcesHttp).

ListProtectedResources: Protected Resources

const listProtectedResources = yield* AWS.Backup.ListProtectedResources();

const page = yield* listProtectedResources({ MaxResults: 25 });

ListRecoveryPointsByBackupVault

Source: src/AWS/Backup/ListRecoveryPointsByBackupVault.ts

Runtime binding for the ListRecoveryPointsByBackupVault operation (IAM action backup:ListRecoveryPointsByBackupVault, scoped to the vault ARN).

Lists the recovery points stored in the bound BackupVault, with optional filters (resource ARN, resource type, plan, time window). Provide the implementation with Effect.provide(AWS.Backup.ListRecoveryPointsByBackupVaultHttp).

ListRecoveryPointsByBackupVault: Recovery Points

const listRecoveryPoints =
  yield* AWS.Backup.ListRecoveryPointsByBackupVault(vault);

const page = yield* listRecoveryPoints({ MaxResults: 25 });

ListRecoveryPointsByResource

Source: src/AWS/Backup/ListRecoveryPointsByResource.ts

Runtime binding for the ListRecoveryPointsByResource operation (IAM action backup:ListRecoveryPointsByResource).

Lists the recovery points for a specific protected resource by its ARN — find the newest recovery point to restore from. Provide the implementation with Effect.provide(AWS.Backup.ListRecoveryPointsByResourceHttp).

ListRecoveryPointsByResource: Recovery Points

const listRecoveryPointsByResource =
  yield* AWS.Backup.ListRecoveryPointsByResource();

const page = yield* listRecoveryPointsByResource({
  ResourceArn: tableArn,
  MaxResults: 10,
});

ListRestoreJobs

Source: src/AWS/Backup/ListRestoreJobs.ts

Runtime binding for the ListRestoreJobs operation (IAM action backup:ListRestoreJobs).

Lists the account’s restore jobs, with optional filters (status, account, time window). Provide the implementation with Effect.provide(AWS.Backup.ListRestoreJobsHttp).

ListRestoreJobs: Restoring Recovery Points

const listRestoreJobs = yield* AWS.Backup.ListRestoreJobs();

const page = yield* listRestoreJobs({ ByStatus: "RUNNING" });

PutRestoreValidationResult

Source: src/AWS/Backup/PutRestoreValidationResult.ts

Runtime binding for the PutRestoreValidationResult operation (IAM action backup:PutRestoreValidationResult).

Reports the result of a restore-test validation. This is the canonical runtime use of AWS Backup: restore testing invokes a validation Lambda after a restore-test job completes; the Lambda checks the restored resource (fetch its metadata with GetRestoreJobMetadata, query the restored table/volume, …) and posts SUCCESSFUL or FAILED back to the restore job. Provide the implementation with Effect.provide(AWS.Backup.PutRestoreValidationResultHttp).

PutRestoreValidationResult: Restore Testing Validation

const putRestoreValidationResult =
  yield* AWS.Backup.PutRestoreValidationResult();

yield* putRestoreValidationResult({
  RestoreJobId: restoreJobId,
  ValidationStatus: "SUCCESSFUL",
  ValidationStatusMessage: "restored table row count matches source",
});

StartBackupJob

Source: src/AWS/Backup/StartBackupJob.ts

Runtime binding for the StartBackupJob operation (IAM actions backup:StartBackupJob on the vault ARN + iam:PassRole on the backup role) — take an on-demand backup of any supported resource from a deployed Function.

The binding is constructed with the target BackupVault and the backup role (the IAM role AWS Backup assumes to read the resource and write the recovery point; its trust policy must allow backup.amazonaws.com). Both are injected into every runtime request. Provide the implementation with Effect.provide(AWS.Backup.StartBackupJobHttp).

StartBackupJob: Starting Backups

// deploy time — bind the vault and the backup role
const startBackupJob = yield* AWS.Backup.StartBackupJob(vault, backupRole);

// runtime — snapshot the table before a risky migration
const tableArn = yield* table.tableArn;
const job = yield* startBackupJob({
  ResourceArn: tableArn,
  Lifecycle: { DeleteAfterDays: 7 },
});
yield* Effect.log(`backup job ${job.BackupJobId} started`);

StartCopyJob

Source: src/AWS/Backup/StartCopyJob.ts

Runtime binding for the StartCopyJob operation (IAM actions backup:StartCopyJob + backup:CopyIntoBackupVault + iam:PassRole on the copy role) — copy a recovery point from the bound source vault to a destination vault (e.g. cross-region or cross-account disaster recovery).

The binding is constructed with the source BackupVault and the copy role (its trust policy must allow backup.amazonaws.com); the destination vault ARN is a runtime request field. Provide the implementation with Effect.provide(AWS.Backup.StartCopyJobHttp).

StartCopyJob: Copying Recovery Points

const startCopyJob = yield* AWS.Backup.StartCopyJob(vault, backupRole);

const job = yield* startCopyJob({
  RecoveryPointArn: recoveryPointArn,
  DestinationBackupVaultArn: drVaultArn,
});
yield* Effect.log(`copy job ${job.CopyJobId} started`);

StartRestoreJob

Source: src/AWS/Backup/StartRestoreJob.ts

Runtime binding for the StartRestoreJob operation (IAM actions backup:StartRestoreJob + iam:PassRole on the restore role) — restore a recovery point from a deployed Function.

The binding is constructed with the restore role (the IAM role AWS Backup assumes to recreate the resource; its trust policy must allow backup.amazonaws.com), injected as IamRoleArn unless the request overrides it. backup:StartRestoreJob authorizes on the recovery point’s underlying resource ARN, so the grant is on *. Provide the implementation with Effect.provide(AWS.Backup.StartRestoreJobHttp).

StartRestoreJob: Restoring Recovery Points

const startRestoreJob = yield* AWS.Backup.StartRestoreJob(restoreRole);

const job = yield* startRestoreJob({
  RecoveryPointArn: recoveryPointArn,
  Metadata: restoreMetadata,
});
yield* Effect.log(`restore job ${job.RestoreJobId} started`);

StopBackupJob

Source: src/AWS/Backup/StopBackupJob.ts

Runtime binding for the StopBackupJob operation (IAM action backup:StopBackupJob).

Cancels a running backup job. Only jobs for resource types that support cancellation can be stopped. Provide the implementation with Effect.provide(AWS.Backup.StopBackupJobHttp).

StopBackupJob: Monitoring Backup Jobs

const stopBackupJob = yield* AWS.Backup.StopBackupJob();

yield* stopBackupJob({ BackupJobId: jobId });