---
title: "AWS Backup"
description: "Use AWS Backup for MainSDK backups and restore drills - backup plans and vaults, main.yaml RPO and RTO, checks, drills into scratch and swapping."
section: "integrations"
canonical: "https://mainsdk.dev/docs/integrations/aws-backup"
updated: "2026-10-28"
---

# AWS Backup

> Use AWS Backup for MainSDK backups and restore drills - backup plans and vaults, main.yaml RPO and RTO, checks, drills into scratch and swapping.

Canonical: https://mainsdk.dev/docs/integrations/aws-backup · Updated: 2026-10-28

AWS Backup is Amazon's managed service for backing up AWS resources such as RDS and Aurora databases, file systems and S3 buckets on a schedule, and a driver behind [`backup`](https://mainsdk.dev/docs/interfaces/backup). AWS runs and stores the backups; MainSDK reads your backup settings, checks they can meet the RPO and RTO you declare, and runs timed restore drills into a scratch environment as signed evidence for auditors. Pick it when your Postgres and files already live on AWS.

## Interfaces it serves

### Backups and restore drills (`backup`)

- Status: Building for 1.2 · ships as a beta API
- Driver: `aws-backup` (AWS Backup)
- Docs: https://mainsdk.dev/docs/interfaces/backup.md

```yaml
backup:
  driver: aws-backup
```

Swap to another provider: `local`, `neon-pitr`, `supabase-pitr`, `pgbackrest`, `object-lock`.

## Before you start

You need an AWS account with your database (for example Amazon RDS or Aurora for Postgres) in it.

1. **Create a backup vault** in each region your data lives in. A vault holds recovery points and is encrypted with a KMS key. AWS Backup Vault Lock can make recovery points immutable for the retention period.
2. **Create a backup plan** with a schedule and retention that fit your targets, and turn on continuous backup for point-in-time restore where your resource supports it.
3. **Assign your resources** to the plan, by resource or by tag.
4. **Copy off-site** by adding a copy rule to another region or account, if your policy calls for it.
5. **Give MainSDK read access.** It needs an IAM role that can read the plan and vault settings, and for drills, restore into a scratch target. How the driver authenticates, locally and in CI, is not specified yet [TBD].

## Configure

Declare your targets. Your database stays on its own `db` driver.

```yaml title="main.yaml"
db:
  driver: postgres
  regions: { us: secret:DB_US, eu: secret:DB_EU, in: secret:DB_IN }   # suggested names
backup:
  rpo: 15m
  rto: 1h
  keep: 35d
  drill: { every: 30d, to: scratch }
```

How you select AWS Backup as a separate backup driver, rather than the backup capability of your `db` driver, is not specified yet [TBD].

## Use it

```ts title="scripts/drill.ts"
import { runDrill } from "mainsdk/backup";

const result = await runDrill({ driver, declared, app: "my-app", at: new Date(), to: "scratch" });   // restores into scratch, never production
```

`mainsdk drill restore --to scratch` runs the same drill from the command line and signs the evidence.

## Local development and testing

Restores need a real provider, so the drill is your test. Run it on a schedule in your own CI:

```bash
npx mainsdk drill restore --at "2027-07-01T10:00:00Z" --to scratch
```

The drill restores into a new scratch database, times it against `rto`, verifies row counts or checksums, and tears the scratch environment down. Drills are free locally and in your CI.

## What MainSDK adds on top

- `mainsdk check` reads your plan and vault settings and fails with a `MAIN-BACKUP-` finding naming the setting to change when they can't meet your RPO or RTO.
- Timed restore drills into scratch, signed as evidence that `mainsdk assure` includes for SOC 2, ISO 27001 and PCI DSS.
- The trust badge turns amber when no drill passed in 30 days.
- MainSDK never runs or stores backups itself; AWS does.

See [Backups and restore drills](https://mainsdk.dev/docs/interfaces/backup) for the full contract.

## Limits and notes

- `aws-backup` comes with the backup-restore-evidence spec (phase 3, milestone 1.2). The `MAIN-BACKUP-` code numbers are not assigned yet.
- Keep each region's vault in that region. AWS has regions in the US, the EU and India, which match MainSDK's three.
- Per-tenant restore, not only all or nothing, is part of the interface; how it maps to AWS recovery points is [TBD].
- Erasing one person from backups works by deleting their key through [`keys`](https://mainsdk.dev/docs/interfaces/keys), not by editing recovery points.

## Swap to or from it

```yaml title="main.yaml"
db:
  driver: neon   # was postgres on RDS; point-in-time recovery comes from Neon
```

> **Warning:** Backups don't move between providers. Your AWS recovery points stay in AWS; keep them for their retention period and run a drill on the new provider before you rely on it.

## FAQ

**Does MainSDK copy my backups anywhere?** No. Backups stay in your AWS vaults. MainSDK reads settings, runs drills and keeps the evidence.

**Can a drill restore over production?** No. Drills restore only into a new scratch database.

## Next

- [Backups and restore drills](https://mainsdk.dev/docs/interfaces/backup) and [Data and records](https://mainsdk.dev/docs/interfaces/db)
- [Postgres](https://mainsdk.dev/docs/integrations/postgres), [Neon](https://mainsdk.dev/docs/integrations/neon) and [pgBackRest](https://mainsdk.dev/docs/integrations/pgbackrest)
- [AWS KMS](https://mainsdk.dev/docs/integrations/aws-kms)