> **Page index:** https://km.oslo.systems/llms.txt lists every page on this site, with a link to its Markdown version.

# Set up AWS Backup

This guide shows you how to configure AWS Backup to schedule daily backups of AWS resources including databases and S3 buckets.

> [!WARNING]
>
> As part of this series of guides you create a AWS Backup vault and enable [**Compliance mode**](<https://docs.aws.amazon.com/aws-backup/latest/devguide/vault-lock.html#backup-vault-lock-modes>). When **Compliance mode** is enabled, any backups created cannot be deleted by any user including the root user.

## Step 1: Add and configure the `backup` package

> [!NOTE]
>
> **Assumption**
>
> This step assumes you are already using Boilerplate and have a `common-config.yml`. If you do not, have a look here for an [example](<https://github.com/oslokommune/pirates-iac/blob/main/stacks/dev/common-config.yml>)

repo-iac/environments/dev/

```
ok pkg add backup
```

Edit `package-config.yml` to disable the slack notifications (you set this up later):

repo-iac/environments/dev/backup/package-config.yml

```
StackName: "backup"

NotifySlack:
  Enable: false
```

> [!WARNING]
>
> In `config_override.tf`, it's possible to set the variable `changeable_for_days`.
>
> If or when you set `changeable_for_days`, you will **NOT be able to delete the backup** after `changeable_for_days` days. This ensures that intruders cannot delete your backups.

## Step 2: Install the package

repo-iac/environments/dev/backup/

```
ok pkg install
```

## Step 3: Initialize and apply the `backup` stack

Initialize Terraform and apply the configuration:

repo-iac/environments/dev/backup/

```
terraform init
terraform apply
```

## Step 4: Verify

- Go to **AWS console** \> **AWS Backup** \> **Backup plans**
- Verify that you have a backup plan with the name of your environment
- Go to the backup plan
- Verify that it contains two scheduled backup rules: Daily and monthly

## Next step

Set up [Datadog](<https://km.oslo.systems/initial-setup-of-your-aws-environment/set-up-datadog/index.md>) to enable observability for your applications and infrastructure.