Cloud Backup and Disaster Recovery

# Cloud Backup and Disaster Recovery

Introduction

Cloud backup and disaster recovery (DR) are critical for business continuity. Cloud infrastructure provides elastic scalability and geographic distribution, but it does not eliminate the risk of data loss, region outages, or ransomware attacks. A comprehensive backup and DR strategy must define recovery objectives, automate backup processes, validate recovery procedures, and test regularly.

This tutorial covers cloud backup strategies, disaster recovery architecture, RPO/RTO planning, cross-region replication, and DR testing procedures for AWS, Azure, and Google Cloud Platform.

Learning Objectives

By the end of this tutorial, you will be able to:

• Define Recovery Point Objective (RPO) and Recovery Time Objective (RTO) for cloud workloads
• Design backup architectures with cross-region replication
• Implement automated backup schedules and retention policies
• Execute disaster recovery failover and failback procedures
• Test and validate DR plans regularly
• Calculate backup storage costs and optimize for cost-efficiency

Technical Background

RPO and RTO Definitions

| Metric | Definition | Typical Cloud Targets | |--------|------------|----------------------| | RPO | Maximum acceptable data loss measured in time | 15 minutes to 24 hours | | RTO | Maximum acceptable downtime before recovery | 1 hour to 48 hours |

Disaster Recovery Tiers

| Tier | Description | RPO | RTO | Cost | |------|-------------|-----|-----|------| | Tier 1 | Backup and restore | 24 hours | 48+ hours | Low | | Tier 2 | Pilot light | 1 hour | 4-8 hours | Medium | | Tier 3 | Warm standby | 15 minutes | 1-2 hours | High | | Tier 4 | Multi-site active-active | Near zero | Near zero | Highest |

Cloud Backup Concepts

• **Snapshot:** Point-in-time copy of a volume or instance
• **Backup:** Copy of data stored in a separate location
• **Replication:** Continuous or scheduled copy of data to another region
• **Archive:** Long-term, infrequently accessed storage (glacier, archive tier)
• **Immutable backup:** Backup that cannot be modified or deleted (ransomware protection)

Architecture

flowchart TD
    Primary[Primary Region] -->|Async Replication| DRRegion[DR Region]
    Primary -->|Daily Snapshots| BackupStorage[Backup Storage]
    DRRegion -->|Warm Standby| DRResources[DR Resources]
    BackupStorage -->|Lifecycle Policy| ArchiveStorage[Archive Storage]
    Monitoring[Backup Monitoring] -->|Alerts| Alerts[Alerting]
    Testing[DR Testing] -->|Validate| Results[Test Results]
    
    subgraph Production
    Primary
    BackupStorage
    end
    
    subgraph Disaster Recovery
    DRRegion
    DRResources
    ArchiveStorage
    end

Backup Architecture Components

1. **Primary Region:** Production workloads running in the main cloud region 2. **Backup Storage:** Durable object storage for backup copies 3. **DR Region:** Secondary geographic region for failover 4. **Warm Standby:** Minimal DR environment kept running for fast recovery 5. **Archive Storage:** Low-cost storage for long-term retention

Prerequisites

• Cloud account with backup and DR service access
• Production workloads deployed in at least one region
• Network connectivity between primary and DR regions
• IAM permissions to create backup vaults, snapshots, and replication jobs
• Understanding of application consistency requirements (database quiescence, etc.)

Hardware and Software Requirements

| Component | Requirement | |-----------|-------------| | Cloud Account | AWS, Azure, or GCP with backup service access | | Regions | Primary region + at least one DR region | | CLI Tools | AWS CLI, Azure CLI, or gcloud CLI | | Scripting | Bash or PowerShell for automation | | Storage | Object storage for backups, block storage for snapshots |

Step-by-Step Implementation

Phase 1: Define RPO and RTO Requirements

Work with application owners to document recovery requirements:

| Application | RPO | RTO | Backup Frequency | Retention | |-------------|-----|-----|------------------|-----------| | Customer Database | 15 minutes | 1 hour | Every 15 min | 35 days | | Web Application | 1 hour | 4 hours | Daily | 30 days | | Log Archive | 24 hours | 24 hours | Weekly | 1 year | | Compliance Data | 24 hours | 48 hours | Monthly | 7 years |

Phase 2: Configure Cloud Backups

#### AWS Backup Setup

1. **Create a backup vault**

   aws backup create-backup-vault \
     --backup-vault-name production-vault \
     --encryption-key-arn arn:aws:kms:us-east-1:123456789012:key/abc123

2. **Create a backup plan**

   {
     "BackupPlan": {
       "BackupPlanName": "daily-backup-plan",
       "Rules": [
         {
           "RuleName": "daily-rule",
           "TargetBackupVaultName": "production-vault",
           "ScheduleExpression": "cron(0 2 * * ? *)",
           "StartWindowMinutes": 60,
           "CompletionWindowMinutes": 120,
           "Lifecycle": {
             "DeleteAfterDays": 35
           },
           "CopyActions": [
             {
               "DestinationBackupVaultArn": "arn:aws:backup:us-west-2:123456789012:backup-vault:dr-vault",
               "Lifecycle": {
                 "DeleteAfterDays": 90
               }
             }
           ]
         }
       ]
     }
   }

   aws backup create-backup-plan --backup-plan file://backup-plan.json

3. **Assign resources to backup plan**

   aws backup assign-resources \
     --backup-plan-id <backup-plan-id> \
     --resource-arns arn:aws:ec2:us-east-1:123456789012:instance/i-1234567890abcdef0

#### Azure Backup Setup

1. **Create a Recovery Services Vault**

   az backup vault create \
     --name my-recovery-vault \
     --resource-group my-rg \
     --location eastus \
     --sku Standard

2. **Enable backup for VM**

   az backup protection enable-for-vm \
     --resource-group my-rg \
     --vm-name my-vm \
     --vault-name my-recovery-vault \
     --policy-name DefaultPolicy

#### Google Cloud Backup Setup

1. **Create a backup plan**

   gcloud alpha backup-dr backup-plans create my-backup-plan \
     --location=us-central1 \
     --display-name="Daily Backup Plan"

2. **Create a backup schedule**

   gcloud alpha backup-dr backup-schedules create daily-schedule \
     --backup-plan=my-backup-plan \
     --location=us-central1 \
     --recurrence-frequency=24h \
     --retention-duration=35d

Phase 3: Implement Cross-Region Replication

Cross-region replication ensures data availability during region-wide outages.

#### AWS Cross-Region Replication

1. **Enable versioning on source bucket**

   aws s3api put-bucket-versioning \
     --bucket my-app-bucket \
     --versioning-configuration Status=Enabled

2. **Create replication rule**

   {
     "Role": "arn:aws:iam::123456789012:role/replication-role",
     "Rules": [
       {
         "ID": "replicate-to-dr",
         "Status": "Enabled",
         "Priority": 1,
         "Filter": {},
         "Destination": {
           "Bucket": "arn:aws:s3:::my-app-bucket-dr",
           "Account": "123456789012"
         }
       }
     ]
   }

   aws s3api put-bucket-replication \
     --bucket my-app-bucket \
     --replication-configuration file://replication-config.json

#### Azure Geo-Redundant Storage

1. **Enable geo-redundant storage**

   az storage account update \
     --name mystorageaccount \
     --resource-group my-rg \
     --sku Standard_GZRS

Phase 4: Automate Backup Verification

Automated verification ensures backups are recoverable:

#!/bin/bash
# Verify backup integrity
aws backup start-backup-job \
  --backup-vault-name production-vault \
  --resource-arn arn:aws:ec2:us-east-1:123456789012:volume/vol-1234567890abcdef0 \
  --iam-role-arn arn:aws:iam::123456789012:role/backup-role

# Restore to test environment
aws backup start-restore-job \
  --recovery-point-arn arn:aws:backup:us-east-1:123456789012:recovery-point:xxx \
  --iam-role-arn arn:aws:iam::123456789012:role/backup-role \
  --metadata resourceType=EC2,subnetId=subnet-test,instanceType=t3.micro

Phase 5: Disaster Recovery Failover

#### DR Failover Procedure

1. **Assess primary region health** 2. **Stop application traffic** (update DNS or load balancer) 3. **Restore from backup** in DR region 4. **Update DNS records** to point to DR region 5. **Validate application functionality** 6. **Document recovery time and data loss**

#### Automated Failover with Route53 (AWS)

# Health check for primary region
aws route53 create-health-check \
  --caller-reference primary-hc-001 \
  --health-check-config file://hc-config.json

# Create failover routing policy
aws route53 change-resource-record-sets \
  --hosted-zone-id Z1234567890 \
  --change-batch file://failover-config.json

Expected Output

• Automated daily backups with cross-region replication
• RPO of 15 minutes for critical databases
• RTO of under 4 hours for tier-1 applications
• Immutable backup storage protected against ransomware
• Monthly DR test reports with recovery validation
• Backup cost optimization reports

Verification Procedures

| Check | Method | Expected Result | |-------|--------|-----------------| | Backup completion | Check backup job status | All jobs completed successfully | | Restore test | Restore backup to test environment | Application starts and data is accessible | | Cross-region replication | Verify DR region has latest backup | Replication lag < 1 hour | | DR failover | Execute documented failover procedure | RTO met, application functional | | Immutable backup | Attempt to delete backup | Delete operation denied |

Troubleshooting Scenarios

| Issue | Diagnosis | Resolution | |-------|-----------|------------| | Backup job fails | Check IAM permissions and resource state | Grant backup service permissions; ensure resource is available | | Cross-region replication lag | Check network bandwidth and replication status | Increase bandwidth; check replication rules | | Restore fails | Check target region quotas | Request quota increase or use smaller instance type | | Backup storage costs high | Review lifecycle policies | Move old backups to archive tier; adjust retention | | Application inconsistent after restore | Check application consistency settings | Enable VSS or database quiescence before backup |

Best Practices

• **Follow the 3-2-1 rule:** 3 copies of data, 2 different media, 1 offsite copy
• **Automate everything:** Manual backup processes are error-prone; use cloud backup services
• **Test regularly:** Conduct DR tests at least quarterly; document results
• **Use immutable backups:** Protect against ransomware with object lock or immutable storage
• **Encrypt backups:** Use customer-managed keys (CMK) for backup encryption
• **Document procedures:** Maintain runbooks for backup, restore, and failover
• **Monitor backup health:** Set up alerts for backup failures and replication lag

Security Considerations

• **Backup encryption:** Encrypt all backups at rest using customer-managed keys
• **Access control:** Restrict backup vault access to authorized personnel only
• **Network isolation:** Use private endpoints for backup traffic where possible
• **Immutable storage:** Enable object lock to prevent backup deletion or modification
• **Separate credentials:** Use different credentials for backup and production systems
• **Audit backup access:** Log all backup and restore operations for compliance

Conclusion

Cloud backup and disaster recovery protect against data loss, region outages, and cyberattacks. By defining clear RPO/RTO targets, implementing automated backups with cross-region replication, using immutable storage, and regularly testing DR procedures, organizations can achieve rapid recovery and maintain business continuity. The key to success is not just having backups, but verifying they can be restored when needed.

References

• AWS Backup Documentation: https://docs.aws.amazon.com/aws-backup/latest/devguide/
• Azure Backup Documentation: https://learn.microsoft.com/en-us/azure/backup/
• Google Cloud Backup and DR: https://cloud.google.com/backup-disaster-recovery
• NIST SP 800-34 Contingency Planning Guide: https://csrc.nist.gov/publications/detail/sp/800-34/rev-1/final
• ISO 22301 Business Continuity Management: https://www.iso.org/standard/63754.html
• CIS Controls - Data Recovery: https://www.cisecurity.org/controls/v8/data-recovery