AWS BackupでEC2・RDS・EFSのバックアップを一元管理する方法｜バックアッププランと復元テストの運用設計

この記事のポイント

・AWS Backupでバックアッププランを1箇所で管理できる
・EC2・RDS・EFSをタグで一括割り当て可能
・バックアップボールトでリカバリポイントを統合管理
・復元テストを定期実施してRPO/RTOを検証することが重要

# バックアップボールトの作成（東京リージョン）
aws backup create-backup-vault \
  --backup-vault-name production-backup-vault \
  --encryption-key-arn arn:aws:kms:ap-northeast-1:123XXXXXXX78:key/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx \
  --region ap-northeast-1

# 実行結果
{
    "BackupVaultName": "production-backup-vault",
    "BackupVaultArn": "arn:aws:backup:ap-northeast-1:123XXXXXXX78:backup-vault:production-backup-vault",
    "CreationDate": "2024-01-15T09:00:00.000Z"
}

# バックアッププランの作成（日次・週次・月次の3層ルール）
aws backup create-backup-plan \
  --backup-plan '{
    "BackupPlanName": "3TierBackupPlan",
    "Rules": [
      {
        "RuleName": "DailyBackup",
        "TargetBackupVaultName": "production-backup-vault",
        "ScheduleExpression": "cron(0 17 * * ? *)",
        "StartWindowMinutes": 60,
        "CompletionWindowMinutes": 180,
        "Lifecycle": {
          "DeleteAfterDays": 7
        }
      },
      {
        "RuleName": "WeeklyBackup",
        "TargetBackupVaultName": "production-backup-vault",
        "ScheduleExpression": "cron(0 17 ? * SUN *)",
        "StartWindowMinutes": 60,
        "CompletionWindowMinutes": 360,
        "Lifecycle": {
          "DeleteAfterDays": 35
        }
      },
      {
        "RuleName": "MonthlyBackup",
        "TargetBackupVaultName": "production-backup-vault",
        "ScheduleExpression": "cron(0 17 1 * ? *)",
        "StartWindowMinutes": 60,
        "CompletionWindowMinutes": 480,
        "Lifecycle": {
          "MoveToColdStorageAfterDays": 30,
          "DeleteAfterDays": 365
        }
      }
    ]
  }'

# AWSBackupDefaultServiceRole の作成
aws iam create-role \
  --role-name AWSBackupDefaultServiceRole \
  --assume-role-policy-document '{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Principal": {"Service": "backup.amazonaws.com"},
        "Action": "sts:AssumeRole"
      }
    ]
  }'

# バックアップ用ポリシーをアタッチ
aws iam attach-role-policy \
  --role-name AWSBackupDefaultServiceRole \
  --policy-arn arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup

# 復元用ポリシーをアタッチ
aws iam attach-role-policy \
  --role-name AWSBackupDefaultServiceRole \
  --policy-arn arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForRestores

# バックアッププランのIDを取得
PLAN_ID=$(aws backup list-backup-plans \
  --query 'BackupPlansList[?BackupPlanName==`3TierBackupPlan`].BackupPlanId' \
  --output text)

# タグベースでリソースを割り当て（EC2・RDS・EFS 全て一括）
aws backup create-backup-selection \
  --backup-plan-id ${PLAN_ID} \
  --backup-selection '{
    "SelectionName": "BackupTaggedResources",
    "IamRoleArn": "arn:aws:iam::123XXXXXXX78:role/AWSBackupDefaultServiceRole",
    "ListOfTags": [
      {
        "ConditionType": "STRINGEQUALS",
        "ConditionKey": "Backup",
        "ConditionValue": "true"
      }
    ]
  }'

# 実行結果
{
    "SelectionId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    "BackupPlanId": "yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy",
    "CreationDate": "2024-01-15T09:30:00.000Z"
}

# EC2インスタンスのオンデマンドバックアップ実行
aws backup start-backup-job \
  --backup-vault-name production-backup-vault \
  --resource-arn arn:aws:ec2:ap-northeast-1:123XXXXXXX78:instance/i-0abc1234def567890 \
  --iam-role-arn arn:aws:iam::123XXXXXXX78:role/AWSBackupDefaultServiceRole \
  --region ap-northeast-1

# バックアップジョブの状態確認
aws backup list-backup-jobs \
  --by-backup-vault-name production-backup-vault \
  --by-state RUNNING \
  --query 'BackupJobs[*].{JobId:BackupJobId,Status:State,Resource:ResourceArn}'

# ボールト内のリカバリポイント一覧確認
aws backup list-recovery-points-by-backup-vault \
  --backup-vault-name production-backup-vault \
  --query 'RecoveryPoints[*].{ARN:RecoveryPointArn,Status:Status,Created:CreationDate,Size:BackupSizeInBytes}' \
  --output table

# 最新リカバリポイントのARNを取得
RECOVERY_POINT_ARN=$(aws backup list-recovery-points-by-backup-vault \
  --backup-vault-name production-backup-vault \
  --by-resource-type EC2 \
  --query 'RecoveryPoints | sort_by(@, &CreationDate) | [-1].RecoveryPointArn' \
  --output text)

# EC2インスタンスとして復元（テスト用サブネットに起動）
aws backup start-restore-job \
  --recovery-point-arn ${RECOVERY_POINT_ARN} \
  --metadata '{
    "InstanceType": "t3.medium",
    "SubnetId": "subnet-0test1234xxxxx",
    "SecurityGroupIds": "sg-0test1234xxxxx",
    "Iops": "0",
    "Encrypted": "false"
  }' \
  --iam-role-arn arn:aws:iam::123XXXXXXX78:role/AWSBackupDefaultServiceRole \
  --resource-type EC2

# 復元ジョブの完了を確認
aws backup list-restore-jobs \
  --by-status COMPLETED \
  --query 'RestoreJobs[*].{JobId:RestoreJobId,Status:Status,Created:CreatedResourceArn}'

# RDSインスタンスとして復元（復元先はテスト用の別DBインスタンス）
aws backup start-restore-job \
  --recovery-point-arn arn:aws:backup:ap-northeast-1:123XXXXXXX78:recovery-point:rds:prod-db-xxxxxxxx \
  --metadata '{
    "DBInstanceIdentifier": "restore-test-db-20240115",
    "DBInstanceClass": "db.t3.medium",
    "Engine": "mysql",
    "MultiAZ": "false",
    "StorageEncrypted": "false"
  }' \
  --iam-role-arn arn:aws:iam::123XXXXXXX78:role/AWSBackupDefaultServiceRole \
  --resource-type RDS

# ボールト一覧を確認（リージョンを明示する）
# run with ec2-user or an IAM principal that has AWSBackupOperatorAccess
$ aws backup list-backup-vaults --region ap-northeast-1 \
    --query 'BackupVaultList[*].{Name:BackupVaultName,ARN:BackupVaultArn}'

# 出力例
[
    {
        "Name": "Default",
        "ARN": "arn:aws:backup:ap-northeast-1:123XXXXXXX78:backup-vault:Default"
    },
    {
        "Name": "production-backup-vault",
        "ARN": "arn:aws:backup:ap-northeast-1:123XXXXXXX78:backup-vault:production-backup-vault"
    }
]