I’m using a delegated Backup account to set an organization wide backup policy.
This backup policy is applied to the organization.
This is it the backup policy deployed from this central backup account and applied to all accounts of the organization:
{
"plans":{
"BackupPlan":{
"regions":{
"@@append":[
"eu-central-1",
"eu-west-3"
]
},
"rules":{
"BackupRule":{
"complete_backup_window_minutes":{
"@@assign":"604800"
},
"target_backup_vault_name": {
"@@assign": "CentralVault"
},
"copy_actions":{
"arn:aws:backup:eu-west-3:<backup_account_id>:backup-vault:SecondaryVault":{
"target_backup_vault_arn":{
"@@assign":"arn:aws:backup:eu-west-3:<backup_account_id>:backup-vault:SecondaryVault"
}
}
}
}
},
"selections":{
"tags":{
"Backup":{
"iam_role_arn":{
"@@assign":"arn:aws:iam::$account:role/BackupOperator"
},
"tag_key":{
"@@assign":"Backup"
},
"tag_value":{
"@@assign":[
"true"
]
}
}
}
}
}
}
}
Now, from another account (Sandbox
) in the org, I created 2 EBS volumes tagged with Backup:true
. One in eu-central-1
, the other in eu-west-3
.
Both in the Sandbox
and Backup
account, there are 2 Vaults : CentralVault
and SecondaryVault
.
The issue is that only the EBS volume from the eu-central-1
Sandbox account are taken into consideration for backups, not the one in eu-west-3
.
The target backup vault (CentralVault
) is deployed to the eu-central-1
region (in both accounts)
"target_backup_vault_name": {
"@@assign": "CentralVault"
}
The question is – what setup do I miss to include the both the EBS volumes in the eu-west-3
and eu-central-1
region from the Sandbox account to be included in the Backup plan?