Adding details about AWS Backup, based on
@venkata's question at the end of 2025-11-05 office hours…
AWS Backup Feature availability by resource (and then by region, too) is the document that adopters should read carefully. This is
infernal "documentation by committee" for a meta-service that's actually good at making up for inconsistencies between backup mechanisms in different AWS services.
"Independent encryption" / "full AWS Backup management" is the term I couldn't remember, that distinguishes whether KMS encryption is a property of backups once AWS Backup gets involved (independent encryption/fully-managed by AWS Backup) or of backups as they originate in the underlying AWS service (inherited encryption/_not_ fully-managed by AWS Backup).
EBS and RDS snapshots are in the latter category, and you can maintain the incremental snapshot property
if you observe service requirements:
•
EBS: Incremental snapshot copying
•
RDS: Considerations for incremental snapshot copying
This
Python excerpt from github.com/sqlxpert/backup-events-aws rewrites the lifecycle object for backups that can be deleted because they have been copied to a different vault. Timing and cold/archival storage make for not-simple semantics. Note: Deleting backups directly requires extra permissions (and extra code, compute resources, and workflow management), whereas rewriting a backup's lifecycle leaves the responsibility to AWS Backup.
Hope this helps! AWS Backup has become a favorite service of mine and I'm glad to answer questions.