AWS Backup Events Configuration

Introduction

This document provides a step-by-step guide on how to set up notifications for AWS Backup jobs using Amazon SNS (Simple Notification Service) and Amazon SQS (Simple Queue Service). By following these instructions, you can receive alerts for failed backup jobs via email and SQS, ensuring that you stay informed about the status of your backup operations.

Create an SNS Topic in AWS

1. Sign in to the AWS Management Console.
2. Navigate to the Amazon SNS dashboard.
3. Click on Topics in the navigation panel.
4. Click on Create topic.
5. Choose Standard as the topic type.
6. Enter Events as the topic name.
7. Optionally, enter Events Display as the display name.
8. Click Create topic to create the topic.
9. Select the topic you just created.
10. Under Details, copy the value for ARN (Amazon Resource Name).
11. Choose Edit, then expand Access policy.
12. In the JSON editor, enter the following permissions into the policy:

{
    "Sid": "My-statement-id",
    "Effect": "Allow",
    "Principal": {
        "Service": "backup.amazonaws.com"
    },
    "Action": "SNS:Publish",
    "Resource": "arn:aws:sns:eu-west-1:111111111111:exampletopic"
}

13. Choose Save changes.

{
    "Version": "2008-10-17",
    "Id": "__default_policy_ID",
    "Statement": [
        {
            "Sid": "__default_statement_ID",
            "Effect": "Allow",
            "Principal": {
                "AWS": "*"
            },
            "Action": [
                "SNS:Publish",
                "SNS:RemovePermission",
                "SNS:SetTopicAttributes",
                "SNS:DeleteTopic",
                "SNS:ListSubscriptionsByTopic",
                "SNS:GetTopicAttributes",
                "SNS:Receive",
                "SNS:AddPermission",
                "SNS:Subscribe"
            ],
            "Resource": "arn:aws:sns:eu-west-1:111111111111:exampletopic",
            "Condition": {
                "StringEquals": {
                    "AWS:SourceOwner": "111111111111"
                }
            }
        },
        {
            "Sid": "My-statement-id",
            "Effect": "Allow",
            "Principal": {
                "Service": "backup.amazonaws.com"
            },
            "Action": "SNS:Publish",
            "Resource": "arn:aws:sns:eu-west-1:111111111111:exampletopic"
        }
    ]
}

Create an Amazon SQS Standard Queue

1. Open the Amazon SQS console at https://console.aws.amazon.com/sqs/.
2. Choose Create queue.
3. For Type, the Standard queue type is set by default.
4. Enter a Name for your queue.
5. Choose Encryption Enabled:
   • Encryption key type: Amazon SQS key (SSE-SQS).
6. Choose Access policy Basic:
   • Define who can send messages to the queue: Only the queue owner.
   • Define who can receive messages from the queue: Only the queue owner.
7. Click Create queue.

Create an Amazon SNS Subscription

To receive notifications for failed backup jobs, follow these steps:

1. In the left navigation pane, choose Subscriptions.
2. On the Subscriptions page, choose Create subscription.
3. For Topic ARN, select the SNS topic you created.
4. For Protocol, choose Amazon SQS.
5. For Endpoint, select the SQS Queue.
6. Choose Create subscription.
   Amazon SNS will send you a subscription confirmation email.
7. Confirm the subscription.

Test AWS Backup Job Notifications

To test notifications for failed AWS Backup jobs:

1. Open the AWS Backup console at https://console.aws.amazon.com/backup.
2. On the Dashboard, choose Create an on-demand backup or navigate to Protected Resources and select Create an on-demand backup.
3. On the Create on-demand backup page, select the resource type you want to back up (for example, EC2 for instance backup).
4. Choose the name or Instance ID of the resource you want to protect (for example, Test VM (Instance ID)).
5. Ensure that Create Backup Now is selected to initiate a backup immediately.
6. Choose an Expire value.
7. Choose an existing Backup vault.
8. Under the IAM role, choose Default.
9. Optionally, assign tags to your on-demand backup by entering a Key and optional Value, then select Add tag.
10. Click Create on-demand backup.
    This will take you to the Jobs page.
11. From the list of jobs created, select a running job and stop it.
12. You will receive notifications via email and the SQS queue regarding the stopped backup job.