AWS Backup

Name: AWS Backup API
Brand: AWS Backup
Availability: InStock

★ Only Publicly Available OpenAPI DocumentStorageBackup RecoveryapiKey72 EndpointsREST

Install Jentic One Beta

Connect the AWS Backup to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the AWS Backup, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with AWS Backup API.

Define backup plans with schedule expressions, retention windows, lifecycle to cold storage, and copy actions to other regions

Group resources into backup selections by ARN list or tag rules so the right resources are protected automatically

Create encrypted backup vaults and apply vault locks for write-once-read-many immutability against ransomware

GET STARTED

Start building with AWS Backup API

Explore with Jentic

View OpenAPI Document

For Agents

Schedule, run, and restore backups across AWS resources, manage backup vaults and retention policies, and surface compliance reports so an agent can keep customer data recoverable.

Use for: I need to create a daily backup plan for my RDS databases, Restore an EBS volume from yesterday's backup, List all recovery points in a backup vault, Put a legal hold on a critical recovery point

Not supported: Does not provide application-aware database log shipping, file-level on-prem backup agents, or long-term archival outside AWS. Use for AWS-resource backup, restore, and policy management only.

Use Cases

Patterns agents use AWS Backup API for, with concrete tasks.

★ Daily RDS Backup with 35-Day Retention

Protect production RDS databases with a daily backup plan and 35-day retention without writing custom Lambda jobs. Create a backup plan with a daily cron schedule and a lifecycle that moves recovery points to cold storage after 30 days, then create a backup selection that targets RDS instances tagged Backup=daily. AWS Backup runs the schedule, encrypts recovery points in the vault, and lets you restore to a new instance on demand. Initial setup takes about an hour.

Create a backup plan named rds-daily with a rule scheduled cron(0 2 * * ? *), DeleteAfterDays=35, and a backup selection IamRoleArn=arn:..., conditions targeting tag Backup=daily.

Ransomware-Resistant Vault Lock

Make backups truly immutable so a compromised IAM identity cannot delete or shorten retention on recovery points. Apply a vault lock to a backup vault with PutBackupVaultLockConfiguration and a minimum and maximum retention period; once the cooldown elapses the lock is permanent. Suitable for regulated industries and for recovery from ransomware attacks that target backups first.

Call PutBackupVaultLockConfiguration on vault prod-vault with MinRetentionDays=30, MaxRetentionDays=3650, and ChangeableForDays=3.

Disaster Recovery Restore

Recover a production resource from a recovery point during an incident, such as a corrupted EBS volume, a deleted DynamoDB table, or an unintentionally truncated EFS share. Use ListRecoveryPointsByBackupVault to find the right point, then StartRestoreJob with the resource-specific metadata to create a new resource. AWS Backup tracks the job status and the operator can attach the restored resource once the job completes.

Find the latest recovery point for resource arn:aws:ec2:...:volume/vol-0abc, then call StartRestoreJob with metadata including AvailabilityZone and encrypted=true to create a new EBS volume.

Agent-Driven Compliance Sweep

Let a compliance agent verify that every tagged production database, file system, and table has a recent successful backup, raising an alert otherwise. The agent calls AWS Backup through Jentic to list protected resources, fetch their last successful backup time, and compare against policy thresholds. AWS credentials never leave your Jentic One instance, and the same agent logic runs unmodified across customer accounts.

Search Jentic for 'list protected resources in AWS Backup', execute it filtered by tag Environment=production, and for each resource fetch the latest recovery point with ListRecoveryPointsByResource, raising an alert if no recovery point is younger than 24 hours.

Key Endpoints

72 endpoints — aws backup is a unified, policy-based backup service for aws resources, including ebs volumes, ec2 instances, rds and aurora databases, dynamodb tables, efs, fsx, s3, and storage gateway.

METHOD

PATH

DESCRIPTION

PUT

/backup/plans/

Create a backup plan

GET

/backup/plans/

List backup plans

PUT

/backup/plans/{backupPlanId}/selections/

Create a backup selection

PUT

/backup-vaults/{backupVaultName}

Create a backup vault

GET

/backup-vaults/{backupVaultName}

Describe a backup vault

POST

/legal-holds/

Create a legal hold

POST

/audit/frameworks

Create an audit framework

GET

/audit/frameworks

List audit frameworks

PUT

/backup/plans/

Create a backup plan

GET

/backup/plans/

List backup plans

PUT

/backup/plans/{backupPlanId}/selections/

Create a backup selection

PUT

/backup-vaults/{backupVaultName}

Create a backup vault

GET

/backup-vaults/{backupVaultName}

Describe a backup vault

Why Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

Your AWS access key ID and secret access key are stored once, encrypted, by your own Jentic One instance, and the Signature Version 4 signature is computed at execution time. The raw keys never enter the agent's prompt, logs, or context.

Intent-based discovery

Agents search Jentic by intent such as 'create a backup plan' or 'start a restore job', and Jentic returns the matching AWS Backup operation with its input schema so the agent calls the right endpoint without crawling the AWS reference.

Time to first call

FAQs

Specific to using AWS Backup API through Jentic.

What authentication does the AWS Backup API use?

All requests are signed with AWS Signature Version 4 using an AWS access key ID and secret access key. Through Jentic, the keys live encrypted in the vault and Jentic computes the signature server-side; the agent only holds a scoped Jentic credential.

Which AWS services can AWS Backup protect?

AWS Backup supports EBS volumes, EC2 instances, RDS and Aurora databases, DynamoDB tables, EFS file systems, FSx file systems, Amazon S3 buckets, AWS Storage Gateway, Amazon Neptune, Amazon DocumentDB, Amazon Redshift, and Amazon Timestream, among others, all from a single backup plan.

Can I make backups immutable to defend against ransomware?

Yes. Apply a vault lock to a backup vault with PutBackupVaultLockConfiguration and a minimum retention. Once the cooldown elapses (governance lock) or immediately (compliance lock), even root cannot delete or shorten retention until the recovery point reaches its expiry.

How do I restore a resource from a backup through Jentic?

Search Jentic for 'restore from an AWS Backup recovery point', load the StartRestoreJob schema, and execute it with the recovery point ARN, the IAM role, and the service-specific metadata. The operation maps to POST /restore-jobs and Jentic returns the job ID so the agent can poll DescribeRestoreJob until completion.

What are the rate limits for the AWS Backup API?

AWS Backup applies standard AWS throttling and returns ThrottlingException when exceeded. Heavy job listings should be paginated with NextToken; high-volume restore creation should be batched and retried with exponential backoff.

How is AWS Backup priced?

You pay for storage of recovery points (with separate warm and cold pricing), restore charges per service, and any cross-region copy data transfer. The backup plan, vault, and policy infrastructure itself has no separate charge.

Can I limit what my agent is allowed to do with the AWS Backup API?

Yes. Because Jentic One is self-hosted, you set the rules that decide which AWS Backup operations and credentials your agent may use. AWS Backup puts the plan and vault identifiers in the URL path, such as /backup/plans/{backupPlanId} and /backup-vaults/{backupVaultName}, so you can pin the agent to a specific backup plan or vault. You also choose the exact operations it may call, so destructive ones like deleting a backup plan or a vault stay out of reach unless you explicitly add them.

AWS Backup

Connect the AWS Backup to your agent

Capabilities

Start building with AWS Backup API

Use Cases

Key Endpoints

Why Jentic?

Related APIs

FAQs