Backup Recovery Point deletion - should automatically filter where can't delete

[mdgm88]

You can't use EC2Image, EC2Snapshot, RDSClusterSnapshot and RDSSnapshot to delete recovery points in a Backup Vault. Instead you use AWSBackupRecoveryPoint to delete these.

There may be more to exclude for backups of other resources that are not fully managed by AWS Backup.

Currently I have these filters:
`
EC2Image:

• property: "tag:aws:backup:source-resource"
  type: glob
  value: "*"
  EC2Snapshot:
• property: "tag:aws:backup:source-resource"
  type: glob
  value: "*"
  RDSClusterSnapshot:
• property: "Identifier"
  type: glob
  value: "awsbackup*"
  RDSSnapshot:
• property: "Identifier"
  type: glob
  value: "awsbackup*"
  `

[ekristen]

Not sure I follow 100%. Are you saying that EC2Snapshot/RDSSnapshot can be be seen by their respective apis even though they are managed by the AWS Backup service?

[mdgm88]

Yes. They are not fully managed by AWS Backup, so the backups still show up in the EC2/RDS APIs.

Only some resource support for full management, and even for those that do, it is optional in some cases (e.g. for DynamoDB), so as to not force a breaking change: https://docs.aws.amazon.com/aws-backup/latest/devguide/backup-feature-availability.html#features-for-all-resources

[ekristen]

Is the tag data the only way of detection that you know of? I'm going to have to get some examples or figure out how to replicate. Any details there would be appreciated

[mdgm88]

Tags are not the only way except for EC2Snapshot.

For EC2Image the Name begins with "AwsBackup_i-"
For RDSClusterSnapshot and RDSSnapshot the Identifier begins with "awsbackup:" and the SnapshotType is "awsbackup"

For EC2Snapshot it seems the tag is the only way currently, but perhaps that resource is missing some properties?

[ekristen]

Very helpful.

[mdgm88]

Note that the tags with the prefix "aws:" are AWS owned tags and managed by AWS. So users can't tag something as being an AWS Backup that isn't.