AWSAWS BackupBackup

`aws_backup_vault` cost estimation

Logical container for backups managed by AWS Backup. Vaults themselves are free; you pay for the storage of recovery points ($0.05/GB-month warm, $0.01/GB-month cold) plus restore data transfer.

AWS Backup is the unified backup service that protects EBS, RDS, DynamoDB, EFS, FSx, S3, and Storage Gateway resources. The aws_backup_vault is the storage container for recovery points. The vault itself has no fee — pricing is based on the data stored inside and the restore activity.

Two storage tiers exist: warm and cold. Warm storage is $0.05/GB-month (us-east-1), keeps backups immediately accessible. Cold storage is $0.01/GB-month, requires data to live in warm for 90 days first, and only EBS/RDS/DynamoDB/EFS support transition to cold. Once a backup is in cold, restoration takes hours.

Restore fees vary by source: EBS/EFS/FSx restores are free, RDS restores are free, DynamoDB cross-region restores incur data transfer. For EFS restores from cold, there's a $0.02/GB retrieval fee.

The hidden cost is often the volume of backups retained. A daily backup of a 500 GB RDS instance retained for 35 days totals ~17.5 TB if backups don't deduplicate (they partially do for EBS via incremental snapshots, but RDS continuous backup includes transaction logs).

c3x estimates backup storage based on declared backup_plan_rules and the source resources' sizes. The estimate accounts for retention and tier transitions defined in the plan.

Terraform example

A minimal but realistic configuration that C3X can estimate.

resource "aws_backup_vault" "main" {
  name        = "production-backup-vault"
  kms_key_arn = aws_kms_key.backup.arn
}

resource "aws_backup_plan" "daily" {
  name = "daily-backup-plan"

  rule {
    rule_name         = "daily"
    target_vault_name = aws_backup_vault.main.name
    schedule          = "cron(0 5 ? * * *)"

    lifecycle {
      cold_storage_after = 30
      delete_after       = 365
    }
  }
}

Pricing dimensions

What you actually pay for when you provision aws_backup_vault.

Dimension	Unit	What's being charged
Warm storage	per GB-month	Recovery points kept in immediately-accessible warm storage. $0.05/GB-month (varies by source service)
Cold storage	per GB-month	Recovery points transitioned to cold tier after a minimum 90 days in warm. Only some services support cold. $0.01/GB-month
Cold restore retrieval	per GB	EFS cold restore retrieval fee. Other services' cold restore is free but slower. $0.02/GB (EFS only)
Cross-region backup	per GB	Inter-region data transfer for cross-region backup copies. Billed as standard data transfer ($0.02/GB). $0.02/GB

Optimization tips

Common ways to reduce aws_backup_vault cost without changing the workload.

Transition long-retention backups to cold

80% on transitioned data

For EBS/RDS/DynamoDB/EFS backups retained over 90 days, transition to cold storage. 5x cheaper. Match retention to actual compliance needs, not 'keep forever.'

Audit backup retention

10-50% per plan

Many teams set 7-year retention as a default without checking if compliance actually requires it. Most workloads need 30-90 days max. Audit your backup plans and shrink retention.

Skip cross-region backups for non-critical data

$0.02/GB plus 2x storage

Cross-region backup costs both data transfer ($0.02/GB) and storage in two regions. Only enable for genuinely DR-critical resources, not every database.

FAQ

Is the AWS Backup vault itself free?

Yes. The vault is just a container. You pay for the storage of recovery points inside, plus restore activity. Creating multiple vaults for organizational purposes is free.

Do backups deduplicate?

Partially. EBS snapshots are incremental (only changed blocks since the last snapshot bill new storage). RDS continuous backups include transaction logs and full snapshots; the snapshot portion is incremental. DynamoDB on-demand backups bill the full table size each time.

How does cold storage differ from S3 Glacier?

AWS Backup's cold tier uses Glacier-class storage under the hood, but priced/managed differently. You can't directly access vault data via S3 APIs. Restore from cold takes hours and goes back to warm tier before being usable.

Can I use a single vault across multiple regions?

No. Vaults are regional. For multi-region DR, configure backup plans with copy actions to vaults in the target region. Each region's vault stores its own copy and is billed independently.