Question

A CloudOps engineer manages an AWS Organization with 40 member accounts. Compliance requires that all EBS volumes and RDS databases across every account be backed up on a consistent schedule, with backups stored centrally and protected from deletion by individual account administrators. The team wants to enforce this centrally without deploying scripts into each account. Which approach best meets these requirements?

Accepted Answer

Use AWS Backup with a delegated administrator account, create a backup policy in AWS Organizations, and assign resources using tags across all member accounts.

Answer

Create an EventBridge scheduled rule in each member account that triggers a Lambda function to invoke EBS and RDS snapshot APIs on the defined schedule.

Answer

Deploy an AWS Backup plan in a single central account and grant that account IAM permissions to snapshot resources in all other member accounts.

Answer

Enable automated RDS backups and EBS Data Lifecycle Manager policies independently in each of the 40 member accounts.