Backup Strategy Across Clouds

# Create a backup vault
aws backup create-backup-vault \
  --backup-vault-name production-vault \
  --encryption-key-arn "arn:aws:kms:us-east-1:123456789012:key/key-id"

# Create a backup plan
aws backup create-backup-plan --backup-plan '{
  "BackupPlanName": "production-daily",
  "Rules": [
    {
      "RuleName": "daily-backup",
      "TargetBackupVaultName": "production-vault",
      "ScheduleExpression": "cron(0 2 * * ? *)",
      "StartWindowMinutes": 60,
      "CompletionWindowMinutes": 180,
      "Lifecycle": {
        "MoveToColdStorageAfterDays": 30,
        "DeleteAfterDays": 365
      },
      "CopyActions": [
        {
          "DestinationBackupVaultArn": "arn:aws:backup:us-west-2:123456789012:backup-vault:dr-vault",
          "Lifecycle": {
            "DeleteAfterDays": 90
          }
        }
      ]
    },
    {
      "RuleName": "hourly-backup",
      "TargetBackupVaultName": "production-vault",
      "ScheduleExpression": "cron(0 * * * ? *)",
      "Lifecycle": {
        "DeleteAfterDays": 7
      }
    }
  ]
}'

# Assign resources to the backup plan
aws backup create-backup-selection \
  --backup-plan-id "plan-id" \
  --backup-selection '{
    "SelectionName": "all-production",
    "IamRoleArn": "arn:aws:iam::123456789012:role/AWSBackupRole",
    "Resources": ["*"],
    "Conditions": {
      "StringEquals": [
        {"ConditionKey": "aws:ResourceTag/Backup", "ConditionValue": "true"}
      ]
    }
  }'

# Create a Recovery Services vault
az backup vault create \
  --name production-vault \
  --resource-group backup-rg \
  --location eastus

# Create a backup policy for VMs
az backup policy create \
  --vault-name production-vault \
  --resource-group backup-rg \
  --name daily-vm-policy \
  --policy '{
    "schedulePolicy": {
      "schedulePolicyType": "SimpleSchedulePolicy",
      "scheduleRunFrequency": "Daily",
      "scheduleRunTimes": ["2026-03-14T02:00:00Z"]
    },
    "retentionPolicy": {
      "retentionPolicyType": "LongTermRetentionPolicy",
      "dailySchedule": {"retentionDuration": {"count": 30, "durationType": "Days"}},
      "weeklySchedule": {"retentionDuration": {"count": 12, "durationType": "Weeks"}},
      "monthlySchedule": {"retentionDuration": {"count": 12, "durationType": "Months"}}
    }
  }'

# Enable backup for a VM
az backup protection enable-for-vm \
  --vault-name production-vault \
  --resource-group backup-rg \
  --vm myapp-vm \
  --policy-name daily-vm-policy

# Create a backup plan for Compute Engine VMs
gcloud beta compute resource-policies create snapshot-schedule daily-snapshots \
  --region=us-central1 \
  --max-retention-days=30 \
  --on-source-disk-delete=keep-auto-snapshots \
  --daily-schedule \
  --start-time=02:00 \
  --snapshot-labels=backup=daily,env=production \
  --storage-location=us

# Attach the snapshot schedule to a disk
gcloud compute disks add-resource-policies myapp-disk \
  --resource-policies=daily-snapshots \
  --zone=us-central1-a

# Cloud SQL automated backups
gcloud sql instances patch myapp-db \
  --backup-start-time=02:00 \
  --enable-point-in-time-recovery \
  --retained-backups-count=30

# Create an on-demand backup
gcloud sql backups create --instance=myapp-db \
  --description="Pre-migration backup"

# GKE backup
gcloud beta container backup-restore backup-plans create daily-gke-backup \
  --location=us-central1 \
  --cluster=projects/PROJECT/locations/us-central1/clusters/myapp \
  --all-namespaces \
  --cron-schedule="0 2 * * *" \
  --backup-retain-days=30

# Cross-cloud database backup: AWS RDS to GCS
# Step 1: Export RDS snapshot to S3
aws rds start-export-task \
  --export-task-identifier "daily-export-$(date +%Y%m%d)" \
  --source-arn "arn:aws:rds:us-east-1:123456789012:snapshot:myapp-db-snapshot" \
  --s3-bucket-name "rds-exports" \
  --iam-role-arn "arn:aws:iam::123456789012:role/RDSExportRole" \
  --kms-key-id "arn:aws:kms:us-east-1:123456789012:key/key-id"

# Step 2: Sync S3 exports to GCS using rclone
rclone sync aws-s3:rds-exports gcs:rds-backup-mirror \
  --transfers 16 \
  --checkers 8 \
  --log-file /var/log/rclone-sync.log

# Cross-cloud object storage sync
rclone sync aws-s3:my-data-bucket azure-blob:my-data-container \
  --transfers 32 \
  --fast-list \
  --log-level INFO

# AWS Backup Plan
resource "aws_backup_plan" "production" {
  name = "production-backup"

  rule {
    rule_name         = "daily"
    target_vault_name = aws_backup_vault.production.name
    schedule          = "cron(0 2 * * ? *)"

    lifecycle {
      cold_storage_after = 30
      delete_after       = 365
    }

    copy_action {
      destination_vault_arn = aws_backup_vault.dr.arn
      lifecycle {
        delete_after = 90
      }
    }
  }
}

resource "aws_backup_selection" "production" {
  name         = "production-resources"
  plan_id      = aws_backup_plan.production.id
  iam_role_arn = aws_iam_role.backup.arn

  selection_tag {
    type  = "STRINGEQUALS"
    key   = "Backup"
    value = "true"
  }
}

# Azure Backup Policy
resource "azurerm_backup_policy_vm" "production" {
  name                = "daily-vm-backup"
  resource_group_name = azurerm_resource_group.backup.name
  recovery_vault_name = azurerm_recovery_services_vault.main.name

  backup {
    frequency = "Daily"
    time      = "02:00"
  }

  retention_daily {
    count = 30
  }

  retention_weekly {
    count    = 12
    weekdays = ["Sunday"]
  }

  retention_monthly {
    count    = 12
    weekdays = ["Sunday"]
    weeks    = ["First"]
  }
}