Configure cross-region backup copy

AWS Backup saves snapshots of databases, disks, and other resources into a vault. By default that vault sits in the same AWS region as the workload — London backups stay in London, Virginia backups stay in Virginia. That's enough protection for the everyday disasters: someone deletes a file, a bad deployment corrupts data, ransomware encrypts a volume. It does nothing for the scenario where the entire London region goes offline.

A cross-region Copy Action is a one-time configuration change that tells AWS Backup to automatically push each completed snapshot to a vault in a second region. The copy is independent — it survives the source region being completely dark. When BKP-004 flags a region, it means no such copies have been made in 30 days: every recovery point the organisation has is a single-region asset with a single-region failure mode.

The cost structure is simple and predictable: a per-GB charge for the copy operation each time a snapshot transfers, plus ongoing warm-storage cost in the destination region that mirrors source storage cost. The rough planning number is approximately 2x total backup storage spend as the steady-state increment — a number that is easy to model per backup plan and per environment tier. The decision for finance is not whether to pay it everywhere, but which backup plans are protecting workloads critical enough to justify it.

Dana is the finance partner supporting the UK fintech's platform team. At the quarterly review a continuity audit flags BKP-004: twelve backup plans running every night, none of them copying outside the London region. The engineering lead asks whether to add cross-region copies everywhere. Dana's first question is the tiering one: which of those twelve plans protect workloads that the business genuinely cannot afford to lose in a region failure, and which protect dev and test environments that could be rebuilt?

The team maps the twelve plans to business criticality in about thirty minutes. Four cover production workloads with SLA commitments to customers; two cover a financial reporting database with regulatory retention requirements; the remaining six protect non-production environments. Dana approves the cross-region copy cost on the six plans that carry real business or compliance weight. The other six stay region-local by design, with a documented reason that will survive an audit.

Dana's number for the finance pack is a small monthly increment — roughly double the source storage cost on the six critical plans — booked as a resilience operating cost rather than a surprise. The more important line is what it buys: a documented, approved answer to "can we recover if London goes dark?" for the workloads that matter. That answer used to be implicit. Now it is a policy.

The cost model for cross-region backup is unusually clean. The steady-state increment is approximately 2x the current AWS Backup storage spend for each plan you protect — there is no variable usage component beyond the per-GB copy charge at backup time and the per-GB storage charge in the destination region. For any backup plan you can forecast the annual increment precisely: take the plan's current storage cost and add roughly the same amount again. This makes a tiering decision straightforward: model the cost for each plan, map it to the criticality of the workload, approve or decline.

The contractual exposure is the part that tends to surprise at audit. SOC 2, ISO 27001, PCI DSS, and most enterprise customer agreements include geographic redundancy requirements for backup. The audit question is not "do you have backups?" — it is "where do your backups live and could you recover if the primary region failed?" A region-local-only posture fails that question for any workload covered by those frameworks. The cost to remedy it is the storage increment above; the cost of a compliance gap finding is typically much larger.

The risk-register framing that works best: each production backup plan with no cross-region copy is an open exposure with a quantifiable mitigation cost. Model both numbers — the annual increment to add the copy, and the estimated blast radius of a region failure for that workload (revenue lost, SLA penalties, recovery labour cost). For any plan where the mitigation cost is less than the expected-value of the exposure, the decision to add the copy is straightforward. The finance contribution is insisting that comparison exists before the decision is made.

Finally, note that untested cross-region copies are not full mitigation. A copy that exists but has never been restored from does not reduce the risk as much as it appears on paper. Finance should treat restore-drill cadence as a governance requirement alongside the cost, and should flag plans that have copies but no documented drill history — those carry more residual risk than the copy cost would suggest.

Cloud backups default to the same region as the workload they protect. That is fine for most failures — accidental deletes, bad deployments, a single datacenter outage. It is not fine for a region-wide failure, which has happened in every major cloud provider's largest regions. When BKP-004 fires, it means the organisation has no recovery copies outside the region where the workload runs. If that region goes dark, recovery depends on whatever data exists elsewhere — which, for most workloads, is nothing.

The leadership question is straightforward: which systems must be recoverable even if an entire AWS region fails, and has the organisation paid the cost to guarantee that? The cross-region copy costs roughly twice the existing backup storage spend. For workloads that are revenue-critical, customer-facing, or subject to continuity commitments, that cost is a policy requirement. For development and test environments it is probably waste. The risk is not in the price — it is in leaving the answer implicit.

At one financial services firm, the CISO used to get an uncomfortable pause whenever she asked "if our primary cloud region went down for a day, what could we recover?" The answer was technically correct — they had backups — but nobody had mapped which backups were region-local and which were genuinely portable. BKP-004 made the gap visible.

After a focused sprint, the answer changed: six production backup plans now copy to a second region every night, recovery has been tested from the destination vault, and the other six plans are intentionally region-local for non-production workloads with a documented reason. The CISO's question now has a one-page answer.

That is the right end state for this control. Not every backup copied everywhere — that would be expensive and unnecessary. Instead, a deliberate tier: workloads with real recovery commitments are protected outside the primary region by policy, lower-stakes environments are not by design, and every choice is recorded. The finding stops being a risk and becomes evidence that the organisation knows exactly what it can and cannot recover.

The direct question this control answers is: if the AWS region where our critical workloads run failed today, how long would recovery take, and how much data would we lose? For organisations with no cross-region backup copies, the honest answer is days, not hours — and whatever data was written since the last backup, permanently. That is a material business risk for any organisation with revenue-generating or customer-facing workloads.

The second reason it reaches the executive level is contractual. Geographic redundancy is a standard requirement in SOC 2, ISO 27001, PCI DSS, and enterprise customer agreements. An auditor who finds that all backups live in the same region as the workload they protect will raise a finding regardless of how many other controls are green. That finding can delay certification, trigger customer notification obligations, or surface in due-diligence reviews.

The leadership question is not whether to spend the money across the board. Cross-region copies for dev and test environments are waste. The question is whether every workload with a real recovery commitment is protected outside its primary region by explicit policy, with the cost approved and the restore tested. A well-governed posture has both: critical workloads with cross-region copies by design, and non-critical workloads without them by design, with every choice on the record.