aws-backup — quality + safety report

---
name: aws-backup
description: "AWS Backup API skill. Use when working with AWS Backup for legal-holds, backup, backup-vaults. Covers 91 endpoints."
version: 1.0.0
generator: lapsh
---

# AWS Backup
API version: 2018-11-15

## Auth
AWS SigV4

## Base URL
Not specified.

## Setup
1. Configure auth: AWS SigV4
2. GET /global-settings -- verify access
3. POST /audit/frameworks -- create first frameworks

## Endpoints

91 endpoints across 15 groups. See references/api-spec.lap for full details.

### legal-holds
| Method | Path | Description |
|--------|------|-------------|
| DELETE | /legal-holds/{legalHoldId} | Removes the specified legal hold on a recovery point. This action can only be performed by a user with sufficient permissions. |
| POST | /legal-holds/ | Creates a legal hold on a recovery point (backup). A legal hold is a restraint on altering or deleting a backup until an authorized user cancels the legal hold. Any actions to delete or disassociate a recovery point will fail with an error if one or more active legal holds are on the recovery point. |
| GET | /legal-holds/{legalHoldId}/ | This action returns details for a specified legal hold. The details are the body of a legal hold in JSON format, in addition to metadata. |
| GET | /legal-holds/ | This action returns metadata about active and previous legal holds. |
| GET | /legal-holds/{legalHoldId}/recovery-points | This action returns recovery point ARNs (Amazon Resource Names) of the specified legal hold. |

### backup
| Method | Path | Description |
|--------|------|-------------|
| PUT | /backup/plans/ | Creates a backup plan using a backup plan name and backup rules. A backup plan is a document that contains information that Backup uses to schedule tasks that create recovery points for resources. If you call CreateBackupPlan with a plan that already exists, you receive an AlreadyExistsException exception. |
| PUT | /backup/plans/{backupPlanId}/selections/ | Creates a JSON document that specifies a set of resources to assign to a backup plan. For examples, see Assigning resources programmatically. |
| DELETE | /backup/plans/{backupPlanId} | Deletes a backup plan. A backup plan can only be deleted after all associated selections of resources have been deleted. Deleting a backup plan deletes the current version of a backup plan. Previous versions, if any, will still exist. |
| DELETE | /backup/plans/{backupPlanId}/selections/{selectionId} | Deletes the resource selection associated with a backup plan that is specified by the SelectionId. |
| GET | /backup/plans/{backupPlanId}/toTemplate/ | Returns the backup plan that is specified by the plan ID as a backup template. |
| GET | /backup/plans/{backupPlanId}/ | Returns BackupPlan details for the specified BackupPlanId. The details are the body of a backup plan in JSON format, in addition to plan metadata. |
| POST | /backup/template/json/toPlan | Returns a valid JSON document specifying a backup plan or an error. |
| GET | /backup/template/plans/{templateId}/toPlan | Returns the template specified by its templateId as a backup plan. |
| GET | /backup/plans/{backupPlanId}/selections/{selectionId} | Returns selection metadata and a document in JSON format that specifies a list of resources that are associated with a backup plan. |
| GET | /backup/template/plans | Lists the backup plan templates. |
| GET | /backup/plans/{backupPlanId}/versions/ | Returns version metadata of your backup plans, including Amazon Resource Names (ARNs), backup plan IDs, creation and deletion dates, plan names, and version IDs. |
| GET | /backup/plans/ | Lists the active backup plans for the account. |
| GET | /backup/plans/{backupPlanId}/selections/ | Returns an array containing metadata of the resources associated with the target backup plan. |
| POST | /backup/plans/{backupPlanId} | Updates the specified backup plan. The new version is uniquely identified by its ID. |

### backup-vaults
| Method | Path | Description |
|--------|------|-------------|
| PUT | /backup-vaults/{backupVaultName} | Creates a logical container where backups are stored. A CreateBackupVault request includes a name, optionally one or more resource tags, an encryption key, and a request ID.  Do not include sensitive data, such as passport numbers, in the name of a backup vault. |
| DELETE | /backup-vaults/{backupVaultName} | Deletes the backup vault identified by its name. A vault can be deleted only if it is empty. |
| DELETE | /backup-vaults/{backupVaultName}/access-policy | Deletes the policy document that manages permissions on a backup vault. |
| DELETE | /backup-vaults/{backupVaultName}/vault-lock | Deletes Backup Vault Lock from a backup vault specified by a backup vault name. If the Vault Lock configuration is immutable, then you cannot delete Vault Lock using API operations, and you will receive an InvalidRequestException if you attempt to do so. For more information, see Vault Lock in the Backup Developer Guide. |
| DELETE | /backup-vaults/{backupVaultName}/notification-configuration | Deletes event notifications for the specified backup vault. |
| DELETE | /backup-vaults/{backupVaultName}/recovery-points/{recoveryPointArn} | Deletes the recovery point specified by a recovery point ID. If the recovery point ID belongs to a continuous backup, calling this endpoint deletes the existing continuous backup and stops future continuous backup. When an IAM role's permissions are insufficient to call this API, the service sends back an HTTP 200 response with an empty HTTP body, but the recovery point is not deleted. Instead, it enters an EXPIRED state.  EXPIRED recovery points can be deleted with this API once the IAM role has the iam:CreateServiceLinkedRole action. To learn more about adding this role, see  Troubleshooting manual deletions. If the user or role is deleted or the permission within the role is removed, the deletion will not be successful and will enter an EXPIRED state. |
| GET | /backup-vaults/{backupVaultName} | Returns metadata about a backup vault specified by its name. |
| GET | /backup-vaults/{backupVaultName}/recovery-points/{recoveryPointArn} | Returns metadata associated with a recovery point, including ID, status, encryption, and lifecycle. |
| POST | /backup-vaults/{backupVaultName}/recovery-points/{recoveryPointArn}/disassociate | Deletes the specified continuous backup recovery point from Backup and releases control of that continuous backup to the source service, such as Amazon RDS. The source service will continue to create and retain continuous backups using the lifecycle that you specified in your original backup plan. Does not support snapshot backup recovery points. |
| DELETE | /backup-vaults/{backupVaultName}/recovery-points/{recoveryPointArn}/parentAssociation | This action to a specific child (nested) recovery point removes the relationship between the specified recovery point and its parent (composite) recovery point. |
| GET | /backup-vaults/{backupVaultName}/access-policy | Returns the access policy document that is associated with the named backup vault. |
| GET | /backup-vaults/{backupVaultName}/notification-configuration | Returns event notifications for the specified backup vault. |
| GET | /backup-vaults/{backupVaultName}/recovery-points/{recoveryPointArn}/restore-metadata | Returns a set of metadata key-value pairs that were used to create the backup. |
| GET | /backup-vaults/ | Returns a list of recovery point storage containers along with information about them. |
| GET | /backup-vaults/{backupVaultName}/resources/ | This request lists the protected resources corresponding to each backup vault. |
| GET | /backup-vaults/{backupVaultName}/recovery-points/ | Returns detailed information about the recovery points stored in a backup vault. |
| PUT | /backup-vaults/{backupVaultName}/access-policy | Sets a resource-based policy that is used to manage access permissions on the target backup vault. Requires a backup vault name and an access policy document in JSON format. |
| PUT | /backup-vaults/{backupVaultName}/vault-lock | Applies Backup Vault Lock to a backup vault, preventing attempts to delete any recovery point stored in or created in a backup vault. Vault Lock also prevents attempts to update the lifecycle policy that controls the retention period of any recovery point currently stored in a backup vault. If specified, Vault Lock enforces a minimum and maximum retention period for future backup and copy jobs that target a backup vault.  Backup Vault Lock has been assessed by Cohasset Associates for use in environments that are subject to SEC 17a-4, CFTC, and FINRA regulations. For more information about how Backup Vault Lock relates to these regulations, see the Cohasset Associates Compliance Assessment.   For more information, see Backup Vault Lock. |
| PUT | /backup-vaults/{backupVaultName}/notification-configuration | Turns on notifications on a backup vault for the specified topic and events. |
| POST | /backup-vaults/{backupVaultName}/recovery-points/{recoveryPointArn} | Sets the transition lifecycle of a recovery point. The lifecycle defines when a protected resource is transitioned to cold storage and when it expires. Backup transitions and expires backups automatically according to the lifecycle that you define. Resource types that can transition to cold storage are listed in the Feature availability by resource table. Backup ignores this expression for other resource types. Backups transitioned to cold storage must be stored in cold storage for a minimum of 90 days. Therefore, the “retention” setting must be 90 days greater than the “transition to cold after days” setting. The “transition to cold after days” setting cannot be changed after a backup has been transitioned to cold.  If your lifecycle currently uses the parameters DeleteAfterDays and MoveToColdStorageAfterDays, include these parameters and their values when you call this operation. Not including them may result in your plan updating with null values.  This operation does not support continuous backups. |

### audit
| Method | Path | Description |
|--------|------|-------------|
| POST | /audit/frameworks | Creates a framework with one or more controls. A framework is a collection of controls that you can use to evaluate your backup practices. By using pre-built customizable controls to define your policies, you can evaluate whether your backup practices comply with your policies and which resources are not yet in compliance. |
| POST | /audit/report-plans | Creates a report plan. A report plan is a document that contains information about the contents of the report and where Backup will deliver it. If you call CreateReportPlan with a plan that already exists, you receive an AlreadyExistsException exception. |
| DELETE | /audit/frameworks/{frameworkName} | Deletes the framework specified by a framework name. |
| DELETE | /audit/report-plans/{reportPlanName} | Deletes the report plan specified by a report plan name. |
| GET | /audit/frameworks/{frameworkName} | Returns the framework details for the specified FrameworkName. |
| GET | /audit/report-jobs/{reportJobId} | Returns the details associated with creating a report as specified by its ReportJobId. |
| GET | /audit/report-plans/{reportPlanName} | Returns a list of all report plans for an Amazon Web Services account and Amazon Web Services Region. |
| GET | /audit/backup-job-summaries | This is a request for a summary of backup jobs created or running within the most recent 30 days. You can include parameters AccountID, State, ResourceType, MessageCategory, AggregationPeriod, MaxResults, or NextToken to filter results. This request returns a summary that contains Region, Account, State, ResourceType, MessageCategory, StartTime, EndTime, and Count of included jobs. |
| GET | /audit/copy-job-summaries | This request obtains a list of copy jobs created or running within the the most recent 30 days. You can include parameters AccountID, State,

… (truncated)