BackupVault

Source: src/AWS/Backup/BackupVault.ts

An AWS Backup vault — a logical container that stores and organizes recovery points created by backup jobs.

A vault name is auto-generated from the app, stage, and logical ID unless you provide one explicitly. Recovery points can optionally be encrypted with a customer-managed KMS key, and access to the vault can be restricted with a resource-based policy.

Creating a Vault

Basic Vault

import * as Backup from "alchemy/AWS/Backup";

const vault = yield* Backup.BackupVault("AppBackups");

Vault with a Customer-Managed KMS Key

const vault = yield* Backup.BackupVault("EncryptedBackups", {
  encryptionKeyArn: key.keyArn,
});

Vault Access Policy

const vault = yield* Backup.BackupVault("LockedBackups", {
  accessPolicy: {
    Version: "2012-10-17",
    Statement: [
      {
        Effect: "Deny",
        Principal: { AWS: "*" },
        Action: ["backup:DeleteRecoveryPoint"],
        Resource: "*",
      },
    ],
  },
});