I Tried Creating a Backup Plan with EBS Snapshots Archive Enabled in an AWS Backup LAG Vault

Introduction

On November 12, 2026, AWS Backup logically air-gapped vaults (LAG vaults) added support for EBS Snapshots Archive. You can now move EBS backups in a LAG vault to the archive tier.

https://aws.amazon.com/jp/about-aws/whats-new/2026/11/aws-backup-lag-vault-ebs-archive/

In this article, I created a LAG vault and used the AWS CLI to check the conditions under which creating and updating a backup plan with archiving enabled is accepted.

Creating a LAG vault

I used the ap-northeast-1 region and AWS CLI 2.40.3. I created a LAG vault with a minimum retention period of 7 days and a maximum retention period of 365 days.

aws backup create-logically-air-gapped-backup-vault --backup-vault-name devio-lag-archive-test --min-retention-days 7 --max-retention-days 365 --backup-vault-tags Purpose=devio-verify

Immediately after creation, the state was CREATING. About 2 minutes later, I confirmed with the following command that it had become AVAILABLE, and then proceeded to create the plan.

aws backup describe-backup-vault --backup-vault-name devio-lag-archive-test --query \{State:VaultState\,Type:VaultType\,Locked:Locked\,Min:MinRetentionDays\,Max:MaxRetentionDays\,Key:EncryptionKeyType\}

{
    "State": "AVAILABLE",
    "Type": "LOGICALLY_AIR_GAPPED_BACKUP_VAULT",
    "Locked": true,
    "Min": 7,
    "Max": 365,
    "Key": "AWS_OWNED_KMS_KEY"
}

Creating a plan with archiving enabled

How you write the plan differs depending on whether the LAG vault is the primary backup destination or a copy destination.

Specifying it as the primary

When I specified the LAG vault as TargetBackupVaultName in the backup rule, creating the plan was rejected with the following error.

aws: [ERROR]: An error occurred (InvalidRequestException) when calling the CreateBackupPlan operation: A LogicallyAirGappedBackupVault vault type cannot be a target for a backup plan. Choose a different vault type, then retry request.

EBS is not backed up directly to a LAG vault; a temporary backup created in a standard vault is copied to the LAG vault. Therefore, even when you make the LAG vault the primary, you specify a standard vault for TargetBackupVaultName. Separately, you specify the ARN of the LAG vault in TargetLogicallyAirGappedBackupVaultArn.

You enable archiving by setting OptInToArchiveForSupportedResources to true in the Lifecycle of the same rule. For MoveToColdStorageAfterDays, enter the warm period before moving to the archive. Save the following content as plan-primary.json.

{
  "BackupPlanName": "P1-monthly-ok",
  "Rules": [
    {
      "RuleName": "rule",
      "ScheduleExpression": "cron(0 5 1 * ? *)",
      "TargetBackupVaultName": "devio-std-source-test",
      "TargetLogicallyAirGappedBackupVaultArn": "arn:aws:backup:ap-northeast-1:<ACCOUNT_ID>:backup-vault:devio-lag-archive-test",
      "Lifecycle": {
        "MoveToColdStorageAfterDays": 30,
        "DeleteAfterDays": 120,
        "OptInToArchiveForSupportedResources": true
      }
    }
  ]
}

devio-std-source-test is a standard vault I created for this verification. In your environment, replace it with the name of an existing standard vault.

aws backup create-backup-plan --backup-plan file://plan-primary.json

The plan was created with this configuration.

Specifying it as the copy destination

When using a LAG vault as the copy destination, specify the ARN of the LAG vault in DestinationBackupVaultArn of CopyActions. Place the archive settings in the Lifecycle within the same CopyActions. Save the following content as plan-copy.json.

{
  "BackupPlanName": "C1-copy-monthly-ok",
  "Rules": [
    {
      "RuleName": "rule",
      "ScheduleExpression": "cron(0 5 1 * ? *)",
      "TargetBackupVaultName": "devio-std-source-test",
      "Lifecycle": {
        "DeleteAfterDays": 7
      },
      "CopyActions": [
        {
          "DestinationBackupVaultArn": "arn:aws:backup:ap-northeast-1:<ACCOUNT_ID>:backup-vault:devio-lag-archive-test",
          "Lifecycle": {
            "MoveToColdStorageAfterDays": 30,
            "DeleteAfterDays": 120,
            "OptInToArchiveForSupportedResources": true
          }
        }
      ]
    }
  ]
}

aws backup create-backup-plan --backup-plan file://plan-copy.json

This plan was also created successfully.

Conditions for the settings to be accepted

I checked which values are accepted and which are rejected for frequency, total retention period, and vault retention period. In what follows, "accepted" means that the API for creating or updating the plan did not return an error.

Backup frequency

I created primary-specified plans with archiving enabled, changing only the schedule.

The rejected schedules all returned the following error.

aws: [ERROR]: An error occurred (InvalidParameterValueException) when calling the CreateBackupPlan operation: Error in some rules due to : Cold storage for archive supported resources can be only applied to backup plans with at least monthly frequency. Please update frequency to more than 28 days.

When I updated the schedule of the plan for the 1st of every month to daily with update-backup-plan, it was rejected with the same error.

Total retention period and warm period

When enabling archiving, the total retention period (DeleteAfterDays) must be at least 90 days longer than the warm period (MoveToColdStorageAfterDays). With the warm period set to 30 days and varying the total retention period, the results were as follows.

The rejected rows all returned the following error.

aws: [ERROR]: An error occurred (InvalidParameterValueException) when calling the CreateBackupPlan operation: Error in some rules due to : Invalid lifecycle. DeleteAfterDays cannot be less than 90 days apart from MoveToColdStorageAfterDays

When archiving was enabled and the warm period was omitted, it was also rejected, and the following error was returned.

aws: [ERROR]: An error occurred (InvalidParameterValueException) when calling the CreateBackupPlan operation: Error in some rules due to : Invalid lifecycle. MoveToColdStorageAfterDays cannot be null when opted in to ArchiveForSupportedResources

Relationship to the vault retention period

With the primary specification, it was rejected when the total retention period fell outside the vault's minimum and maximum retention periods (7 to 365 days). With the copy destination specification, out-of-range values were accepted at plan creation. The warm period in the rows where archiving is enabled is 30 days.

The rejected rows all returned the following error.

aws: [ERROR]: An error occurred (InvalidParameterValueException) when calling the CreateBackupPlan operation: Lifecycle is incompatible with the retention setting of the logically air-gapped backup vault.

The AWS Backup documentation states that the total retention period must fall within the vault's minimum and maximum retention periods.

https://docs.aws.amazon.com/aws-backup/latest/devguide/logicallyairgappedvault.html

Deleting resources

I deleted the backup plans, the standard vault, and the LAG vault that I created for verification. Even for a LAG vault with Locked set to true, it could be deleted with the following command as long as it contained 0 backups.

aws backup delete-backup-vault --backup-vault-name devio-lag-archive-test

After deletion, the list of LAG vaults showed 0 items.

Summary

I confirmed that you can create a plan with EBS Snapshots Archive enabled in an AWS Backup LAG vault.

A LAG vault stores immutable backups that are locked by default. When you move backups to the archive, you can store them in a low-cost tier intended for infrequently accessed snapshots.

Please make use of this when your backups have long-term retention or compliance requirements.