I tried direct access to backup data using the new "Backup Access Point" feature of AWS Backup for S3

AWS Backup for S3 has added a backup access point feature. Previously, restoring even a single file from a backup required a restore job, but with access points, you can retrieve files directly using the standard S3 API. I verified this in practice using the AWS CLI.

suzuki.ryo

2026.08.07

This page has been translated by machine translation. View original

Introduction

On August 6, 2026, an access point feature was added to AWS Backup for S3.

Previously, even retrieving a single file from a backup required running a restore job. With the new feature, you can create an access point for a backup and access it directly.

Traditional Restore	Via Access Point
Run a restore job	Create an access point
Must wait for job completion	Immediate access available *1
Must specify a destination bucket	No destination bucket required (direct download)
Retrieval per restore job	Selectively retrieve any object

*1 Accessible when backup is in a completed state (AVAILABLE)

In this article, we verify that an access point can be created using the AWS CLI to directly access backup data.

Verification Details

Verification Environment

AWS CLI 2.36.18 or later (supports the create-backup-access-point command)
Executed with administrator privileges

Preparing the S3 Bucket

Create a test bucket and enable versioning (AWS Backup for S3 targets buckets with versioning enabled).

# Create bucket
aws s3api create-bucket \
  --bucket backup-access-point-test-YYYYMMDD \
  --create-bucket-configuration '{"LocationConstraint": "ap-northeast-1"}' \
  --region ap-northeast-1

# Enable versioning
aws s3api put-bucket-versioning \
  --bucket backup-access-point-test-YYYYMMDD \
  --versioning-configuration '{"Status": "Enabled"}' \
  --region ap-northeast-1

Place test data.

for i in $(seq 1 10); do
  echo "Test content for file $i - created at $(date -Iseconds)" | \
    aws s3 cp - "s3://backup-access-point-test-YYYYMMDD/test-data/file-$(printf '%02d' $i).txt" \
    --region ap-northeast-1
done

Configuring AWS Backup

Create a backup vault.

aws backup create-backup-vault \
  --backup-vault-name s3-access-point-test-vault \
  --region ap-northeast-1

Create an IAM role and attach AWS managed policies.

# Create role
aws iam create-role \
  --role-name AWSBackupS3TestRole \
  --assume-role-policy-document '{
    "Version": "2012-10-17",
    "Statement": [{
      "Effect": "Allow",
      "Principal": {"Service": "backup.amazonaws.com"},
      "Action": "sts:AssumeRole"
    }]
  }'

# Attach policies
aws iam attach-role-policy \
  --role-name AWSBackupS3TestRole \
  --policy-arn arn:aws:iam::aws:policy/AWSBackupServiceRolePolicyForS3Backup

aws iam attach-role-policy \
  --role-name AWSBackupS3TestRole \
  --policy-arn arn:aws:iam::aws:policy/AWSBackupServiceRolePolicyForS3Restore

Enable the S3 resource type and start an on-demand backup.

# Enable S3 resource type
aws backup update-region-settings \
  --resource-type-opt-in-preference '{"S3": true}' \
  --region ap-northeast-1

# Start on-demand backup
aws backup start-backup-job \
  --backup-vault-name s3-access-point-test-vault \
  --iam-role-arn arn:aws:iam::xxxxxxxxxxxx:role/AWSBackupS3TestRole \
  --resource-arn arn:aws:s3:::backup-access-point-test-YYYYMMDD \
  --region ap-northeast-1

{
    "BackupJobId": "1dddfe69-5d32-4eee-a1bb-77bc75b8a7e0",
    "CreationDate": "2026-08-07T16:41:24.596000+09:00",
    "IsParent": false
}

After the backup job completes, retrieve the RecoveryPointArn.

aws backup describe-backup-job \
  --backup-job-id 1dddfe69-5d32-4eee-a1bb-77bc75b8a7e0 \
  --region ap-northeast-1

{
    "State": "COMPLETED",
    "RecoveryPointArn": "arn:aws:backup:ap-northeast-1:xxxxxxxxxxxx:recovery-point:backup-access-point-test-YYYYMMDD-20260807074125-1de2a2cd"
}

Creating an Access Point

Create an access point for the recovery point (the actual backup). You can create up to 5 access points per recovery point. You can also configure an access point policy to restrict access by IAM principal, VPC, or object prefix.

aws backup create-backup-access-point \
  --name test-access-point \
  --recovery-point-arn "arn:aws:backup:ap-northeast-1:xxxxxxxxxxxx:recovery-point:backup-access-point-test-YYYYMMDD-20260807074125-1de2a2cd" \
  --region ap-northeast-1

{
    "AccessPointArn": "arn:aws:backup:ap-northeast-1:xxxxxxxxxxxx:accesspoint/test-access-point",
    "Status": "CREATING"
}

Verify that the status has changed to AVAILABLE.

aws backup describe-backup-access-point \
  --access-point-arn "arn:aws:backup:ap-northeast-1:xxxxxxxxxxxx:accesspoint/test-access-point" \
  --region ap-northeast-1

{
    "AccessPointArn": "arn:aws:backup:ap-northeast-1:xxxxxxxxxxxx:accesspoint/test-access-point",
    "AccessPointMetadata": {
        "S3AccessPointAlias": "example-alias-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx-ext-s3alias"
    },
    "Status": "AVAILABLE",
    "BackupVaultName": "s3-access-point-test-vault",
    "ResourceType": "S3"
}

Direct Access to Backup Data

Specify the value of S3AccessPointAlias as the bucket name and access it using the standard S3 API. Access via the access point is read-only (this article verifies read-only APIs only).

ListObjectsV2 (Retrieve Object List)

aws s3api list-objects-v2 \
  --bucket "example-alias-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx-ext-s3alias" \
  --region ap-northeast-1

{
    "Contents": [
        {
            "Key": "test-data/file-01.txt",
            "LastModified": "2026-08-07T07:40:15+00:00",
            "Size": 63,
            "StorageClass": "AWS_BACKUP_WARM"
        }
    ]
}

file-02.txt through file-10.txt were also retrieved in the same way, all with Size 63 / StorageClass AWS_BACKUP_WARM. This is the value returned for backup data in AWS Backup.

HeadObject (Retrieve Metadata)

aws s3api head-object \
  --bucket "example-alias-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx-ext-s3alias" \
  --key "test-data/file-01.txt" \
  --region ap-northeast-1

{
    "ContentLength": 63,
    "ETag": "\"fdef648f5a8cf52454ed8db9c21559b6\"",
    "VersionId": "Kjfj_zH.wbVvhruWZnprEe8RBRYd10Wg",
    "ServerSideEncryption": "aws:backup",
    "StorageClass": "AWS_BACKUP_WARM"
}

ServerSideEncryption was set to aws:backup (encryption managed by AWS Backup).

GetObject (Retrieve File Contents)

aws s3api get-object \
  --bucket "example-alias-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx-ext-s3alias" \
  --key "test-data/file-01.txt" \
  /tmp/backup-file-01.txt \
  --region ap-northeast-1

$ cat /tmp/backup-file-01.txt
Test content for file 1 - created at 2026-08-07T16:40:14+09:00

The backup data was retrieved directly without running a restore job.

Summary

The access point feature of AWS Backup for S3 makes it easy to access backup data on a per-file basis. Once an access point is created, you can access it directly using standard S3 APIs (ListObjectsV2, HeadObject, GetObject) without running a restore job or preparing a destination bucket.

This feature looks useful for use cases such as "I want to recover just one accidentally deleted file" or "I want to check the contents of a backup." The official blog also highlights compliance auditing and forensic investigations as valid use cases.