AWS Backup

Manage backup vault and plan records.

Plan: Pro109 of 115 operations implemented6Known differences

Vault and plan metadata is verified; this does not demonstrate working backup or recovery.

Example checked on Vera 1.2.2, 8 November 2026. Each coverage note names its own evidence and date.

Connect

Activate your license key and start the emulator with the Vera launcher, as in Activate Pro, then run this in a terminal of its own, from an empty scratch directory. It gives the official AWS CLI dummy credentials and a config file of its own, so no AWS account is needed and your own AWS profile isn't touched.

export VERA_ENDPOINT="http://localhost:5003"
export AWS_ACCESS_KEY_ID=test AWS_SECRET_ACCESS_KEY=test
export AWS_REGION=us-east-1 AWS_DEFAULT_REGION=us-east-1
export AWS_SHARED_CREDENTIALS_FILE=/dev/null
export AWS_EC2_METADATA_DISABLED=true
export AWS_PAGER="" AWS_CLI_AUTO_PROMPT=off
unset AWS_PROFILE AWS_DEFAULT_PROFILE
unset AWS_SESSION_TOKEN AWS_SECURITY_TOKEN
unset AWS_WEB_IDENTITY_TOKEN_FILE AWS_ROLE_ARN AWS_ROLE_SESSION_NAME
unset AWS_CONTAINER_CREDENTIALS_FULL_URI
unset AWS_CONTAINER_CREDENTIALS_RELATIVE_URI
cat > vera-aws-config <<'EOF'
[default]
region = us-east-1
output = json
cli_binary_format = base64
s3 =
    addressing_style = path
EOF
export AWS_CONFIG_FILE="$PWD/vera-aws-config"

When you've finished every example in this terminal, close it and delete vera-aws-config, not before.

The example uses the AWS CLI’s backup commands. The emulator serves the 2018-11-15 API over the REST JSON protocol, and the example was checked with the official AWS CLI 2.31.35.

Example

Create a vault and a backup plan with one rule, then read the plan back. These are configuration records: nothing is backed up.

aws --endpoint-url "$VERA_ENDPOINT" backup create-backup-vault --backup-vault-name vera-docs-vault
PLAN_ID=$(aws --endpoint-url "$VERA_ENDPOINT" backup create-backup-plan \
  --backup-plan '{"BackupPlanName": "vera-docs-plan", "Rules": [{"RuleName": "daily", "TargetBackupVaultName": "vera-docs-vault"}]}' \
  --query BackupPlanId --output text)
aws --endpoint-url "$VERA_ENDPOINT" backup get-backup-plan --backup-plan-id "$PLAN_ID"

The plan’s output includes these fields. Its ID, VersionId, CreatorRequestId and CreationDate differ on every run, and so does the ID in its ARN:

{
    "BackupPlan": {
        "BackupPlanName": "vera-docs-plan",
        "Rules": [
            {
                "RuleName": "daily",
                "TargetBackupVaultName": "vera-docs-vault"
            }
        ]
    },
    "BackupPlanArn": "arn:aws:backup:::plan:backup-dbb5914f17bf4ab5b"
}

The ARN has no region or account, as in arn:aws:backup:::plan: followed by the plan’s ID. The vault’s ARN is arn:aws:backup:::backup-vault:vera-docs-vault.

To clean up, delete the plan, then the vault:

aws --endpoint-url "$VERA_ENDPOINT" backup delete-backup-plan --backup-plan-id "$PLAN_ID"
aws --endpoint-url "$VERA_ENDPOINT" backup delete-backup-vault --backup-vault-name vera-docs-vault

Supported features

Vault records, created and deleted.
Backup plan records, created with rules, read back and deleted. In earlier testing, deleting one returned its DeletionDate.
Backup jobs, from earlier testing only. Earlier tests started synthetic backup jobs that completed at once: StartBackupJob returned a job ID and a recovery point ARN, which DescribeBackupJob, StopBackupJob and DeleteRecoveryPoint accepted. Earlier source inspection found synthetic copy and restore records. None of this was rechecked after earlier testing: see Limitations.
Also served, not yet tested: backup selections, copy, restore, report and scan jobs, restore testing, legal holds, frameworks and report plans, vault access policies, notifications and Vault Lock, logically air-gapped vaults, and global and region settings.

Limitations

The main limits are below. A few more apply to every service, and the API coverage notes cover smaller differences.

Records, not data protection. Vault and plan metadata doesn’t demonstrate data protection, restore correctness, schedules, retention expiry, Vault Lock or actual copies.
Jobs weren’t rechecked after earlier testing. A backup job needs an IAM role. Earlier, in Vera 1.2.0 preview and Vera 1.2.0-rc.3, creating a role failed, so jobs weren’t rerun, and the Vera 1.2.2 checks didn’t include them. In Vera 1.2.0 preview, StartBackupJob with a role that doesn’t exist returned ResourceNotFoundException, so naming an arbitrary role ARN isn’t a workaround.
Jobs didn’t move data in earlier testing. A job started with StartBackupJob was COMPLETED at once, 100.0 percent done with 0 bytes transferred, and no data was copied. Earlier source inspection found that copy and restore jobs complete without transferring data or restoring the underlying resource.
ARNs leave out the region and account. Vault and plan ARNs come back as arn:aws:backup:::backup-vault:vera-docs-vault, with no region or account, so don’t read either from them. This was seen again when the example ran on Vera 1.2.0 preview.

API coverage

Every operation in AWS's published 2018-11-15 API (SDK model, botocore 1.43.105), and whether the emulator implements it. Availability combines the earlier implementation inventory with the dated observations below; checking a page's example does not verify every operation. Each note names its evidence first; an observation given without a build or date comes from earlier testing, on 3 November 2026. What the statuses mean

Operation	Status	Notes
AssociateBackupVaultMpaApprovalTeam	Implemented
CancelLegalHold	Implemented
CreateBackupAccessPoint	Not implemented
CreateBackupPlan	Known difference	Local observation: The observed plan ARN omits the region and account components, for example `arn:aws:backup:::plan:<plan ID>`. This was observed in the local example. Local observation: Vera 1.2.0 preview, 5 November 2026 — the plan ARN again omitted the region and account.
CreateBackupSelection	Implemented
CreateBackupVault	Known difference	Local observation: The observed vault ARN omits the region and account components, for example `arn:aws:backup:::backup-vault:vera-docs-vault`. This was observed in the local example. Local observation: Vera 1.2.0 preview, 5 November 2026 — the vault ARN again omitted the region and account.
CreateFramework	Implemented
CreateLegalHold	Implemented
CreateLogicallyAirGappedBackupVault	Implemented
CreateReportPlan	Implemented
CreateRestoreAccessBackupVault	Implemented
CreateRestoreTestingPlan	Implemented
CreateRestoreTestingSelection	Implemented
CreateTieringConfiguration	Implemented
DeleteBackupAccessPoint	Not implemented
DeleteBackupPlan	Implemented
DeleteBackupSelection	Implemented
DeleteBackupVault	Implemented
DeleteBackupVaultAccessPolicy	Implemented
DeleteBackupVaultLockConfiguration	Implemented
DeleteBackupVaultNotifications	Implemented
DeleteFramework	Implemented
DeleteRecoveryPoint	Implemented
DeleteReportPlan	Implemented
DeleteRestoreTestingPlan	Implemented
DeleteRestoreTestingSelection	Implemented
DeleteTieringConfiguration	Implemented
DescribeBackupAccessPoint	Not implemented
DescribeBackupJob	Known difference	Local observation: earlier testing, 3 November 2026 — reported a job `COMPLETED` at `100.0` percent with `0` bytes transferred, though no data was backed up. Not rechecked in Vera 1.2.0 preview.
DescribeBackupVault	Implemented
DescribeCopyJob	Implemented
DescribeFramework	Implemented
DescribeGlobalSettings	Implemented
DescribeProtectedResource	Implemented
DescribeRecoveryPoint	Implemented
DescribeRegionSettings	Implemented
DescribeReportJob	Implemented
DescribeReportPlan	Implemented
DescribeRestoreJob	Implemented
DescribeScanJob	Implemented
DisassociateBackupVaultMpaApprovalTeam	Implemented
DisassociateRecoveryPoint	Implemented
DisassociateRecoveryPointFromParent	Implemented
ExportBackupPlanTemplate	Implemented
GetBackupPlan	Implemented	Local observation: Vera 1.2.0 preview, 5 November 2026 — returned the plan's name and daily rule; its ARN omitted the region and account.
GetBackupPlanFromJSON	Implemented
GetBackupPlanFromTemplate	Implemented
GetBackupSelection	Implemented
GetBackupVaultAccessPolicy	Implemented
GetBackupVaultNotifications	Implemented
GetLegalHold	Implemented
GetPITRMalwareScanResults	Implemented
GetRecoveryPointIndexDetails	Implemented
GetRecoveryPointRestoreMetadata	Implemented
GetRestoreJobMetadata	Implemented
GetRestoreTestingInferredMetadata	Implemented
GetRestoreTestingPlan	Implemented
GetRestoreTestingSelection	Implemented
GetSupportedResourceTypes	Implemented
GetTieringConfiguration	Implemented
ListBackupAccessPoints	Not implemented
ListBackupAccessPointsByRecoveryPoint	Not implemented
ListBackupAccessPointsByResource	Not implemented
ListBackupJobSummaries	Implemented
ListBackupJobs	Implemented
ListBackupPlanTemplates	Implemented
ListBackupPlanVersions	Implemented
ListBackupPlans	Implemented
ListBackupSelections	Implemented
ListBackupVaults	Implemented
ListCopyJobSummaries	Implemented
ListCopyJobs	Implemented
ListFrameworks	Implemented
ListIndexedRecoveryPoints	Implemented
ListLegalHolds	Implemented
ListProtectedResources	Implemented
ListProtectedResourcesByBackupVault	Implemented
ListRecoveryPointsByBackupVault	Implemented
ListRecoveryPointsByLegalHold	Implemented
ListRecoveryPointsByResource	Implemented
ListReportJobs	Implemented
ListReportPlans	Implemented
ListRestoreAccessBackupVaults	Implemented
ListRestoreJobSummaries	Implemented
ListRestoreJobs	Implemented
ListRestoreJobsByProtectedResource	Implemented
ListRestoreTestingPlans	Implemented
ListRestoreTestingSelections	Implemented
ListScanJobSummaries	Implemented
ListScanJobs	Implemented
ListTags	Implemented
ListTieringConfigurations	Implemented
PutBackupVaultAccessPolicy	Implemented
PutBackupVaultLockConfiguration	Implemented
PutBackupVaultNotifications	Implemented
PutRestoreValidationResult	Implemented
RevokeRestoreAccessBackupVault	Implemented
StartBackupJob	Known difference	Local observation: earlier testing, 3 November 2026 — the job was `COMPLETED` at once, `100.0` percent done with `0` bytes transferred, and no data was backed up. Local observation: Vera 1.2.0 preview, 5 November 2026 — with a role that doesn't exist, returned `ResourceNotFoundException`. Earlier, in Vera 1.2.0 preview and Vera 1.2.0-rc.3, creating a role failed in IAM, so a job wasn't rerun then.
StartCopyJob	Known difference	Source inspection: Immediately creates a `COMPLETED` job record and updates metadata and counters without copying backup data.
StartReportJob	Implemented
StartRestoreJob	Known difference	Source inspection: Immediately creates a `COMPLETED` job record with a resource ARN derived from supplied or recovery-point metadata; this path does not restore the underlying resource.
StartScanJob	Implemented
StopBackupJob	Implemented
TagResource	Implemented
UntagResource	Implemented
UpdateBackupPlan	Implemented
UpdateFramework	Implemented
UpdateGlobalSettings	Implemented
UpdateRecoveryPointIndexSettings	Implemented
UpdateRecoveryPointLifecycle	Implemented
UpdateRegionSettings	Implemented
UpdateReportPlan	Implemented
UpdateRestoreTestingPlan	Implemented
UpdateRestoreTestingSelection	Implemented
UpdateTieringConfiguration	Implemented