Policy Center

Supported scope and limits

Backup policies are supported only for specific data sources and regions:

• The regions that support backup policies are displayed on the Policy Center page in the console. For more information about the supported regions, see Features supported by region.

• Backup policies are supported only for ECS File Backup, ECS instance backup, OSS backup, Alibaba Cloud NAS backup, on-premises NAS backup, Tablestore backup, CPFS backup, and local file backup.

• The Backup Vault feature applies only to standard backup policies.

• The Automatic Archiving feature is available only for ECS File Backup, ECS instance backup, OSS backup, Alibaba Cloud NAS backup, on-premises NAS backup, CPFS backup, and local file backup.

• The Immutable Backup feature is supported for both standard and ECS instance backup policies.

• The Backup Point Virus Detection feature applies only to ECS File Backup (New), Local File Backup (New), OSS Backup, Alibaba Cloud NAS Backup, and Local NAS Backup.

• The Associate Resource Tag feature applies only to ECS instance backups, ECS file backups, OSS backups, Alibaba Cloud NAS backups, and Tablestore backups.

Prerequisites

You have activated Cloud Backup. Activating Cloud Backup is free of charge.

Notes

If the Policy Type of a backup policy is 'Legacy Backup Policy', the policy is associated with an ECS instance backup and uses a backup vault. The limitations are as follows:

Create a backup policy

Before you back up a data source, you must create a backup policy.

1. Log on to the Cloud Backup console.

2. In the navigation pane on the left, choose Backup > Policy Center.

3. In the top navigation bar, select a region.

4. On the Policy Center page, click Create Backup Policy.

5. In the Create Backup Policy dialog box, configure parameters such as Policy Type, Policy Name, Execution Plan, Lifecycle, Automatic Archive Settings, Backup Vault Configuration, and Replication Policy, and then click OK.

   

   

   General Backup Policy parameter description

   Important

   Select a policy type based on your business needs and carefully read the parameter descriptions to ensure that the configurations meet your requirements.

   Parameter		Description
   Policy Type		Specifies the policy type. This policy applies to backups other than ECS instance backups. Supported data sources include the following: ECS files, local files, OSS, Alibaba Cloud NAS, CPFS, Tablestore, and on-premises NAS. Backup data is stored in a general-purpose backup vault.
   Policy Name		Enter a custom name for the backup policy. The name must be 2 to 128 characters in length. It cannot start with `auto`, a special character, or a digit. It can contain only periods (.), underscores (_), hyphens (-), and colons (:).
   Schedule	Backup Frequency	Specify the backup cycle. Note If a backup job is still running when the next one is scheduled to start, the next job is skipped and will run at the next scheduled time. Hourly: Execute backups at intervals of a fixed number of hours. Daily: Executes backups at a fixed interval of days. Weekly: Execute backups on specified days of the week. Monthly: Executes a backup in the specified months.
   	First Execution Time	You can set the initial execution time.
   	Time Interval	Specify the backup interval.
   	Incremental Backup Interval	This parameter is required only for Tablestore. For other data sources, Cloud Backup automatically performs full or incremental backups. No: Do not use incremental backup. Specify Time: Specify the incremental backup interval for Tablestore.
   Lifecycle	Retention Period	Set the retention period for backup data. Permanent: The backup data is retained permanently and is never deleted. Specify Time: The total retention period for the backup data. The retention period is specified in days. The maximum value cannot exceed the equivalent of 999 years. For example, if you set the Specify Time parameter to 210 days, backup data is retained for 210 days and is deleted when the retention period expires. When you set Days to Transfer to Archive Tier, data in the archive tier must be retained for at least 60 days. Therefore, the total retention period must be greater than or equal to the sum of the number of days before archiving and the minimum retention period of 60 days for the archive tier. For example, if you set data to be archived after 30 days, the total retention period must be at least 30 + 60 = 90 days.
   	Special Retention Period	In addition to standard backup policies, Cloud Backup supports special retention policies to meet data security requirements. With a special retention policy, you can set a longer retention period for the first available backup of a specified cycle (weekly, monthly, or yearly). A single backup policy can include rules for weekly, monthly, and yearly special retention at the same time. For more information, see Special retention periods. Important The special retention period and the standard retention period have time constraints. When you set a special retention period, we recommend that you follow the system's suggestions. The following limits generally apply: You cannot set a special retention period for backups that are retained permanently. The special retention period must be longer than the standard retention period. The special retention period, converted from weeks, months, or years, cannot exceed 999 years.
   	Keep At Least One Backup Version	We recommend that you enable this option. When this option is enabled, the latest backup version generated by this backup plan is not deleted due to the expiration of the retention period or accidental operations. This prevents the risk that no backup version is available for restoration due to reasons such as improper backup plan settings. For more information, see Enable retaining at least one backup version. Important This feature takes effect only after a data source is associated with this backup policy. For general-purpose backup policies, at least one version of the off-site replicated backup points is also retained. Tablestore backups are not supported. The latest backup is not automatically archived.
   Automatic Archiving	Days to Transfer to Archive Tier	Specify the number of days after which backup data is moved to the archive tier. By default, backup data is stored in the standard tier of a backup vault. For backup data that needs to be retained for a long time, you can use this feature to move backup points from the standard tier to the archive tier to reduce data protection costs. Important When you use cross-region backup, Archive tier data in a backup vault is not replicated to a different region. After Standard tier data in the backup vault is transferred to the Archive tier, the corresponding data in the replication target vault is also deleted. The amount of data in the archive tier is calculated based on the size of the raw data before it is archived. Objects or files smaller than 64 KB are calculated as 64 KB. For scenarios that involve many small files, you should carefully evaluate whether to archive the data. For detailed rules, see Auto-archiving. Backup data must be retained in the standard tier for at least 30 days before it can be archived. After backup data is moved to the archive tier, it must be retained in the archive tier for at least 60 days. No: The backup data is stored in the standard layer and is not transferred to the archive layer. Specify Time: The valid range is 30 to 65,535 days. To balance data access frequency, recovery needs, storage costs, and data lifecycle, backup points must be retained in the Standard tier for at least 30 days before they can be automatically archived. This strategy is based on the consideration that recent data has a higher probability of recovery. The strategy helps reduce your long-term storage costs and minimize the high costs that may be incurred by data restoration from the Archive tier. If moved to the archive tier 30 days after the Specify Time: If the backup data Retention Period is Permanent, the backup data is transferred to the Archive tier after 30 days, where it is permanently retained and will not be deleted. If the Retention Period for the backup data is 210 days, the data is transferred to the Archive tier after 30 days and retained for an additional 180 days before it is automatically deleted. The total retention period is 210 days.
   Backup Vault	Backup Vault	Configure the backup vault where backups are stored. Create Backup Vault: Create a new backup vault to store backup data. By default, the vault name is assigned based on the date and time. Select Vault: Select an existing backup vault from the backup vault name drop-down list. To maximize the redundancy of your backup data, the system automatically selects the vault type based on region support: a zone-redundant backup vault is created by default in regions that support zone-redundant storage, and a locally redundant backup vault is created in other regions.
   	Vault Name	This parameter is required only when the Backup Vault parameter is set to Create Backup Vault or Select Backup Vault. Enter or select the name of a backup vault.
   	Vault Resource Group	This parameter is required only when the Backup Vault parameter is set to Create Backup Vault. This parameter specifies the resource group to which the backup vault belongs. You can use resource groups to manage resources owned by your Alibaba Cloud account. Resource groups help you simplify the resource and permission management of your Alibaba Cloud account. For more information, see Create a resource group.
   	Vault Encryption Method	You need to configure this parameter only when the Backup Vault parameter is set to Create Backup Vault. This parameter specifies the method that is used to encrypt the data in the backup vault. Cloud Backup-managed (Default): Uses the default encryption method of the backup service. KMS: Use a custom key from Alibaba Cloud KMS for encryption. You must specify the KMS KeyId parameter. You can select the Use KMS Alias check box to use a KMS key alias as the KMS key ID. Important After you enable encryption for a backup vault using Key Management Service (KMS), you cannot change the KMS key. To encrypt a backup vault with a KMS key, you must first create a key ID in KMS. For more information, see Create a key.
   Replication Policy	Backup Vault Replication	After you enable backup vault replication, all existing backup data in the standard tier of the source backup vault and any new backup data generated after the current time are automatically synchronized to the replication target vault. This provides cross-region and cross-account, cross-region data protection. Important When automatic archiving is enabled for the source backup vault, data in the archive tier of the source backup vault is not synchronized to the replication target vault. After data in the standard tier of the source backup vault is moved to the archive tier, the corresponding data in the replication target vault is also deleted. Enabling cross-region backup replication incurs storage and inter-region data transfer fees. For more information, see Billing methods and billable items. Enabling the Backup Vault Replication feature in a general backup policy is equivalent to Configure Vault Replication for the backup vaults associated with the policy. You can configure cross-region backup in Storage Vaults. After you enable Backup Vault Replication, the backup vaults for the data sources associated with this backup policy will automatically perform replication based on the configured rules, and all backup points, including existing and new ones, will be synchronized to the replication target vault. Note The off-site retention period for general-purpose backups is the same as the retention period of the source backup points.
   	Replication Target Vault Configuration	Choose whether to use an existing replication target vault or create a new one, as needed. Create replication target vault: Creates a vault in the current account for cross-region replication. Select replication target vault: If you have already created a replication target vault in another account and shared it with the current account, you can achieve cross-account or cross-account, cross-region replication. If you select a replication target vault in another region of the current account, you can achieve cross-region replication.
   	Destination Region	This parameter is required only if you enable the Backup Vault Replication switch. Select the region where the replication target vault is located.
   	Encryption Method of Replication Target Vault	This parameter is required only when you enable the Backup Vault Replication switch and select Create Replication Target Vault. The encryption method for the destination backup vault must be the same as that of the source backup vault. The valid values are Cloud Backup-managed and KMS.
   Data Security	Immutable Backup	After you enable Backup lock, you cannot disable this feature. After you enable this feature, the backup vault and all its backup data cannot be deleted before they automatically expire. After you enable this feature, if off-site backup replication is also enabled, the replicated backup vault and backup points in the off-site location are also locked.
   	Backup Point Virus Detection	After you enable the Backup Point Virus Detection option, the system automatically runs virus detection on the backup data after the backup is complete. You can view the detailed detection results at the backup point. Important After you enable virus scanning in a backup policy, a full virus scan is performed on the first backup point. For subsequent backup points, an incremental virus scan is performed. Backup point virus scanning is a paid feature. A backup point virus scan task cannot be canceled once it starts. You can disable the backup point virus detection feature by turning off the Backup Point Virus Detection switch.
   Associate Resource Tag		Backup policies support associating resources in batches based on tags. Resource Type: ECS file, OSS Bucket, Alibaba Cloud NAS, Tablestore. Select Resource: You can associate all resources of a resource type or associate some resources using Specify Tag. Resource Tag: A resource is matched only if it has all the specified tags. You can click Associate Tags to add multiple tags. The resource tags must correspond to the resource type: Resource Type is ECS File: Specify ECS instance tags. Resource Type is OSS Bucket: Specify OSS bucket tags. Resource Type is Alibaba Cloud NAS: Specify NAS file system tags. Resource Type is Tablestore: Specify Tablestore instance tags. Note You can add up to 30 resource tags. When an ECS instance is associated with a backup policy through tags and the resource type is set to ECS File, Cloud Backup automatically deploys the ECS file backup client when the next backup job starts. Conversely, if an ECS instance's tags are no longer associated with any backup policy and all related backup jobs have expired, Cloud Backup automatically uninstalls the ECS file backup client. Each time the backup policy runs, Cloud Backup performs the following tag matching check: Automatically associate new matching resources: If Cloud Backup finds data sources that are not bound to the current backup policy but match the policy's tags, it automatically associates them. These resources will be backed up periodically starting from the next backup time. Automatically adjust associated resources: For data sources already bound to this backup policy, the system checks if they still meet the policy's tag requirements. If a data source no longer matches the current policy settings, Cloud Backup automatically pauses its backup operations. After the backup cycle ends, the data source is automatically dissociated from the policy. Tag Hit Check: Click Detect Now to find the resources that match the resource tags you set. To add resources of multiple resource types, you can click Add Resource.

   ECS Instance Backup Policy Metric Description

   Important

   Select a policy type based on your business needs and carefully read the parameter descriptions to ensure that the configurations meet your requirements.

   Parameter		Description
   Policy Type		Specifies the policy type. Applies only to ECS instance backup. Backup data uses the snapshot capacity and is not stored in a backup vault.
   Policy Name		Enter a custom name for the backup policy. The name must be 2 to 128 characters in length. It cannot start with `auto`, a special character, or a digit. It can contain only periods (.), underscores (_), hyphens (-), and colons (:).
   Schedule	Backup Frequency	Specify the backup cycle. Note If a backup job is still running when the next one is scheduled to start, the next job is skipped and will run at the next scheduled time. Hourly: Execute a backup at a fixed hourly interval. Daily: Execute a backup at a fixed interval of days. Weekly: Execute backups on the specified days of the week. Monthly: Executes the backup in the specified months.
   	First Execution Time	You can specify the first execution time.
   	Time Interval	Specify the backup interval.
   Lifecycle	Retention Period	Set the retention period for backup data. Important ECS instance backups cannot be retained permanently. Specify Time: The total retention period for backup data. The unit is days. The maximum retention period cannot exceed 999 years. For example, if you set the Specify Time parameter to 210 days, backup data is retained for 210 days and is deleted when the retention period expires. If you set the Days to Transfer to Archive Tier parameter, data in the archive tier must be retained for at least 60 days. Therefore, the total retention period must be no less than the sum of the number of days before archiving and the minimum retention period for the archive tier (60 days). For example, if you set data to be archived after 15 days, the total retention period must be at least 15 + 60 = 75 days.
   	Special Retention Period	In addition to standard backup policies, Cloud Backup supports special retention policies to meet data security requirements. These policies allow you to set a longer retention period for the first available backup that is generated every week, every month, and every year. A backup policy can include weekly, monthly, and yearly special retention rules at the same time. For more information, see Special retention periods. Important The special retention period and the standard retention period have time constraints. When you set a special retention period, we recommend that you follow the system's suggestions. The following limits generally apply: The special retention period must be longer than the standard retention period. The special retention period, converted from weeks, months, or years, cannot exceed 999 years.
   	Keep At Least One Backup Version	We recommend the Enable Keep at least one backup version option. If you enable this option, the latest backup version generated by this backup plan is not deleted due to the expiration of the retention period or accidental operations. This prevents the risk that no backup version is available for restoration due to reasons such as improper backup plan settings. Important This feature takes effect only after a data source is associated with this backup policy. The "Keep at Least One Backup Version" setting in the local policy does not affect off-site replicated backup points for ECS instance backup policies. The latest backup is not automatically archived.
   Automatic Archiving	Days to Transfer to Archive Tier	Specify the number of days after which backup data is moved to the archive tier. By default, backup data is stored in the standard tier. For backup data that needs to be retained for a long time, you can use this feature to move backup points from the standard tier to the archive tier to reduce data protection costs. Important This feature applies only to new ECS instance backup points created after the automatic archiving setting is configured or modified. Backup points created before the setting was configured are not archived. Data in the archive tier is billed based on archive snapshot storage, and the fees are collected by the ECS service. Before backup points for an entire ECS instance enter the archive tier, snapshots that have not been successfully archived are billed based on standard snapshot storage, and snapshots that have been successfully archived are billed based on archive snapshot storage. Backup points must be retained in the standard tier for at least 14 days before they can be archived. After a backup point is moved to the archive tier, it must be retained for at least 60 days. If you manually delete a backup point within 60 days, you will be charged for the remaining duration. No: The backup data remains in the Standard tier and is not transferred to the Archive tier. Specify Time: The valid range is 14 to 65535 days. To balance data access frequency, recovery requirements, storage costs, and the data lifecycle, backup points must be retained in the Standard tier for at least 14 days before they can be automatically archived. This strategy is based on the consideration that recent data has a higher probability of recovery. The strategy helps reduce your long-term storage costs and minimize the high costs that may be incurred by data restoration from the Archive tier. For example, if the Specify Time is 30 days and the Retention Period is 210 days, the backup data is moved to the Archive tier after 30 days. The data is then retained in the Archive tier for an additional 180 days before it is automatically deleted. The total retention period is 210 days.
   Replication Policy	Replication to Other Region	After you enable the Replication to Other Region feature, backups that you create are immediately and automatically replicated to the destination region to provide cross-region protection. Depending on the backup source type, enabling cross-region replication incurs storage fees or cross-region data transfer fees. For details about the billing methods, see Billing methods and billable items. Cloud Backup provides the following off-site backup replication technology: Backups are replicated across regions using cross-region snapshot replication technology. This method is applicable only to backing up entire ECS instances. Important After you enable Replication to Other Region, existing backups are not replicated. This feature applies only to backup points that are created after the feature is enabled. After you disable off-site backup replication, backup points that have already been replicated to the destination region are not immediately deleted. They are automatically cleaned up after their retention period expires.
   	Destination Region	This parameter is required only when the Replication to Other Region feature is enabled. Specify the destination region to which the backup data will be replicated.
   	Remote Retention Period	When you enable the Replication to Other Region feature, you must configure this parameter. You can set the retention period for backup data in the destination region. Note ECS instance backups cannot be retained permanently. Specify Time: The total retention period for geo-redundant backup data. Unit: day. The default value is 7 days, and the maximum retention period cannot exceed 999 years. Backup data is automatically deleted after the retention period expires. When you set the Archive after days option, data in the archive tier must be retained for at least 60 days. Therefore, the total retention period for off-site data must be no less than the sum of the number of days before archiving and the minimum retention period of the archive tier (60 days). For example, if you set data to be archived after 15 days, the total retention period must be at least 15 + 60 = 75 days.
   	Archive after days	You must configure this parameter when you enable the Replication to Other Region feature. By default, off-site backup data is stored in the standard tier. By setting the number of days after which to archive the data, you can move long-term off-site backup data from the standard tier to the archive tier to reduce data protection costs. Important Data in the archive layer is billed as archive snapshot storage, and the fees are collected by the ECS service. Before a backup point of an entire ECS instance is moved to the archive layer, snapshots that have not been successfully archived are billed as standard snapshot storage, and snapshots that have been successfully archived are billed as archive snapshot storage. Backup points must be retained in the standard tier for at least 14 days before they can be archived. After a backup point is moved to the archive tier, it must be retained for at least 60 days. If you manually delete a backup point within 60 days, you will be charged for the remaining duration. If the Archive after days is greater than or equal to the Remote Retention Period, no backups will be archived. No: Geo-redundant backup data remains in the Standard tier and is not transferred to the Archive tier. Specify Time: The number of days can range from 14 to 65,535. To balance data access frequency, recovery needs, storage costs, and the data lifecycle, backup points must be retained in the Standard tier for at least 14 days before they can be automatically archived. This strategy is based on the consideration that recent data has a higher probability of recovery. The strategy helps reduce your long-term storage costs and minimize the high costs that may be incurred by data restoration from the Archive tier. For example, if you set Specify Time to 30 days and the Remote Retention Period for the backup data is 210 days, the geo-redundant backup data is moved to the Archive tier after 30 days. It is then retained in the Archive tier for another 180 days and then automatically deleted. The total retention period is 210 days.
   Data Security	Immutable Backup	Once enabled, the Backup Lock feature cannot be disabled. After you enable this feature, ECS instance backup points cannot be deleted before they automatically expire. After you enable this feature, only ECS instance backup points created in the next backup cycle will be locked. Existing ECS instance backup points will not be locked. After you enable this feature, if off-site backup replication is also enabled, the replicated backup points in the off-site location are also locked. Enabling this feature does not affect the normal use of the corresponding cloud disks and snapshots, such as creating cloud disks or sharing snapshots.
   Associate Resource Tag		Backup policies support associating resources in batches based on tags. Resource Type: ECS instance. Select Resource: You can associate all resources of a resource type or associate some resources using Specify Tag. Resource Tag: A resource is hit only if all tags are matched. You can click Associate Tags to add multiple tags. Specify the tags for ECS instances. Note You can add up to 30 resource tags. When an ECS instance is associated with a backup policy through tags and the resource type is set to ECS File, Cloud Backup automatically deploys the ECS file backup client when the next backup job starts. Conversely, if an ECS instance's tags are no longer associated with any backup policy and all related backup jobs have expired, Cloud Backup automatically uninstalls the ECS file backup client. Each time the backup policy runs, Cloud Backup performs the following tag matching check: Automatically associate new matching resources: If Cloud Backup finds data sources that are not bound to the current backup policy but match the policy's tags, it automatically associates them. These resources will be backed up periodically starting from the next backup time. Automatically adjust associated resources: For data sources already bound to this backup policy, the system checks if they still meet the policy's tag requirements. If a data source no longer matches the current policy settings, Cloud Backup automatically pauses its backup operations. After the backup cycle ends, the data source is automatically dissociated from the policy. Tag Hit Detection: Click Detect Now to check which resources match the resource tags that you set. To add resources of multiple resource types, you can click Add Resource.

   After the policy is created, you can view it in the policy list in the Policy Center.

   • If the policy type is General Backup Policy, the created backup policies are displayed as shown in the following figure.

     

   • When you select ECS Instance Backup Policy, the backup policies are created as follows.

     

Associate a backup policy with a data source

After you create a backup policy, you can associate resources for automatic backups in one of the following ways:

• Associate the backup policy when you create a backup plan for a data source.

• In the backup policy list, associate resources in batches by resource ID.

• Specify resource tags in the backup policy to automatically associate matching resources. For more information, see Automatically associate resources based on tags.

You can click the icon to the left of a policy to view its associated data sources.

Associate resources in batches by resource ID

After a backup policy is created, you can also click Associate Resource in the Actions column of the target backup policy to associate resources in batches.

For a standard backup policy:

• If the resource type is ECS File, click the ECS Instance drop-down list to select multiple ECS instances.

  The specified ECS instances are automatically backed up based on this policy. By default, all files except system directories are backed up. For information about the excluded system directories, see the information provided in the console.

• If the resource type is OSS, click the OSS Bucket drop-down list to select multiple OSS Buckets.

  The specified OSS buckets of the Standard and Infrequent Access storage classes are automatically backed up based on this policy. By default, the entire bucket is backed up.

• If the resource type is NAS, click the NAS Filesystem drop-down list to select one or more NAS file systems.

  The specified NAS file systems of the General-purpose type are automatically backed up based on this policy. By default, the entire file system is backed up.

• If the resource type is Tablestore, click the Tablestore Instance drop-down list to select multiple Tablestore instances.

  The specified Tablestore instances are automatically backed up based on this policy. By default, the entire instance is backed up.

For an ECS instance backup policy:

• If the resource type is ECS Instance, click the ECS Instance drop-down list to select multiple ECS instances.

  The specified ECS instances are automatically backed up based on this policy. By default, all cloud disks are backed up.

To add resources of multiple resource types, you can click Associate Resource.

Modify a backup policy

After you create a backup policy, you can find the target policy in the policy list and click Edit Policy in the Actions column to modify the configured settings. The modified settings take effect during the next backup task execution.

Run a backup policy immediately

• Run a backup job immediately for all data sources that are associated with the backup policy.

  Find the target policy in the policy list. In the Actions column, choose ┇ > Execute Immediately. This operation immediately runs a backup job for all associated data sources. After the job is complete, you can go to the Backup Jobs page for each data source to view the execution progress.

• Run a backup job immediately for a specific data source.

  You can click the icon to expand the backup policy details and switch to the corresponding data source in the navigation pane on the left. In the Actions column of the target data source, choose ┇ > Execute Immediately. This action immediately runs a backup job for the target data source.

Dissociate a backup policy

After a backup policy is created, you can switch to the corresponding data source in the navigation pane on the left, click the Backup Plans tab, find the target backup plan, and in the Actions column, choose ┇ > Delete Plan to dissociate the backup policy from the data source. After the policy is dissociated, the backup plan for the data source is no longer executed.

Delete a backup policy

After a backup policy is created, you can find the target policy in the policy list and choose ┇ > Delete in the Actions column. After a backup policy is deleted, backup jobs for the associated data sources no longer run, but the backed-up data is retained.

Detach resource tags

After a backup policy is created, you can find the target policy in the policy list and click Edit Policy in the Actions column. Then, click the icon for the resource tag to detach it from the backup policy. When a resource tag is detached, the data sources associated with the tag are automatically removed from the backup policy. This change takes effect during the next backup policy execution.