Configure cross-account backup vault replication to prevent backup data loss caused by improper account management or to unify backup data from multiple enterprise accounts. When you configure this feature, select a replication target vault shared by another Alibaba Cloud account. This provides cross-account disaster recovery for your data. You can recover data quickly from the replication target vault in another account as needed.
Background information
Cloud Backup supports cross-account backup vault replication based on resource sharing and resource directory, enabling flexible and controllable collaborative management of cross-account backup data.
A replication target vault stores backup data replicated from other regions or accounts. It serves as the destination for backup vault replication, enabling cross-region or cross-account disaster recovery and restoration. For more information, see Vault Types.
Cloud Backup protects data in business unit accounts. However, for data security or compliance reasons, an independent backup management account must also store a copy of this data. If a business unit experiences a risk event—such as key leakage, accidental data deletion, overdue payments, or business adjustments—the backup management account retains the backup data. You can use this data for recovery to ensure business continuity and data recoverability. Configure cross-account backup vault replication to automatically synchronize backup data from business unit accounts to the backup management account. This achieves efficient and compliant cross-account data protection.
How it works
After the destination account shares its replication target vault with the source account, select the shared replication target vault when configuring backup vault replication for the source account. All existing backup data in the source vault’s standard tier—and all new data generated afterward—begins continuous and secure synchronization to the destination account’s replication target vault through an asynchronous replication mechanism. This replication target vault acts as a read replica of the source vault, specifically for disaster recovery and high availability. To use cross-account backup vault replication, authorize the replication target vault using resource sharing. Sharing can be initiated based on resource directories.
The entire replication process runs automatically in the background and requires no manual intervention. This mechanism ensures data consistency and achieves an acceptable recovery point objective (RPO), balancing cross-region network latency and transfer efficiency. It meets the disaster recovery needs of most business scenarios.
If data in the source account’s backup vault is lost, initiate a quick recovery operation using the replication target vault. This rebuilds critical applications and data, effectively ensuring business continuity.
Quota and Limits
For the regions that support the cross-account backup vault replication feature, see Features supported by region.
Currently, cross-account replication for backup vaults supports data sources such as ECS files, OSS, local NAS, Alibaba Cloud NAS, Tablestore, CPFS, local files, and SAP HANA data sources.
ImportantECS whole-machine data sources support only enabling backup cross-region replication in backup policies. Enable Backup Cross-Region Replication
Cross-account replication for backup vaults does not support the following types of storage: OSS backup (30-day free trial), NAS backup (30-day free trial), Tablestore backup (30-day free trial) replication target vaults, archive vaults, Database Backup vaults, container backup vaults, and storage in an abnormal state (such as ERROR).
Each account can create a maximum of 5 replication target vaults in each region.
Recovery of VMware backup virtual machines from replication target vaults is not supported.
A backup vault can sync data to only one replication target vault at a time.
Replication target vaults only store and recover replicated data. Do not configure them with backup plans to create backups.
After configuring cross-account replication for backup vaults, the lifecycle of backup points in the target vault that are in a replicating state remains consistent with the source account. You cannot modify it.
When you enable automatic archiving for a source backup vault, archive layer data in the source backup vault will not sync to the replication target vault. After standard layer data in the source backup vault is transferred to the archive layer, the corresponding data in the replication target vault is also deleted.
Before deleting a source backup vault, stop cross-account replication for backup vaults. Deleting the source backup vault after stopping replication will not delete the replication target vault.
Backup points in replication target vaults are not associated with any backup policies. Therefore, after the replication relationship stops, backup points in the replication target vault are automatically deleted based on the retention period configured in the source backup vault. You can also manually delete them earlier. Even if the backup policy associated with the source backup vault is configured to retain at least one version, it will not take effect in the replication target vault. Currently, you cannot modify the retention period of backup points in replication target vaults.
Regardless of whether the source backup vault uses Cloud Backup-managed or KMS encryption, the replication target vault must use the same encryption method.
Prerequisites
The source vault’s Storage Vault Type must be General Backup, and the destination vault’s Storage Vault Type must be Replication Target Vault. View existing vault types in Vault Management. Create vaults in Vault Management, when creating backup policies, or when configuring vaults for backup sources.
To share resources within an organization based on a resource directory, complete the following steps:
The owner and principal of the replication target vault must belong to the same resource directory.
Enable the resource directory by completing Enable a resource directory, Create a folder, Create a member, Invite an Alibaba Cloud account to join a resource directory, and Move a member.
Ensure sharing with the resource directory organization is enabled. If not, enable resource directory organization sharing.
Procedure
Enable cross-account backup vault replication in Vault Management or the Policy Center. After enabling, all existing backup data in the source vault’s standard tier and all new backup data generated after the current time point automatically synchronize to the replication target vault.
For information on configuring backup vault replication when creating or editing a policy, see Policy Center.
Step 1: Create a replication target vault in the destination account
Create a replication target vault. This serves as the destination for cross-account backup vault replication.
Access the destination account’s Cloud Backup console - Vault Management. On the Storage Vaults page, select the destination region.
Click Create Replication Target Vault.
On the Create Replication Target Vault panel, configure the replication target vault parameters.
Parameter
Description
Vault Name
Enter the name of the replication target vault.
Vault Description
Enter a description for the replication target vault.
Vault Resource Group
Select the resource group for the replication target vault.
Vault Encryption Method
ImportantThe encryption method of the replication target vault must match that of the source vault.
Select the encryption method for the replication target vault. The default is Cloud Backup fully managed, which uses the encryption method provided by the backup service.
If the source vault uses custom key encryption from Alibaba Cloud KMS, click KMS and select the KMS Key ID. Select the Use KMS alias check box as needed to use a KMS key alias as the KMS Key ID identifier. For more information, see KMS Key Selection.
Click OK.
Step 2: Share resources with the source account in the destination account
After sharing a replication target vault with another account, the account owning the replication target vault incurs all storage and traffic fees. Evaluate potential cost risks before sharing.
Share the destination account’s resources with the source account using a resource share.
Access the destination account’s Cloud Backup console - Vault Management. On the Storage Vaults page, select the destination region.
Hover over the ┇ icon in the Actions column of the replication target vault, then select Resource Sharing.
On the Add Resources to Resource Share panel, configure sharing information.
To add the current resource to an existing resource share and reuse its principals and permissions, click Select from existing and choose an existing resource share.
The system displays the list of shared resources, principals, and associated permissions in the resource share.
For first-time sharing or when permission isolation is required, click Create Resource Share and configure the sharing parameters. For more parameter descriptions, see Create a resource share.
Parameter
Description
Resource Share Name
The name of the resource share.
Principal Scope
Select the principal scope. Values are:
Share resources with any account: The resource owner can share resources with any principal.
Only allow sharing within the resource directory: The resource owner can only share resources within the resource directory. This means the management account or members of the resource directory share resources with the current resource directory and its folders and members.
Principals
Specify principals. This supports two methods: Add via resource directory or Manually add. Principal types include Alibaba Cloud accounts, resource directory organizations, or folders (organizational units).
ImportantIf the resource directory is not enabled, you can only share resources with specified Alibaba Cloud accounts. The Add via resource directory method is only available when the resource directory is enabled.
Share resources with a specified Alibaba Cloud account (UID)
Set Add Method to Manually add. Then, set Principal Type to Alibaba Cloud account and configure the Principal ID. Click OK.
Share resources with all member accounts in the entire resource directory (including newly added members)
Configure using one of the following methods:
Set Add Method to Add via resource directory. Then, select the resource directory organization and click OK.
Set Add Method to Manually add. Then, set Principal Type to Resource directory organization and configure the Resource Directory ID. Click OK.
Share resources with all members in a specified folder (including newly added members)
Configure using one of the following methods:
Set Add Method to Add via resource directory. Then, select the folder and click OK.
Set Add Method to Manually add. Then, set Principal Type to Folder (organizational unit) and configure the Folder ID. Click OK.
Folder ID format: fd-string. For information about how to obtain a folder ID, see Obtain a folder ID.
Associated Permissions
Configure permissions for principals (vault users). Cloud Backup's replication target vault defaults to only one permission: AliyunRSDefaultPermissionHBRVault. Modifying associated permissions is not currently supported. For specific permission details, view the permission library on the Resource Sharing console.
Click OK.
Step 3: Configure backup vault replication in the source account
Configure cross-account backup vault replication to replicate source account data to the destination account’s replication target vault.
Access the source account’s Cloud Backup console - Vault Management. On the Storage Vaults page, select the region where the source vault is located.
Click Configure Backup Vault Replication in the Actions column of the target vault.
On the Initiate Backup Vault Replication panel, click Select Replication Target Vault. Then, select the region where the destination account’s vault is located and the shared replication target vault from Step 1.
Click OK.
After configuration, Cloud Backup begins synchronizing historical data from the source vault. View the synchronization progress in the destination account’s region. Once synchronization completes, all data from the source vault is backed up.
Restore data from a replication target vault
Restore ECS files
Create an Elastic Compute Service (ECS) instance in the console to which you want to restore data.
The ECS instance must be in the same region as the replication target vault.
In the Cloud Backup console, create a job to restore ECS files.
Set the source backup vault to the replication target vault. Set the restore destination to the ECS instance that you created in Step 1. The other parameters are configured in the same way as for a backup job. After the restore job is complete, the data is restored to the specified destination in the same region as the replication target vault.
Restore OSS
Create an OSS bucket to which you want to restore data.
The OSS bucket must be in the same region as the replication target vault.
In the Cloud Backup console, create an OSS restore job.
Set the source backup vault to the replication target vault. Set the restore destination to the OSS bucket that you created in Step 1. The other parameters are configured in the same way as for a backup job. After the restore job is complete, the data is restored to the specified destination in the same region as the replication target vault.
Restore Alibaba Cloud NAS
Create an Apsara File Storage NAS file system to which you want to restore data.
The Apsara File Storage NAS file system must be in the same region as the replication target vault.
In the Cloud Backup console, create a job to restore a single NAS file system in the same region.
Set the source backup vault to the created replication target vault. Set the restore destination to the Apsara File Storage NAS file system that you created in Step 1. The other parameters are configured in the same way as for a backup job. After the restore job is complete, the data is restored to the specified destination in the same region as the replication target vault.
Restore an SAP HANA instance
Prepare an SAP HANA instance to which you want to restore data.
The SAP HANA instance must be in the same region as the replication target vault.
In the Cloud Backup console, register the SAP HANA instance.
In the Cloud Backup console, create a job to restore SAP HANA.
Set the source backup vault to the replication target vault. Set the restore destination to the SAP HANA instance that you created in Step 1. The other parameters are configured in the same way as for a backup job. After the restore job is complete, the data is restored to the specified destination in the same region as the replication target vault.
Restore Tablestore
Create an instance to which you want to restore data.
The Tablestore instance must be in the same region as the replication target vault.
In the Cloud Backup console, create a job to restore a Tablestore table.
Set the source backup vault to the replication target vault. Set the restore destination to the Tablestore instance that you created in Step 1. The other parameters are configured in the same way as for a backup job. After the restore job is complete, the data is restored to the specified destination in the same region as the replication target vault.
Restore on-premises NAS
Prepare an on-premises NAS to which you want to restore data.
Install a backup client to run the restore job.
In the Cloud Backup console, create a job to restore the on-premises NAS.
Set the source backup vault to the replication target vault. Set the restore destination to the on-premises NAS that you prepared in Step 1. The other parameters are configured in the same way as for a backup job. After the restore job is complete, the data is restored to the specified destination in the same region as the replication target vault.
Restore on-premises files
Prepare a local server to which you want to restore data.
The restored files are saved on this local server. You must create a restore folder on the server.
Install a backup client to run the restore job.
In the Cloud Backup console, create a job to restore local files.
Set the source backup vault to the replication target vault. Set the restore destination to the local server that you prepared in Step 1. The other parameters are configured in the same way as for a backup job. After the restore job is complete, the data is restored to the specified destination in the same region as the replication target vault.
Restore CPFS
Prepare a CPFS file system to which you want to restore data.
The CPFS file system must be in the same region as the replication target vault.
In the Cloud Backup console, create a job to restore CPFS.
Set the source backup vault to the replication target vault. Set the restore destination to the CPFS file system that you created in Step 1. The other parameters are configured in the same way as for a backup job. After the restore job is complete, the data is restored to the specified destination in the same region as the replication target vault.
Stop Cross-Account Backup Vault Replication
After stopping cross-account backup vault replication, the current replication relationship cannot be recovered. Proceed with caution. An unlinked replication target vault only supports data recovery.
To stop cross-account backup vault replication, go to the source vault’s region. Click Stop Backup Vault Replication in the Actions column of the source vault. Confirm to stop.
After stopping cross-account backup vault replication, new data in the source vault no longer replicates to the destination. Replicated data in the replication target vault remains available for recovery.
Deletion removes all backup data in the vault, making corresponding backups unrecoverable. Proceed with caution.
After stopping cross-account backup vault replication, perform the following operations as needed:
Delete data in the replication target vault: Go to the Create Recovery Job page and select this replication target vault for deletion.
Enable Backup Lock for the replication target vault: This prevents accidental deletion or ransomware attacks on backup data before its retention period expires.
Delete data in the source vault: Go to the source vault’s region. Hover over the ┇ icon in the Actions column of the source vault, then select Delete. Confirm to delete.
Billing
Using cross-account backup vault replication incurs storage capacity fees. If the backup vault and replication target vault are in different regions, cross-region replication traffic fees also apply. The account owning the replication target vault bears both the storage capacity fees and the traffic fees generated by cross-region, cross-account replication.
Refer to the Resource Plan Purchase Guide to purchase a subscription resource plan to offset storage capacity fees. Cross-region replication traffic fees only support pay-as-you-go billing.
Cloud Backup does not charge recovery fees when you restore data from a replication target vault to corresponding resources in the same region.
When you restore data to local NAS or local servers over the Internet (not VPN or leased line), outbound traffic over Internet fees apply. Traffic fees are charged based on the actual amount of data restored. For more information, see Local NAS Recovery Fees and Local Server File Recovery Fees.
For detailed pricing, see Cloud Backup Pricing Details.
FAQ
Is cross-account backup vault replication charged?
The feature itself is free. You pay for the capacity of the replication target vault used in replication. For cross-region scenarios, traffic fees also apply. The account owning the replication target vault bears both storage capacity and traffic fees. For details, see Billing.
What is the difference between cross-account backup vault replication and cross-account backup? What are their respective application scenarios?
Cross-account backup vault replication means the source account has performed backups and generated backup data. The source account replicates its backup vault data to other Alibaba Cloud accounts for backup data redundancy or cross-account use.
Cross-account backup means a backup operations account centrally issues backup policies to other accounts. The backup data from these other accounts stores in the backup operations account. The backup operations account uses this backup data to perform data recovery operations as needed, achieving unified backup data management.
Both methods are widely used for enterprise data security and compliance. Choose based on your specific enterprise needs, or combine both methods to achieve unified backup data management and backup data redundancy simultaneously.
How can I view the replication target vault?
You can switch to the region where the replication target vault is located. On the Storage Vaults page in the Cloud Backup console, view the created replication target vault.
What is the basis for the billable storage usage of a replication target vault?
The Storage Vault Data Size of the replication target vault is the basis for its billable storage usage.
Can I set the synchronization frequency for cross-account backup vault replication?
For example, if the source vault backs up daily, but the replication target vault only needs weekly synchronization.
No. Data from the source vault synchronizes to the replication target vault through continuous replication.
Does a replication target vault support zone-redundant storage?
This is supported.
To maximize the redundancy of backup data, the system automatically selects a vault type based on regional support. In regions that support zone-redundant storage, a zone-redundant storage (ZRS)-enabled backup vault is created by default. In other regions, a locally redundant storage (LRS)-enabled backup vault is created.
Currently, the regions that support ZRS are China (Hangzhou), China (Shanghai), China (Beijing), China (Zhangjiakou), China (Ulanqab), China (Shenzhen), Hong Kong (China), Japan (Tokyo), Singapore, Indonesia (Jakarta), Germany (Frankfurt), and Malaysia (Kuala Lumpur).