AWS Backup

AWS Backup is a fully managed service that centralizes and automates backup across AWS services, storing recovery points in backup vaults and applying retention and lifecycle policies to them.

Available solutions

Zabbix version 7.4 7.0
Source: templates/cloud/AWS/aws_http

AWS Backup Vault by HTTP

Overview

This template uses AWS Backup API calls to list and retrieve metrics. For more information, please refer to the AWS Backup API page.

Additional information about metrics and API methods used in the template:

Requirements

Zabbix version: 7.4 and higher.

Tested versions

This template has been tested on:

  • AWS Backup Vault service

Configuration

Zabbix should be configured according to the instructions in the Templates out of the box section.

Setup

The template gets AWS Backup vault metrics and uses the script item to make HTTP requests to the AWS Backup API.

Before using the template, you need to create an IAM policy with the necessary permissions for the Zabbix role in your AWS account.

Required permissions

Add the following required permissions to your Zabbix IAM policy in order to collect AWS backup vaults and jobs.

{
    "Version":"2012-10-17",
    "Statement":[
        {
          "Action":[
              "backup:ListBackupVaults",
              "backup:ListBackupJobs",
              "backup:ListCopyJobs",
              "backup:ListRestoreJobs"
          ],
          "Effect":"Allow",
          "Resource":"*"
        }
    ]
  }

Access Key Authorization

If you are using access key authorization, you need to generate an access key and a secret key for an IAM user with the necessary permissions:

  1. Create an IAM user with programmatic access.
  2. Attach the required policy to the IAM user.
  3. Generate an access key and a secret key.
  4. Use the generated credentials in the macros {$AWS.ACCESS.KEY.ID} and {$AWS.SECRET.ACCESS.KEY}.

Assume Role authorization

For using Assume Role authorization, add the appropriate permissions to the role you are using:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "sts:AssumeRole",
            "Resource": "arn:aws:iam::{Account}:user/{UserName}"
        },
        {
            "Effect": "Allow",
            "Action": [
                "backup:ListBackupVaults",
                "backup:ListBackupJobs",
                "backup:ListCopyJobs",
                "backup:ListRestoreJobs"
            ],
            "Resource": "*"
        }
    ]
}

Trust Relationships for Assume Role Authorization

Next, add a principal to the trust relationships of the role you are using:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::{Account}:user/{UserName}"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

Set the following macros: {$AWS.ACCESS.KEY.ID}, {$AWS.SECRET.ACCESS.KEY}, {$AWS.STS.REGION}, {$AWS.ASSUME.ROLE.ARN}.

Note: If you set the {$AWS.ASSUME.ROLE.AUTH.METADATA} macro to true and set the macros {$AWS.STS.REGION} and {$AWS.ASSUME.ROLE.ARN}, the Zabbix server or proxy will attempt to retrieve the role credentials from the instance metadata service. This means that the Zabbix server or proxy must be running on an AWS EC2 instance with an IAM role assigned that has the necessary permissions. This approach is recommended when running Zabbix inside an AWS EC2 instance with an IAM role assigned, as it simplifies credential management.

Role-Based Authorization

If you are using role-based authorization, set the appropriate permissions:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "iam:PassRole",
            "Resource": "arn:aws:iam::<<--account-id-->>:role/<<--role_name-->>"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "backup:ListBackupVaults",
                "backup:ListBackupJobs",
                "backup:ListCopyJobs",
                "backup:ListRestoreJobs"
            ],
            "Resource": "*"
        }
    ]
}

Trust Relationships for Role-Based Authorization

Next, add a principal to the trust relationships of the role you are using:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": [
                    "backup.amazonaws.com"
                ]
            },
            "Action": [
                "sts:AssumeRole"
            ]
        }
    ]
}

Note: Using role-based authorization is only possible when you use a Zabbix server or proxy inside AWS.

Set the macros: {$AWS.AUTH_TYPE}, {$AWS.REGION}, and {$AWS.BACKUP_VAULT.NAME}.

For more information about managing access keys, see the official AWS documentation.

See the section below for a list of macros used for LLD filters.

Macros used

Name Description Default
{$AWS.DATA.TIMEOUT}

API response timeout.

 60s
{$AWS.PROXY}

Sets the HTTP proxy value. If this macro is empty, no proxy is used.
{$HTTP.TLS.VERIFY}

TLS certificate verification for script items: "none" - disabled, "peer" - verify the certificate chain and expiration, "full" - full verification. Any other value enables full verification. To override the setting for this template only, define the macro with the context "AWS Backup Vault", e.g. {$HTTP.TLS.VERIFY:"AWS Backup Vault"}.

 full
{$AWS.ACCESS.KEY.ID}

Access key ID.
{$AWS.SECRET.ACCESS.KEY}

Secret access key.
{$AWS.REGION}

AWS backup vault region code.

 us-west-1
{$AWS.AUTH_TYPE}

Authorization method. Possible values: access_key, assume_role, role_base.

 access_key
{$AWS.ASSUME.ROLE.AUTH.METADATA}

Add when using the assume_role through instance metadata or environment authorization method. Possible values: false, true.

 false
{$AWS.STS.REGION}

Region used in assume role request.

 us-east-1
{$AWS.ASSUME.ROLE.ARN}

ARN assume role; add when using the assume_role authorization method.
{$AWS.BACKUP_VAULT.NAME}

AWS backup vault name.
{$AWS.BACKUP_JOB.STATE.MATCHES}

Filter of discoverable jobs by state.

 .*
{$AWS.BACKUP_JOB.STATE.NOT_MATCHES}

Filter to exclude discovered jobs by state.

 CHANGE_IF_NEEDED
{$AWS.BACKUP_JOB.RESOURCE_TYPE.MATCHES}

Filter of discoverable jobs by resource type.

 .*
{$AWS.BACKUP_JOB.RESOURCE_TYPE.NOT_MATCHES}

Filter to exclude discovered jobs by resource type.

 CHANGE_IF_NEEDED
{$AWS.BACKUP_JOB.RESOURCE_NAME.MATCHES}

Filter of discoverable jobs by resource name.

 .*
{$AWS.BACKUP_JOB.RESOURCE_NAME.NOT_MATCHES}

Filter to exclude discovered jobs by resource name.

 CHANGE_IF_NEEDED
{$AWS.BACKUP_JOB.PERIOD}

The number of days over which to retrieve backup jobs.

 7

Items

Name Description Type Key and additional info
Get jobs

Get a list of jobs in the vault.

 Script aws.backup_vault.job.get
Get data

Retrieve AWS backup vault metrics.

More information here: https://docs.aws.amazon.com/aws-backup/latest/devguide/API_BackupVaultListMember.html

 Script aws.backup_vault.data.get
Recovery points

The total number of recovery points in the backup vault.

 Dependent item aws.backup_vault.recovery_points

Preprocessing

  • JSON Path: $.NumberOfRecoveryPoints

  • Does not match regular expression: null

    ⛔️Custom on fail: Discard value
Age

The age of the vault.

 Dependent item aws.backup_vault.age

Preprocessing

  • JSON Path: $.CreationDate

  • JavaScript: return Date.now() / 1000 - value
Retention period, min

The minimum retention period that the vault retains its recovery points.

 Dependent item aws.backup_vault.retention.min

Preprocessing

  • JSON Path: $.MinRetentionDays

  • Does not match regular expression: null

    ⛔️Custom on fail: Set error to: The vault does not have the minimum retention period set.
Retention period, max

The maximum retention period that the vault retains its recovery points.

 Dependent item aws.backup_vault.retention.max

Preprocessing

  • JSON Path: $.MaxRetentionDays

  • Does not match regular expression: null

    ⛔️Custom on fail: Set error to: The vault does not have the maximum retention period set.
Lock status

Indicates whether AWS Backup Vault Lock is applied to the selected backup vault. When the vault is locked, delete and update operations on recovery points in that vault are prevented.

 Dependent item aws.backup_vault.lock.status

Preprocessing

  • JSON Path: $.Locked

  • Replace: false -> 0

  • Replace: true -> 1
Lock time remain

The remaining time before AWS Backup Vault Lock configuration becomes immutable, meaning it cannot be changed or deleted.

 Dependent item aws.backup_vault.lock.time_left

Preprocessing

  • JSON Path: $.LockDate

  • Does not match regular expression: null

    ⛔️Custom on fail: Set error to: Either the vault is not locked, or the lock date is not specified.

  • JavaScript: The text is too long. Please see the template.
Lock date

The date and time when AWS Backup Vault Lock configuration becomes immutable, meaning it cannot be changed or deleted.

 Dependent item aws.backup_vault.lock.date

Preprocessing

  • JSON Path: $.LockDate

  • Does not match regular expression: null

    ⛔️Custom on fail: Set error to: Either the vault is not locked, or the lock date is not specified.
State

The current state of the backup vault.

Possible values are:

- Unknown

- Creating

- Available

- Failed

 Dependent item aws.backup_vault.state

Preprocessing

  • JSON Path: $.VaultState

  • JavaScript: The text is too long. Please see the template.
Jobs: Size, avg

The average size, in bytes, of a backup (recovery point).

This value can render differently depending on the resource type as AWS Backup pulls in data information from other AWS services. For example, the value returned may show a value of 0, which may differ from the anticipated value.

 Dependent item aws.backup_vault.job.size.avg

Preprocessing

  • JSON Path: $[?(@.job_size > 0)].job_size.avg()

    ⛔️Custom on fail: Discard value

  • Discard unchanged with heartbeat: 1h
Jobs: Size, max

The maximum size, in bytes, of a backup (recovery point).

This value can render differently depending on the resource type as AWS Backup pulls in data information from other AWS services. For example, the value returned may show a value of 0, which may differ from the anticipated value.

 Dependent item aws.backup_vault.job.size.max

Preprocessing

  • JSON Path: $[?(@.job_size > 0)].job_size.max()

    ⛔️Custom on fail: Discard value

  • Discard unchanged with heartbeat: 1h
Jobs: Size, min

The minimum size, in bytes, of a backup (recovery point).

This value can render differently depending on the resource type as AWS Backup pulls in data information from other AWS services. For example, the value returned may show a value of 0, which may differ from the anticipated value.

 Dependent item aws.backup_vault.job.size.min

Preprocessing

  • JSON Path: $[?(@.job_size > 0)].job_size.min()

    ⛔️Custom on fail: Discard value

  • Discard unchanged with heartbeat: 1h
Jobs: Backup

The number of backup jobs in the vault over the last {$AWS.BACKUP_JOB.PERIOD} day(s).

 Dependent item aws.backup_vault.job.backup.count

Preprocessing

  • JSON Path: $.[?(@.job_type == "backup-job")].length()

  • Discard unchanged with heartbeat: 1h
Jobs: Restore

The number of restore jobs in the vault over the last {$AWS.BACKUP_JOB.PERIOD} day(s).

 Dependent item aws.backup_vault.job.restore.count

Preprocessing

  • JSON Path: $.[?(@.job_type == "restore-job")].length()

  • Discard unchanged with heartbeat: 1h
Jobs: Copy

The number of copy jobs in the vault over the last {$AWS.BACKUP_JOB.PERIOD} day(s).

 Dependent item aws.backup_vault.job.copy.count

Preprocessing

  • JSON Path: $.[?(@.job_type == "copy-job")].length()

  • Discard unchanged with heartbeat: 1h
Jobs: Total

The total number of jobs in the vault over the last {$AWS.BACKUP_JOB.PERIOD} day(s).

 Dependent item aws.backup_vault.job.total.count

Preprocessing

  • JSON Path: $.length()

  • Discard unchanged with heartbeat: 1h
Jobs: Failed backup

The number of failed backup jobs in the vault over the last {$AWS.BACKUP_JOB.PERIOD} day(s).

 Dependent item aws.backup_vault.job.backup.failed.count

Preprocessing

  • JSON Path: The text is too long. Please see the template.

  • Discard unchanged with heartbeat: 1h
Jobs: Failed restore

The number of failed restore jobs in the vault over the last {$AWS.BACKUP_JOB.PERIOD} day(s).

 Dependent item aws.backup_vault.job.restore.failed.count

Preprocessing

  • JSON Path: The text is too long. Please see the template.

  • Discard unchanged with heartbeat: 1h
Jobs: Failed copy

The number of failed copy jobs in the vault over the last {$AWS.BACKUP_JOB.PERIOD} day(s).

 Dependent item aws.backup_vault.job.copy.failed.count

Preprocessing

  • JSON Path: The text is too long. Please see the template.

  • Discard unchanged with heartbeat: 1h

Triggers

Name Description Expression Severity Dependencies and additional info
AWS Backup vault: Restore job has appeared

New restore job has appeared.

 change(/AWS Backup Vault by HTTP/aws.backup_vault.job.restore.count)>0 Average Manual close: Yes
AWS Backup vault: Copy job has appeared

New copy job has appeared.

 change(/AWS Backup Vault by HTTP/aws.backup_vault.job.copy.count)>0 Warning Manual close: Yes

LLD rule AWS Backup job discovery

Name Description Type Key and additional info
AWS Backup job discovery

AWS Backup job discovery.

 Dependent item aws.backup_vault.job.discovery

Preprocessing

  • Discard unchanged with heartbeat: 1h

Item prototypes for AWS Backup job discovery

Name Description Type Key and additional info
Job state [{#AWS.BACKUP_JOB.RESOURCE_NAME}][{#AWS.BACKUP_JOB.ID}]

The state of the job.

Possible values are:

- Unknown

- Created

- Pending

- Running

- Aborting

- Aborted

- Completed

- Failed

- Expired

- Partial

 Dependent item aws.backup_vault.job.state["{#AWS.BACKUP_JOB.ID}"]

Preprocessing

  • JSON Path: $.[?(@.job_id == "{#AWS.BACKUP_JOB.ID}")].job_state.first()

    ⛔️Custom on fail: Discard value

  • JavaScript: The text is too long. Please see the template.

  • Discard unchanged with heartbeat: 1h

Trigger prototypes for AWS Backup job discovery

Name Description Expression Severity Dependencies and additional info
AWS Backup vault: Job failed [{#AWS.BACKUP_JOB.ID}]

Job has failed.

 last(/AWS Backup Vault by HTTP/aws.backup_vault.job.state["{#AWS.BACKUP_JOB.ID}"])=7 High Manual close: Yes
AWS Backup vault: Job has been aborted [{#AWS.BACKUP_JOB.ID}]

Job has been aborted.

 last(/AWS Backup Vault by HTTP/aws.backup_vault.job.state["{#AWS.BACKUP_JOB.ID}"])=5 Average Manual close: Yes
AWS Backup vault: Job has expired [{#AWS.BACKUP_JOB.ID}]

Job expired.

 last(/AWS Backup Vault by HTTP/aws.backup_vault.job.state["{#AWS.BACKUP_JOB.ID}"])=8 Warning Manual close: Yes
AWS Backup vault: Job is in an unknown state [{#AWS.BACKUP_JOB.ID}]

Job is in unknown state.

 last(/AWS Backup Vault by HTTP/aws.backup_vault.job.state["{#AWS.BACKUP_JOB.ID}"])=0 Warning Manual close: Yes

Articles and documentation

+ Propose new article

No se encuentra la integración que necesitas?

Request custom integration

Zabbix integration team will develop custom integration based on your requirements and Zabbix best practices.

Request

Propose integration

Have you already developed high quality integration and want to submit to Zabbix integration repository?

Propose