← All guides

RDS automated backups: what they cover and what they don't

RDS snapshots and PITR are excellent — inside AWS. Cross-account risk, logical portability, and restore proof are the gaps.

What RDS gives you

Automated daily snapshots with PITR up to 35 days, cross-region copies if configured, and one-click (well, one-CloudFormation) restore to a new instance. For infrastructure failure, RDS backups are genuinely great.

The gaps

Snapshots restore whole instances — you can't pull one table out, inspect the data without paying for a full instance, or load it anywhere but RDS. Retention past 35 days needs manual snapshot juggling. And everything lives in the AWS account: a compromised root credential or an org-level billing incident reaches the backups too.

The complement: verified logical archives

Add scheduled pg_dump archives, encrypted, in a different account/provider, with monthly GFS retention — and restore-test them. Snapshot for infrastructure recovery, logical archive for data recovery and portability.

Whatever tool made your backup, the only way to know it works is to restore it. Firedrill does that automatically for every backup — or try a one-off free drill on a dump you already have.

A backup you've never restored is a hope, not a backup.

Firedrill restore-tests every backup it takes — on real infrastructure, with the report to prove it.