<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Implementing Cloud Backup Security — API Reference

## AWS Backup

```bash
# List vaults
aws backup list-backup-vaults

# Describe vault (check lock status)
aws backup describe-backup-vault --backup-vault-name VAULT

# Enable vault lock
aws backup put-backup-vault-lock-configuration --backup-vault-name VAULT \
  --min-retention-days 30 --max-retention-days 365

# List backup plans
aws backup list-backup-plans

# List protected resources
aws backup list-protected-resources

# Start restore job
aws backup start-restore-job --recovery-point-arn ARN --iam-role-arn ROLE --metadata '{}'

# List copy jobs (cross-region)
aws backup list-copy-jobs
```

## AWS EBS/RDS

```bash
# List unencrypted snapshots
aws ec2 describe-snapshots --owner-ids self --query 'Snapshots[?!Encrypted]'

# Check RDS backup retention
aws rds describe-db-instances --query 'DBInstances[].{ID:DBInstanceIdentifier,Retention:BackupRetentionPeriod}'

# Enable RDS backup
aws rds modify-db-instance --db-instance-identifier ID --backup-retention-period 14
```

## Azure Backup

```bash
# List Recovery Services vaults
az backup vault list

# Check soft delete
az backup vault backup-properties show --name VAULT --resource-group RG

# Enable soft delete
az backup vault backup-properties set --name VAULT --resource-group RG --soft-delete-feature-state Enable

# List protected items
az backup item list --vault-name VAULT --resource-group RG
```

## GCP Backup

```bash
# List backup plans
gcloud backup-dr backup-plans list --project=PROJECT --location=LOCATION

# List backup vaults
gcloud backup-dr backup-vaults list --project=PROJECT --location=LOCATION

# List snapshots
gcloud compute snapshots list
```

## Backup Security Controls

| Control | AWS | Azure | GCP |
|---------|-----|-------|-----|
| Immutability | Vault Lock | Immutable Vault | Enforced Retention |
| Soft Delete | Default enabled | Configurable | Default enabled |
| Encryption | KMS CMK | Platform/CMK | CMEK |
| Cross-Region | Copy Jobs | GRS/CRR | Multi-region snapshot |
| Access Control | Vault Access Policy | RBAC | IAM bindings |
