Move an EBS volume between zones with a snapshot, and set out an AWS Backup plan

Steps

1. Pick two Availability Zones and keep their names:

AZ1=$(aws ec2 describe-availability-zones --filters Name=zone-type,Values=availability-zone --query 'AvailabilityZones[0].ZoneName' --output text)
AZ2=$(aws ec2 describe-availability-zones --filters Name=zone-type,Values=availability-zone --query 'AvailabilityZones[1].ZoneName' --output text)
echo $AZ1 $AZ2

2. See which instance types come with an instance store. This only reads:

aws ec2 describe-instance-types --instance-types t3.micro m5d.large --query 'InstanceTypes[].[InstanceType,InstanceStorageSupported]' --output text

t3.micro shows False: it has only network-attached EBS storage. m5d.large shows True: the d in its name marks local disks on the host, which are fast and included in the instance price, but whose data is lost when the instance stops or terminates. 3. Create a 1 GiB gp3 volume in the first zone and wait until it is available:

VOL_ID=$(aws ec2 create-volume --availability-zone $AZ1 --size 1 --volume-type gp3 --tag-specifications 'ResourceType=volume,Tags=[{Key=Name,Value=clf-lab19-vol}]' --query 'VolumeId' --output text)
aws ec2 wait volume-available --volume-ids $VOL_ID
aws ec2 describe-volumes --volume-ids $VOL_ID --query 'Volumes[0].[AvailabilityZone,Size,State]' --output text

It prints your first zone, 1 and available. This volume can attach only to an instance in that same zone. 4. Take a snapshot of the volume and wait for it to complete. An empty volume snapshots quickly, but it can still take a few minutes:

SNAP_ID=$(aws ec2 create-snapshot --volume-id $VOL_ID --description "clf-lab19 snapshot of an empty volume" --tag-specifications 'ResourceType=snapshot,Tags=[{Key=Name,Value=clf-lab19-snap}]' --query 'SnapshotId' --output text)
echo $SNAP_ID
aws ec2 wait snapshot-completed --snapshot-ids $SNAP_ID

The snapshot is private to your account; leave its permissions as they are. 5. Create a new volume from the snapshot in the second zone:

COPY_ID=$(aws ec2 create-volume --availability-zone $AZ2 --snapshot-id $SNAP_ID --volume-type gp3 --tag-specifications 'ResourceType=volume,Tags=[{Key=Name,Value=clf-lab19-vol-copy}]' --query 'VolumeId' --output text)
aws ec2 wait volume-available --volume-ids $COPY_ID
aws ec2 describe-volumes --volume-ids $VOL_ID $COPY_ID --query 'Volumes[].[Tags[0].Value,AvailabilityZone,SnapshotId]' --output table

The two volumes sit in different zones, and the copy records the snapshot it came from. A volume cannot move zones itself; the snapshot carried it. 6. Create a backup vault and a backup plan. The plan's one rule backs up daily at 05:00 UTC, moves each backup to cold storage after 30 days and deletes it after 120:

aws backup create-backup-vault --backup-vault-name clf-lab19-vault
cat > plan.json <<'EOF'
{
  "BackupPlanName": "clf-lab19-plan",
  "Rules": [
    {
      "RuleName": "daily-keep-120-days",
      "TargetBackupVaultName": "clf-lab19-vault",
      "ScheduleExpression": "cron(0 5 * * ? *)",
      "Lifecycle": {"MoveToColdStorageAfterDays": 30, "DeleteAfterDays": 120}
    }
  ]
}
EOF
PLAN_ID=$(aws backup create-backup-plan --backup-plan file://plan.json --query 'BackupPlanId' --output text)
echo $PLAN_ID

7. Open the AWS Backup console and choose Backup plans, then clf-lab19-plan. The Backup rules panel shows daily-keep-120-days, and Resource assignments is empty. That is deliberate: a plan protects only the resources assigned to it, usually by tag, so this one will never take a backup. Do not assign the volumes to it; the clean-up deletes them the same day.