> This page is for Data Protection. > For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.eon.io/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.eon.io/_mcp/server. # Create Cloud Workload Backup Policies A cloud workload backup policy starts protecting your cloud resources. Once you create it, Eon backs up the resources assigned to the policy on the schedule you set. This article explains how to create a backup policy for cloud workloads in the Eon console. ## Create a backup policy You can create a backup policy from the Backup Policies page in the Eon console. To get started, click **Create Backup Policy**. The **Create Backup Policy** page opens. #### Before you start [manage-vaults]: /data-protection/backup-and-protection/backup-configuration/vaults/manage-vaults Before you create a backup policy, make sure you [set up the vaults][manage-vaults] you want the policy to store snapshots in, if applicable. #### Name the policy Provide a **Name** for the backup policy. A good policy name describes the kind of data you want to back up. For example, if backing up production resources that contain PII, you could give the name `Prod with PII`. #### Choose the backup policy type For **Backup source**, choose **Cloud resources**. Choose the **Type** of backup policy you want to create: **Standard**, **High frequency**, or **Point-in-time recovery**. For more information on backup policy types, see [Backup policy types]. Depending on the type you choose, you're presented with additional options: * If applicable, choose where to store snapshots under **Store snapshots in**: | Option | Description | | ----------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Vault** | Backs up assigned resources to your Eon vault. Resources backed up with this method are processed through your scanning account and, if applicable, are available through the file explorer and database explorer. | | **Vault cold tier** | Backs up assigned S3 buckets to the cold tier of an Eon vault in AWS, for large data that has few deletions or overwrites and is rarely restored. Only S3 buckets and AWS vaults can be selected, and retention must be at least 1 year. For when to use it, costs, and retention, see [Cold tier]. | | **AWS source account** | Backs up assigned resources to an AWS Backup Vault in the source account. Resources backed up with this method aren't scanned and aren't available through the file explorer or database explorer. | | **Azure source subscription** | Backs up assigned resources to an Azure Recovery Services vault in the source subscription. Resources backed up with this method aren't scanned and aren't available through the file explorer or database explorer. | * For point-in-time recovery backup policies, choose the resource type you want to back up with the policy. > **Note** > > These settings can't be changed after you continue. You can confirm the resources the backup policy is available for by clicking **Available for *x* resource types** and reviewing the list. Click **Continue**. [Backup policy types]: /data-protection/backup-and-protection/backup-configuration/backup-policies/cloud-workloads/about-cloud-workload-backup-policies#backup-policy-types[Cold tier]: /data-protection/cloud-workloads/aws/resources/s3#cold-tier #### Choose the dynamic resource selection In **Dynamic resource selection**, select your backup policy's default behavior for including resources: * **Include all**: All resources are included in the backup policy by default. If the policy type doesn't support all resources, only the supported resources are included. * **Use conditions**: Only the resources that match the conditions you set are included in the backup policy by default. If new resources that meet the conditions are discovered, they're also included in the policy. With classification conditions, a resource can also join or leave the policy after a recurring scan updates its classification. You can set a simple **AND** or **OR** list of conditions, or you can group conditions for fine-tuned targeting of resources. See [Work with conditions] and [Work with groups] below for how to work with these options. For an explanation of conditions, see [Conditions] in *About Cloud Workload Backup Policies*. * **Exclude all**: No resources are included in the backup policy by default. Using this option means that, unless you include resources with manual overrides, no resources are backed up by the policy. > **Note** > > With **Include all** or **Use conditions**, the list of resources assigned to the policy can change over time. > As Eon discovers new resources that match the policy's selection criteria, those resources are automatically included in the policy and backed up on the next scheduled run. If the policy type supports a recurring scan, a banner appears below the resource selection options when you set a [classification condition][Classification conditions]. The banner says Eon sets a recurring scan, and you set its schedule in the **Schedules** step. See [Scan schedule] in *About Cloud Workload Backup Policies*. The footer of this step shows the policy name and labels. Optionally, add labels to the policy to allow filtering. You add and remove labels next to **Backup policy name**. Click (Add label), type a label, and then press **Enter** or click . To remove a label, click the x icon on it. [Work with conditions]: #work-with-conditions[Work with groups]: #work-with-groups[Conditions]: /data-protection/backup-and-protection/backup-configuration/backup-policies/cloud-workloads/about-cloud-workload-backup-policies#conditions[Classification conditions]: /data-protection/backup-and-protection/backup-configuration/backup-policies/cloud-workloads/about-cloud-workload-backup-policies#classification-conditions[Scan schedule]: /data-protection/backup-and-protection/backup-configuration/backup-policies/cloud-workloads/about-cloud-workload-backup-policies#scan-schedule #### Work with conditions * To add a condition: Click (Add condition), then select the property, operator, and value for the condition. * To add a condition within a group: Click the large (Add condition) button in the group, or select (Add condition) > **Add condition** > **Above** or **Below**. Then select the property, operator, and value for the condition. * To delete a condition: Click the condition's (Actions) menu, then click **Delete condition**. For each condition, set the property, operator, and value. #### Work with groups * To nest an existing condition or group in a group: In an existing condition or group, click (Actions) > **Create group**. Select the group's logical **AND** or **OR** operator. * To delete a group and all the conditions it contains: Click the group's (Actions) menu, then click **Delete group**. #### Set manual overrides You can manually include or exclude resources by resource ID, overriding the dynamic selection. In **Included resources** or **Excluded resources**, choose or enter the resource ID you want to override in the respective list, and click to add it to the list. You can provide IDs for resources that aren't in your inventory yet, but that you anticipate will be discovered at some point in the future. Click **Next** to continue. #### Review the list of assigned resources In the **Resource list** step, you can review the list of resources that meet the conditions you set in the policy and make sure there's nothing unexpected. If the **Resource selection** step showed the recurring scan banner, two views appear above the list. **Matched now** shows the resources that match your conditions based on their current classification. **Scanned periodically** shows the resources the recurring scan includes that aren't assigned to the policy yet. A scan can assign each one if its classification changes to match. If you need to make changes, click **Back** to edit your conditions and manually assigned or excluded resources. When you're ready to continue, click **Next**. #### Set backup schedules In the **Schedules** step, choose whether you want a **Basic** or **Advanced** schedule. For more information and a comparison between the two, see [Backup schedules] in *About Cloud Workload Backup Policies*. [Backup schedules]: /data-protection/backup-and-protection/backup-configuration/backup-policies/cloud-workloads/about-cloud-workload-backup-policies#backup-schedules #### Basic schedule ![Basic backup schedule](/_fern-files/_img/2cd425bddcf567ccf56feb8b4804fabe07316c0fbe398d8bf8140d731161e264.webp) Each basic backup schedule defines a frequency, retention, and vault for snapshots. You can add as many backup schedules as you need. #### Advanced schedule ![Advanced backup schedule](/_fern-files/_img/5ec0f839b250cf47bb53607edbdc935c0499ac6c89a9855bc0e4a51bebb0439a.webp) By default, all backup schedules are calculated based on the resource time zone. You can change this behavior by changing **Schedules are in** to **UTC**. Each advanced backup schedule defines a frequency, retention and start times, and vault for snapshots. You can add as many backup schedules as you need. The available schedule and start time options change based on the frequency you choose: | Frequency | Schedule options | Start time options | | --------------- | ----------------------------------------------------- | ------------------ | | Daily | Time of day. | 4 to 22 hours. | | Weekly | Days of week and time of day. | 4 to 22 hours. | | Monthly | First, last, or specific day of month. | 4 to 22 hours. | | Annually | Specific dates. | 4 to 22 hours. | | More frequently | Automatically set for equal time between start times. | Automatically set. | * **To add a schedule**: Click **Add Backup Schedule** and configure the schedule. * **To duplicate a schedule**: Click the schedule's (Actions) menu, then click **Duplicate**. * **To delete a schedule**: Click the schedule's (Actions) menu, then click **Delete**. If your conditions include a classification condition, the **Recurring classification schedule** control appears below the backup schedules. Set how often the recurring scan runs; see [Scan schedule]. In advanced mode, the **Schedules are in** setting applies to the recurring scan as well. #### Additional configuration for source account storage If you selected **AWS source account** or **Azure source subscription** in the "Choose the backup policy type" step, additional configuration options appear in this step: #### Vault protection (AWS source account) When storing snapshots in an AWS source account, you can configure vault protection to enhance the security of your AWS Backup Vaults. From the **Vault protection** list, select the protection mode: * **None**: No special protection is applied to the backup vault. * **VaultLockGovernance**: Applies a vault lock in governance mode. Authorized users can make changes to the lock configuration. * **VaultLockCompliance**: Applies a vault lock in compliance mode. After a 3-day grace period, the lock becomes immutable, preventing any changes or deletions of backups until their retention period expires. * **AirGapped**: Creates a logically air-gapped vault for enhanced protection. Provides isolation from customer-managed vaults with retention between 1 and 100 years. > **Warning** > > Changing the vault protection mode after creating the policy creates a new AWS vault for future backups. > Existing snapshots remain in the old vault. #### Backup storage redundancy (Azure source subscription) When storing snapshots in an Azure source subscription, you must configure backup storage redundancy for the Azure Recovery Services Vault. From the **Backup storage redundancy** list, select the redundancy option: * **LRS** (Locally-redundant storage): Replicates your data three times within a single data center in the vault's region. Protects against hardware failures but not against data center or regional failures. * **ZRS** (Zone-redundant storage): Replicates your data across three availability zones in the vault's region. Protects against data center failures within the region. * **GRS** (Geo-redundant storage): Replicates your data to a secondary Azure region hundreds of miles away. Protects against regional outages and provides the highest level of durability. > **Warning** > > The backup storage redundancy setting is immutable after the vault is created. > Choose your redundancy option carefully, as you can't change it later without creating a new policy and re-backing up the resources. > **Info** > > Retention times are always converted to days, so a week is 7 days, a month is 30 days, and a year is 365 days. #### Set PiTR schedules This step applies only if you selected **Point-in-time recovery** as your backup policy type. ![PiTR schedules](/_fern-files/_img/9d804ea15c9fa3acba73f71ec819c5a3fd3dfe626697728097a61f53328d3f02.webp) Under **Point-in-time recovery (PiTR) schedules**, you can set the frequency and retention for PiTR snapshots. You can add as many PiTR schedules as you need. PiTR schedules must conform to these requirements: * A vault can be used by one PiTR schedule. * The vault in a PiTR schedule must be used by a backup schedule whose frequency is daily or more frequent, and whose retention period is longer than the PiTR retention period. To work with PiTR schedules: * **To add a schedule**: Click **Add PiTR Schedule** and configure the schedule. * **To duplicate a schedule**: Click the schedule's (Actions) menu, then click **Duplicate**. * **To delete a schedule**: Click the schedule's (Actions) menu, then click **Delete**. #### Save When you're done, click **Create**. Your policy begins backing up its assigned resources according to the configuration you set. To disable or enable the policy later, see [Manage Backup Policies](/data-protection/backup-and-protection/backup-configuration/backup-policies/manage-backup-policies#enable-or-disable-a-backup-policy). ## See also * [About Cloud Workload Backup Policies](/data-protection/backup-and-protection/backup-configuration/backup-policies/cloud-workloads/about-cloud-workload-backup-policies) * [Manage Backup Policies](/data-protection/backup-and-protection/backup-configuration/backup-policies/manage-backup-policies) * [Backup Policy Overview](/data-protection/backup-and-protection/backup-configuration/backup-policies/backup-policy-overview)