iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Yes—but AWS Backup’s “dry run” is a real restore test, not a no-resource simulation. Restore Testing schedules restore jobs from selected recovery points, creates temporary EC2 instances, Aurora clusters, or other supported resources, and records restore duration. An EventBridge event can then invoke a Lambda validator to test application health and report the result. After the validation window, AWS Backup attempts cleanup, although timing and deletion behavior vary by resource type.
This guide shows how to build that workflow for an EC2-based application stack and an Aurora database, while making the boundary clear: AWS Backup restores the resource types you select; it does not prove that a multi-tier application was restored atomically. Your validation code must test dependencies, connectivity, data integrity, and recovery-time objectives.
What does an AWS Backup “dry-run” restore actually do?
A restore test executes an AWS Backup restore job against a recovery point and provisions temporary resources. AWS describes Restore Testing as providing “automated and periodic evaluation of restore viability” and monitoring of restore-job duration times. The operation uses the same recovery points as an on-demand restore, so it exercises the restore path rather than merely checking whether a backup object exists. See the AWS Backup restore-testing guide.
The term dry run is therefore operational shorthand. It does not mean “no infrastructure is created.” A test can create billable EC2, Aurora, storage, networking, and related resources. AWS Backup adds an awsbackup-restore-test tag to resource types that support tag-on-restore, and uses the configured validation retention period before attempting deletion.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
A test also does not restore an application stack as one indivisible transaction. EC2 and Aurora are selected and restored by resource type. Whether the restored web tier can reach the restored database, whether secrets and security groups are usable, and whether application data is coherent are workload-specific questions that your validator must answer.
How do I test an AWS Backup restore?
Build the process as a scheduled plan, one or more resource selections, an event-driven validator, and an operational cleanup check. The order matters because the plan defines when and how often tests run, while selections define which recovery points and resource types are eligible.
1. Define the recovery objective and test boundary
Write down the recovery-time objective (RTO), the recovery-point objective (RPO), the AWS account and Region to test, the backup vaults that contain eligible recovery points, and the network boundary in which temporary resources may run. AWS recommends using a designated account for restore testing. A separate account or isolated test VPC can reduce the risk that a test instance reaches production services.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match- RTO: the maximum acceptable time from restore initiation to a usable application. Restore Testing records restore-job duration, which gives you a repeatable infrastructure component of the RTO.
- RPO: the age of the recovery point you are willing to restore. Define a recovery-point window rather than assuming the newest point is always appropriate.
- Scope: identify the EC2 resources, Aurora clusters, and any other supported resource types that are required to represent the workload.
- Isolation: decide which subnets, security groups, endpoints, and IAM roles are permitted for test resources. Avoid granting a test instance unrestricted production access.
2. Choose specific or random recovery points
Restore-testing selections can use specific recovery points or choose eligible points within a configured time window. Random selection is useful for detecting a backup that is technically present but unusable at an arbitrary age; a fixed point is useful when you need a reproducible regression test. Document the choice because it changes what a passing test proves.
3. Decide what “passed” means before scheduling
A restore job reaching COMPLETED proves that AWS Backup finished the restore operation. It does not prove that an HTTP endpoint returns a healthy response, that an Aurora user can authenticate, or that expected records are present. Define assertions for each resource and dependency before you create the plan.
4. Set a validation retention period
The restore-testing plan guide documents validation retention from 1 to 168 hours. The selection API describes ValidationWindowHours as 0 to 168 hours, so confirm the current console or API behavior before standardizing a value. Use the shortest period that allows all checks, evidence collection, and incident triage; a window that is too short can delete a resource before an engineer inspects it.
Can AWS Backup automatically test EC2 and Aurora restores?
Yes. AWS Backup Restore Testing supports both EC2 and Aurora, among other resource types. Each type is assigned to a selection in the restore-testing plan, and each selection can carry the restore role, recovery-point criteria, and any required restore metadata overrides.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| Resource | What AWS Backup tests | What your validator should add | Important boundary |
|---|---|---|---|
| EC2 | Creation of the selected instance or instances from a recovery point, including the restore job and supported restore metadata. | Instance status and system checks, reachable health endpoint, expected ports, attached-volume checks, application process readiness, and log or metric assertions. | An instance can be healthy while the application cannot reach Aurora, secrets, queues, or external services. |
| Aurora | Creation of the selected Aurora cluster from a recovery point, subject to the resource type’s restore behavior and metadata. | Cluster and instance availability, TLS connection, credential retrieval, schema checks, read/write transaction, and a small data-integrity query. | A database can be available even when the restored EC2 application has incompatible configuration or schema expectations. |
| Other supported types | The resource-specific restore operation selected in the plan. | Checks tailored to that service, plus dependency checks from the application owner. | Cleanup duration and tag-on-restore support differ by resource type. |
For an EC2-and-Aurora application, treat the two selections as coordinated tests rather than assuming AWS Backup will order them according to your application topology. If the application requires a database before the web tier starts, encode that dependency in the validation workflow or use a staged test design.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
How do I create a restore-testing plan and selections?
Create the plan first, then add selections. AWS exposes separate CloudFormation resources for the plan and for each selection: AWS::Backup::RestoreTestingPlan and AWS::Backup::RestoreTestingSelection. The same separation appears in the console and API workflow.
- Open the restore-testing area. In the AWS Backup console, open Restore testing and choose to create a plan. Select the account and Region in which the test resources will be created.
- Set the schedule. Choose the recurrence that gives you useful evidence without creating unnecessary restore cost. A monthly test may suit a stable workload; a higher-risk system may need weekly or more frequent runs.
- Configure the recovery-point window. Select the backup vaults and resource criteria, and choose whether eligible points are selected specifically or randomly within the allowed window.
- Set the validation window and tags. Pick a retention period long enough for automated checks and human inspection. Add cost-center, owner, environment, and test-run tags where the resource type supports tag-on-restore.
- Create the plan before selections. A plan can exist without a selection. Do not treat a successful plan-creation response as evidence that a restore test is configured.
- Add an EC2 selection. Choose the EC2 resources or criteria, the restore IAM role, recovery-point rules, and any restore metadata overrides such as subnet or security-group settings required by the test account.
- Add an Aurora selection. Configure Aurora separately with its own resource criteria, restore role, and metadata. Confirm that the selected recovery points contain the cluster and that the test account has the required KMS and networking permissions.
The restore-testing plan guide lists service limits including 100 plans, 30 selections per plan, and a 365-day maximum selection window. These are account and service limits documented by AWS; check the current service documentation before designing a larger fleet of plans.
How do I trigger automatic validation with EventBridge?
Create an Amazon EventBridge rule for AWS Backup Restore Job State Change events and match jobs whose status is COMPLETED. Send the event to a Lambda function or another supported target. AWS’s validation workflow is documented in Restore testing validation.
A minimal event pattern can match the service, event type, and completion status:
{"source":["aws.backup"],"detail-type":["Restore Job State Change"],"detail":{"status":["COMPLETED"]}}Use the event payload and the plan or resource identifiers available in your Region to narrow the rule or to filter inside Lambda. Do not assume every completion event belongs to the restore-testing plan; production on-demand restores can generate similar state changes.
EventBridge delivery for AWS Backup events is documented as best effort, not a guaranteed real-time handoff. Configure CloudWatch alarms, inspect AWS Backup restore-job status, and maintain a fallback poller or operator runbook for a job that completes without a validation invocation. See AWS Backup events in Amazon EventBridge.
How do I validate a restore automatically?
Have the validator identify the restore job and created resource from the event, wait for service-level readiness, execute application checks, and submit one final validation result. A successful AWS Backup job is only an input to this process.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →EC2 validation checks
- Confirm the instance reaches the expected running state and passes both system and instance status checks.
- Verify that the intended IAM instance profile, security groups, subnets, and encrypted volumes are present.
- Wait for the application process to start, then call a health endpoint from an allowed network location. Check an expected status code and a response field that demonstrates a real dependency check.
- Test required outbound and inbound paths without sending production traffic. For example, use a synthetic request or a private test endpoint.
- Collect instance identifiers, timestamps, and failure messages in structured logs so an engineer can reproduce the result.
Aurora validation checks
- Wait until the restored cluster and writer instance report an available state.
- Connect with TLS using a test credential retrieved from the designated secrets path; do not hard-code a production password in the validator.
- Run a read query against a known table and verify schema version or migration markers.
- Perform a bounded write-and-read transaction in a test schema, or compare checksums/counts for a carefully chosen data set that will not mutate business data.
- Check that parameter groups, encryption, and connectivity match the recovery objective.
Report the result once
After the checks finish, call AWS Backup’s PutRestoreValidationResult operation with a success or failure status and a concise message. AWS notes that the validation status cannot be changed after it is set, so do not submit “passed” before asynchronous checks, retries, and dependency tests are complete. The Lambda SDK version used in AWS’s sample did not include this operation; AWS suggests using a Lambda layer with a current SDK. Verify SDK support in the runtime you deploy rather than copying an old sample unchanged.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Use bounded retries for resources that need time to become reachable, and make the validator idempotent. If EventBridge retries the invocation, the function should recognize an already-processed restore job and avoid creating duplicate test traffic or writing conflicting results.
Does AWS Backup restore testing create real resources?
Yes. Restore testing creates temporary resources through actual restore jobs. The resources consume service capacity and can incur charges for the restore operation and for the resources while they exist. The test also produces the same kind of restore activity that an on-demand restore produces; when CloudTrail is enabled for the relevant events, AWS documents StartRestoreJob calls for test jobs.
AWS attempts cleanup after validation or after the configured retention period, but cleanup is not necessarily instantaneous. Resource behavior differs: some types support tag-based deletion, while others may use resource names or require manual intervention. A resource whose awsbackup-restore-test tag is removed may no longer be deleted automatically.
How do I clean up resources after a restore test?
Design cleanup as a monitored workflow rather than assuming the retention timer is a deletion guarantee.
- Keep the AWS Backup test tag. Do not strip
awsbackup-restore-testfrom resources that support tag-on-restore. Preserve your own owner and cost tags as well. - Check deletion after every run. Query EC2, Aurora, volumes, snapshots, security groups, and other dependent resources in the test account and Region after the validation window.
- Handle exceptions by resource type. AWS notes that some resources may take longer to clean up. S3 lifecycle processing, for example, can take days; do not apply that timing to EC2 or Aurora.
- Use a manual-cleanup runbook. Record the restore job ID, resource IDs, and deletion errors. Grant a narrowly scoped operator role permission to remove only resources created by the test.
- Alert on leftovers and cost. A missing deletion event, an orphaned volume, or an Aurora cluster that remains available should open an operational ticket.
Never use a broad “delete everything in the test account” policy as a substitute for tagging and ownership. The test account may contain unrelated recovery artifacts or investigations that must be retained.
What does restore testing cost, and how does it measure RTO?
AWS Backup restore testing and the underlying restore jobs can incur charges. The amount depends on test frequency, recovery-point size, resource types, storage, compute time, networking, and how long resources remain before cleanup. Use tags and cost-allocation reports to separate restore-test spend from production recovery activity.
For RTO measurement, capture a start timestamp when the restore job begins and an end timestamp when the validator declares the application usable. Keep the infrastructure restore duration and the application validation duration as separate metrics. A test can meet the restore-job target but miss the application RTO because dependency checks, migrations, DNS, or secrets take longer.
Which automation design should I choose?
Use AWS Backup Restore Testing when you want a managed schedule and recovery-point selection. Use a custom restore workflow when the application requires orchestration that the plan and selections cannot express by themselves. Many teams use both: Restore Testing provisions representative resources, while EventBridge, Lambda, and workload code perform validation.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
| Decision area | AWS Backup restore-testing plan | Custom schedule calling restore APIs |
|---|---|---|
| Scheduling and selection | Managed periodic schedule with resource selections and recovery-point criteria. | Complete control over sequencing and selection logic, but you own scheduling, retries, and state. |
| Provisioning | Console, API, or CloudFormation plan plus separate selections. | Code must create restore jobs, track identifiers, and apply metadata itself. |
| Validation depth | Event-driven handoff to Lambda or another target; application checks remain your responsibility. | Can orchestrate multi-step checks directly, at the cost of more code and maintenance. |
| Isolation and cleanup | Validation retention and AWS Backup cleanup behavior, with resource-specific exceptions. | You define teardown, tagging, and orphan detection for every resource. |
| Reliability and observability | Restore-job status plus EventBridge events and workflow logs; EventBridge delivery is best effort. | You must build event handling, polling, alarms, and recovery for every failure mode. |
| Cost and RTO evidence | Restore duration is tracked by the service; frequency and resource scope drive charges. | Potentially finer-grained timing, but you must instrument every phase. |
How should I monitor and troubleshoot the workflow?
The plan runs but no restore job starts
Check that the plan has at least one active selection, that the recovery-point window contains eligible points, and that the restore IAM role can read the vault, decrypt the recovery point, and create the target resource. Confirm the account and Region of the plan rather than checking a different console context.
The restore job fails
Inspect the AWS Backup restore-job status and failure message first. Common categories include missing KMS permissions, unavailable subnets or security groups, unsupported restore metadata, quota limits, and a recovery point that cannot satisfy the selected resource criteria. Fix the selection or role, then run a new test; do not treat a previously failed job as validated.
The job completes but Lambda does not run
Because EventBridge delivery is best effort, inspect the rule’s event pattern, target permissions, Lambda logs, and dead-letter or retry configuration. Use AWS Backup job-status polling as a fallback and alert when a completed restore has no validation result within an agreed interval.
Free tools Windows power users keep installed
One-click scans. No signup required.
Validation fails even though resources are healthy
Separate infrastructure readiness from application readiness. Check DNS, routes, security groups, secrets, certificates, database parameter groups, schema version, and test data assumptions. A validator that only checks EC2 status or Aurora availability is too shallow to represent an application recovery.
Resources remain after the validation window
Find out whether the resource type supports tag-on-restore, whether the AWS Backup test tag was removed, and whether the resource has a service-specific deletion delay. Use the recorded resource IDs for a scoped manual cleanup and investigate why the automated path did not finish.
What permissions and isolation should the validator use?
Give the restore role only the permissions needed to restore the selected resource types in the test account. Give the Lambda execution role read access to the restore-job and resource state, permission to run the specific health checks, and permission to call PutRestoreValidationResult. Keep cleanup permissions in a separate operator role when possible.
Use test-only secrets and endpoints. Network rules should allow the validator to reach the restored EC2 and Aurora resources without allowing those resources to modify production databases, queues, or object stores. If a dependency cannot be safely restored, replace it with a controlled test double and document that limitation in the validation result.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →What does a practical EC2-and-Aurora test run look like?
At the scheduled time, AWS Backup chooses eligible recovery points and starts the EC2 and Aurora restore jobs defined by their selections. EventBridge delivers completion events to the validator. The validator waits for both resources to be service-ready, checks Aurora connectivity and a known data assertion, starts or probes the EC2 application, verifies an endpoint that exercises the database path, and records a single pass or fail result with the restore job identifiers.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
After the validation window, AWS Backup begins cleanup. A separate monitor confirms that the test instances, clusters, volumes, and other tagged resources disappear and reports exceptions. The operations dashboard retains restore duration, validation duration, result, recovery-point age, failure reason, and cleanup status so the next test can be compared with the previous one.
This design gives you evidence about three different questions: whether AWS can restore the selected recovery points, whether the restored services become usable, and whether the complete recovery fits the RTO. Keep those results separate; collapsing them into a single “backup passed” label hides the failure mode you need to fix.
Frequently Asked Questions
Can I use a different recovery point on every restore test?
Yes. Configure the selection to choose randomly from eligible recovery points in its window instead of naming one fixed point. Random choice broadens coverage across backup ages, while a fixed point is better for a repeatable regression test.
Recommended Free Tools
What should happen if the validator starts before Aurora is ready?
Treat the completion event as the end of the restore job, not proof that every endpoint is immediately accepting connections. Poll the cluster and application with bounded exponential backoff, then fail with a timestamped readiness reason if the deadline expires.
Can one restore-testing plan represent a complete application stack?
A plan can contain selections for multiple resource types, but AWS Backup does not define application dependency ordering for you. Your workflow must coordinate EC2, Aurora, networking, secrets, and any external services that the application needs.
How can I prove that a restore test met the RTO?
Record the restore-job start and completion times, then record when application-level checks pass. Compare both intervals with the RTO and retain the recovery-point age and validation logs so a passing result is reproducible.
Where can I investigate a restore-test operation after it finishes?
Use AWS Backup restore-job history for service status and CloudWatch logs for validator details. If CloudTrail is enabled for the relevant events, AWS documents restore API activity such as StartRestoreJob, which can connect the test to the resources it created.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
