Backup and DR overview

Backup and DR is a managed service that provides centralized backup and recovery for enterprise workloads running in Google Cloud and hybrid environments. It offers policy-based governance, automated data protection, and application-consistent backups from a single interface in the Google Cloud console, with full programmatic support using Terraform and Google Cloud APIs.

This document gives you a high-level overview of Backup and DR, including its benefits, the workloads it supports, its data protection features, and its core hierarchy of resources.

Benefits of Backup and DR

Backup and DR provides the following benefits:

  • Protection against modification and deletion: Backup vault enforces write once, read many (WORM) immutability and indelibility. This approach ensures that your backups remain intact and recoverable, even in the event of ransomware attacks or accidental deletion.
  • Reduced recovery times and data loss: Incremental-forever capture and instant volume mounting help you achieve low recovery point objectives (RPO) and recovery time objectives (RTO).
  • Centralized administration: Manage your backup strategy from a single interface in the Google Cloud console. This approach lets you assign policies, track compliance, and automatically discover newly provisioned resources across your organization.
  • Storage and network efficiency: Efficient block-level change tracking and direct-to-vault storage reduce network transfer overhead and minimize your overall storage footprint.
  • Flexible recovery options: Perform granular file-level restores, full workload recoveries, or cross-region and cross-project cloning to support both targeted data retrieval and comprehensive disaster recovery drills.

Workloads supported by Backup and DR

Backup and DR supports the following Google Cloud infrastructure, managed services, and enterprise workloads:

Workload category Supported platforms and engines Consistency options
Compute Engine infrastructure Compute Engine instances, Persistent Disk, Filestore instances, Google Cloud VMware Engine VMs Crash-consistent, application-consistent
Managed databases Cloud SQL (MySQL, PostgreSQL, SQL Server), AlloyDB Application-consistent
Self-managed databases Oracle Database, Microsoft SQL Server, SAP HANA, MySQL, PostgreSQL on VMs or Bare Metal Solution Application-consistent
Hybrid and bare metal Bare Metal Solution, on-premises VMware Crash-consistent, application-consistent

For detailed version and operating system support, see the Support matrix for Backup and DR.

Data protection in Backup and DR

Backup and DR provides the following security controls across the backup lifecycle to help you protect your data:

  • Data retention compliance: To meet regulatory requirements, lock backup data against modification or deletion until your configured vault retention timers expire.
  • Customer-managed encryption: Protect your backup data by using your own encryption keys. Backup and DR supports customer-managed encryption keys (CMEK) that are managed in Cloud Key Management Service. For more information, see CMEK for Backup and DR.
  • Granular access control: Use Identity and Access Management (IAM) to enforce role-based access control and the principle of least privilege across all administrative and restore operations.
  • Data exfiltration mitigation: Enclose backup operations within VPC Service Controls security perimeters to help secure your backup workflows.
  • Auditability and monitoring: Integrate with Cloud Logging and Cloud Monitoring to track compliance, monitor operational metrics, and receive real-time alerts.

Resource hierarchy

Backup and DR organizes data protection into a logical hierarchy:

  • Backup vaults: Google-managed, isolated storage resources that serve as the primary security boundary for immutable and indelible backups. Each Backup vault supports an optional minimum enforced retention period (up to 99 years) to prevent early deletion or tampering, and can store backups in regional or compatible multi-regional locations.
  • Backup plans: Policies that define where and how workloads are protected. A backup plan links target workloads to a specific backup vault and aggregates one or more backup rules.
  • Backup rules: Rules within a backup plan that define backup frequency (hourly, daily, weekly, monthly, or yearly), backup windows, and retention durations before backups expire.
  • Workloads and backups: Protected resources (such as Compute Engine instances or Cloud SQL databases) and their discrete point-in-time recovery points.

Storage options

Backup and DR supports two storage targets:

  • Backup vault storage (recommended): Google-managed, isolated storage providing immutable and indelible backups with enforced retention.
  • Self-managed storage: Storage resources—such as Persistent Disk snapshots and Cloud Storage buckets—created and managed in your Google Cloud projects using the appliance management console.

Storage options comparison

Feature Backup vault storage (recommended) Self-managed storage
Management Fully managed by Backup and DR Managed by you
Immutable and indelible backups Yes No
Minimum enforced retention Yes (up to 99 years) No
Multi-region replication Yes Yes
CMEK support Yes (Compute Engine, Persistent Disk, Cloud SQL) Yes
Primary interface Google Cloud console Appliance management console

For more information, see Backup and DR backup vault storage and Storage pools overview.

Limitations

Backup and DR has the following limitations:

  • Location compatibility: Backup vault locations must be compatible with the source workload location.
  • Multi-region availability: Multi-region vaults are supported for select workloads; AlloyDB and Filestore instances in backup vaults are limited to regional locations.
  • CMEK workload support: CMEK in backup vault storage is supported for Compute Engine instances, Persistent Disk, and Cloud SQL.
  • Appliance management console separation: Workloads managed through the appliance management console use an appliance-based architecture with configuration models that are distinct from those of console-native vaulted backups.

30-day introductory trial

The Backup and DR 30-day introductory trial lets you explore and evaluate Backup and DR features for up to 30 days without backup management charges or vault storage charges. You can activate the trial on any eligible project by using the Google Cloud console or the backupdr API.

During the trial, you can configure backup vaults, create backup plans, and protect supported workloads such as Compute Engine instances and Cloud SQL databases.

For more information about trial eligibility, billing terms, and configuration steps, see 30-day introductory trial for Backup and DR and Configure and manage the 30-day introductory trial for Backup and DR.

What's next