Cloud Backup provides the Associate Resource Tag feature, which automatically associates and disassociates resources from a backup policy based on resource tags. This topic describes the Associate Resource Tag feature of Cloud Backup, including how the feature works, its limits, usage notes, and how to configure it.
How it works
Feature introduction
Cloud Backup dynamically tracks tag changes across your resources. Each time a backup policy runs, Cloud Backup queries all resources that match the tag conditions and automatically adjusts resource associations — adding newly matched resources and removing resources that no longer match. This eliminates the need to manually update resource lists as your infrastructure changes.
Tag rule types
When configuring a backup policy, set the resource association mode to All resources or Specified tags:
All resources: Cloud Backup automatically backs up all resources of the specified resource type.
Specified tags: Cloud Backup backs up resources that match the tag conditions.
For Specified tags mode, define up to 30 tag rules. Each rule requires a tag key and a tag value with one of the following match types:
|
Match type |
Behavior |
|
Equal to a specified tag value |
Matches resources whose tag key has exactly the specified value |
|
Not equal to a specified tag value |
Matches resources whose tag key does not have the specified value |
|
Matches any value of a tag key |
Matches resources that have the tag key, regardless of the value |
All tag rules must be satisfied for a resource to be included (logical AND between rules). Resources of different types are evaluated independently (logical OR between different resources).
Association and disassociation behavior
Each time a backup policy runs, Cloud Backup evaluates tag conditions for all resources:
|
Resource state |
Action |
|
Matches tags, not yet associated |
Back up and automatically associate |
|
Matches tags, already associated |
Back up and keep the association |
|
Does not match tags, not associated |
Skip — no backup, no change |
|
Does not match tags, automatically associated |
Remove the automatic association, skip backup |
|
Does not match tags, manually associated |
Keep the manual association, back up as scheduled |
If a resource matches tags in multiple backup policies, Cloud Backup backs up the resource according to each policy.
Automatic association vs. manual association
A backup policy can associate resources automatically (by tags) or manually. A resource can be associated with the same backup policy only once.
Editing a backup plan converts the association from automatic to manual. Manual associations are not affected by tag changes.
Service-linked roles
Cloud Backup checks tag conditions by calling the resource query operation of the Resource service and the tag query operation of the Resource Management service. Cloud Backup automatically creates the following service-linked roles to obtain the required permissions:
AliyunServiceRoleForHbrEcsBackup — for ECS file and ECS instance backup based on resource tags
AliyunServiceRoleForHbrOssBackup — for OSS backup based on resource tags
AliyunServiceRoleForHbrNasBackup — for NAS backup based on resource tags
AliyunServiceRoleForHbrOtsBackup — for Tablestore backup based on resource tags
Default backup scope
When a backup policy is automatically associated with a resource based on tags, Cloud Backup applies the following default settings:
-
ECS files: All files in the ECS instance, except the following system directories. Bandwidth throttling is disabled.
Windows
Windows\
python27\
Program Files (x86)\
Program Files\
ProgramData\
Boot\
$RECYCLE.BIN\
System Volume Information\
Users\Administrator\NTUSER.DAT
pagefile.sys
Users\Administrator\ntuser.dat.LOG1
Linux
/bin/
/usr/bin/
/sbin/
/boot/
/proc/
/sys/
/srv/
/lib/
/selinux/
/usr/sbin/
/run/
/lib32/
/lib64/
/lost+found/
OSS: All objects in the OSS bucket. The OSS inventory feature is not used.
NAS: All files in the root directory of the NAS file system.
Tablestore: All tables of the Tablestore instance. Bandwidth throttling is disabled.
ECS instance: All disks of the ECS instance. Application consistency is disabled.
To back up specific content (for example, a specific directory or OSS prefix), configure these settings in a backup plan.
Limits
The Associate Resource Tag feature is available only for Elastic Compute Service (ECS) instance backup, ECS file backup, Object Storage Service (OSS) backup, File Storage NAS (NAS) backup, and Tablestore backup.
You can specify up to 30 resource tags.
Tags can only be configured on the Policy Center page in the Cloud Backup console. On other data source pages, you can create or edit backup policies, but you cannot edit tags.
Usage notes
When a new resource is associated with the tag or all resources are selected, the backup policy is automatically associated with the resource. The resource is backed up starting from the next scheduled backup point.
When a resource no longer matches the tag conditions, the backup policy is automatically disassociated. The resource is no longer backed up starting from the next scheduled backup point.
If you modify any parameter in a backup plan that was created from a backup policy, the association changes from automatic (tag-based) to manual. The resource is no longer affected by tag changes in the backup policy.
Tag-based association does not support fine-grained backup content selection. To back up a specific directory on an ECS instance or a specific prefix in an OSS bucket, configure these settings in a backup plan instead.
-
For ECS file backup, Cloud Backup automatically installs a backup client on the ECS instance when the backup starts. No manual operations are required. The client is automatically uninstalled when both of the following conditions are met:
The ECS files are disassociated from all backup policies.
All backup points of ECS files are deleted or released upon expiration.
Configure tag-based backup
-
When you create or edit a backup policy, associate the backup policy with resources by specifying tags. However, you cannot specify backup content in a finer-grained manner. For more information, see Manage backup policies.
On the Policy Center page, click the
icon on the left side of a backup policy to view its associated data sources.ImportantResources that match the specified tags appear in the associated resource list only after the backup policy is successfully run at least once.
To remove resource tags from a backup policy, see Remove resource tags from the backup policy.