{"id":83151,"date":"2026-10-14T20:24:26","date_gmt":"2026-10-14T14:54:26","guid":{"rendered":"https:\/\/www.tothenew.com\/blog\/?p=83151"},"modified":"2026-10-27T23:07:22","modified_gmt":"2026-10-27T17:37:22","slug":"why-aws-automated-snapshots-arent-enough-how-to-automate-opensearch-backups-to-your-own-s3-bucket","status":"publish","type":"post","link":"https:\/\/www.tothenew.com\/blog\/why-aws-automated-snapshots-arent-enough-how-to-automate-opensearch-backups-to-your-own-s3-bucket\/","title":{"rendered":"Why AWS Automated Snapshots Aren\u2019t Enough: How to Automate OpenSearch Backups to Your Own S3 Bucket"},"content":{"rendered":"<article>If you run <a href=\"https:\/\/docs.aws.amazon.com\/opensearch-service\/latest\/developerguide\/what-is.html\" target=\"_blank\" rel=\"noopener noreferrer\">Amazon OpenSearch Service<\/a> in production, automated hourly snapshots sound like a good safety net. In reality, they have major operational catches:<\/p>\n<ul>\n<li>Backups sit in a hidden, AWS-managed bucket you cannot inspect or download.<\/li>\n<li>You cannot export them across accounts or regions for disaster recovery.<\/li>\n<li>You cannot retain them past 14 days for audits or compliance.<\/li>\n<li>If someone deletes the domain, all automated snapshots vanish immediately.<\/li>\n<\/ul>\n<p>Relying solely on AWS automated backups is a serious operational risk.<\/p>\n<p>The answer is simple. Own the manual snapshots by storing them in your own Amazon S3 bucket and automate the entire lifecycle. This guide walks through our production pattern &#8211; covering IAM roles, the 403 permission gotcha, daily automation, and safe restores.<\/p>\n<h2>How It Works Under the Hood<\/h2>\n<p>OpenSearch requires no background agents or sync jobs. When you trigger a snapshot, the service assumes an IAM role you provide, connects directly to S3, and writes your Lucene index files into a prefix you define.<\/p>\n<div id=\"attachment_83156\" style=\"width: 635px\" class=\"wp-caption aligncenter\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-83156\" class=\"size-large wp-image-83156\" src=\"https:\/\/www.tothenew.com\/blog\/wp-ttn-blog\/uploads\/2026\/09\/opensearch_s3_flow-2-1024x572.jpg\" alt=\"OpenSearch Manual Snapshot Architecture\" width=\"625\" height=\"349\" srcset=\"https:\/\/www.tothenew.com\/blog\/wp-ttn-blog\/uploads\/2026\/09\/opensearch_s3_flow-2-1024x572.jpg 1024w, https:\/\/www.tothenew.com\/blog\/wp-ttn-blog\/uploads\/2026\/09\/opensearch_s3_flow-2-300x167.jpg 300w, https:\/\/www.tothenew.com\/blog\/wp-ttn-blog\/uploads\/2026\/09\/opensearch_s3_flow-2-768x429.jpg 768w, https:\/\/www.tothenew.com\/blog\/wp-ttn-blog\/uploads\/2026\/09\/opensearch_s3_flow-2-624x348.jpg 624w, https:\/\/www.tothenew.com\/blog\/wp-ttn-blog\/uploads\/2026\/09\/opensearch_s3_flow-2.jpg 1376w\" sizes=\"auto, (max-width: 625px) 100vw, 625px\" \/><p id=\"caption-attachment-83156\" class=\"wp-caption-text\">OpenSearch Manual Snapshot Architecture<\/p><\/div>\n<p>In order for this to work, three things must align:<\/p>\n<ol>\n<li><strong>Snapshot IAM Role:<\/strong> Trusted for OpenSearch (<code>es.amazonaws.com<\/code>) with S3 read\/write permissions.<\/li>\n<li><strong>Execution Role:<\/strong> The Bastion identity sending signed requests, granted <a href=\"https:\/\/docs.aws.amazon.com\/IAM\/latest\/UserGuide\/id_roles_use_passrole.html\" target=\"_blank\" rel=\"noopener noreferrer\"><code>iam:PassRole<\/code><\/a> on the snapshot role.<\/li>\n<li><strong>OpenSearch Internal Security:<\/strong> Under <a href=\"https:\/\/docs.aws.amazon.com\/opensearch-service\/latest\/developerguide\/fgac.html\" target=\"_blank\" rel=\"noopener noreferrer\">FGAC<\/a>, the execution role must be mapped to internal OpenSearch roles.<\/li>\n<\/ol>\n<h2>Step 1: Create the S3 Bucket (Avoid the Glacier Trap)<\/h2>\n<p>Create a dedicated S3 bucket in the <strong>same AWS region<\/strong> as your OpenSearch domain (e.g., <code>my-opensearch-backup-bucket<\/code>). In private VPCs, S3 Gateway Endpoints are strictly regional &#8211; buckets in other regions fail verification with <code>Status Code: 301<\/code>. Enable default encryption (<code>SSE-S3<\/code>) and configure lifecycle rules with care.<\/p>\n<h3>Why You Should Avoid S3 Glacier<\/h3>\n<p>Many teams attempt to cut costs by transitioning snapshots to Glacier. <strong>Do not do this.<\/strong><\/p>\n<p>OpenSearch requires instant, random read access to snapshot metadata and index chunks when verifying repositories or restoring data. If files reside in Glacier, repository checks fail and restores time out.<\/p>\n<p><strong>The recommended lifecycle approach:<\/strong><\/p>\n<ul>\n<li>Store active snapshots in <strong>S3 Standard<\/strong>.<\/li>\n<li>Transition objects under <code>opensearch-snapshots\/<\/code> to <a href=\"https:\/\/docs.aws.amazon.com\/AmazonS3\/latest\/userguide\/storage-class-intro.html\" target=\"_blank\" rel=\"noopener noreferrer\"><strong>S3 Standard-Infrequent Access (Standard-IA)<\/strong><\/a> after 30 days. You retain millisecond retrieval at much lower storage costs.<\/li>\n<\/ul>\n<h2>Step 2: The Two IAM Roles You Need<\/h2>\n<p>You need two distinct IAM roles: one for OpenSearch itself, and one for the machine executing registration commands.<\/p>\n<h3>1. The Role OpenSearch Assumes (<code>opensearch-s3-snapshot-role<\/code>)<\/h3>\n<p>Create an IAM role with this trust policy:<\/p>\n<pre><code>{\r\n  \"Version\": \"2012-10-17\",\r\n  \"Statement\": [\r\n    {\r\n      \"Effect\": \"Allow\",\r\n      \"Principal\": { \"Service\": \"es.amazonaws.com\" },\r\n      \"Action\": \"sts:AssumeRole\"\r\n    }\r\n  ]\r\n}<\/code><\/pre>\n<p>Attach an inline policy granting permissions on your bucket:<\/p>\n<pre><code>{\r\n  \"Version\": \"2012-10-17\",\r\n  \"Statement\": [\r\n    {\r\n      \"Effect\": \"Allow\",\r\n      \"Action\": [\"s3:ListBucket\"],\r\n      \"Resource\": [\"arn:aws:s3:::my-opensearch-backup-bucket\"],\r\n      \"Condition\": {\r\n        \"StringLike\": { \"s3:prefix\": [\"opensearch-snapshots\/*\", \"opensearch-snapshots\"] }\r\n      }\r\n    },\r\n    {\r\n      \"Effect\": \"Allow\",\r\n      \"Action\": [\"s3:GetObject\", \"s3:PutObject\", \"s3:DeleteObject\"],\r\n      \"Resource\": [\"arn:aws:s3:::my-opensearch-backup-bucket\/opensearch-snapshots\/*\"]\r\n    }\r\n  ]\r\n}<\/code><\/pre>\n<h3>2. Permissions for Your Bastion Host Execution Role<\/h3>\n<p>Registering snapshot repositories requires sending a signed HTTP request to OpenSearch. The calling role needs OpenSearch access and permission to pass the snapshot role:<\/p>\n<pre><code>{\r\n  \"Version\": \"2012-10-17\",\r\n  \"Statement\": [\r\n    {\r\n      \"Effect\": \"Allow\",\r\n      \"Action\": [\"es:ESHttpPut\", \"es:ESHttpGet\", \"es:ESHttpPost\"],\r\n      \"Resource\": [\"arn:aws:es:us-east-1:123456789012:domain\/my-opensearch-cluster\/*\"]\r\n    },\r\n    {\r\n      \"Effect\": \"Allow\",\r\n      \"Action\": \"iam:PassRole\",\r\n      \"Resource\": \"arn:aws:iam::123456789012:role\/opensearch-s3-snapshot-role\"\r\n    }\r\n  ]\r\n}<\/code><\/pre>\n<h2>Step 3: The Wall Everyone Hits (OpenSearch Internal Security)<\/h2>\n<p>This is where most engineers get stuck. After configuring IAM roles with <code>iam:PassRole<\/code>, sending the registration request from your Bastion returns:<\/p>\n<pre><code>{\r\n  \"error\": {\r\n    \"root_cause\": [{\r\n      \"type\": \"security_exception\",\r\n      \"reason\": \"no permissions for [cluster:admin\/repository\/put] and User [name=arn:aws:iam::123456789012:role\/ec2-ssm-role, ...]\"\r\n    }],\r\n    \"type\": \"security_exception\",\r\n    \"status\": 403\r\n  }\r\n}<\/code><\/pre>\n<p>Even with AWS <code>AdministratorAccess<\/code>, OpenSearch rejects the request.<\/p>\n<div id=\"attachment_83152\" style=\"width: 635px\" class=\"wp-caption aligncenter\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-83152\" class=\"size-large wp-image-83152\" src=\"https:\/\/www.tothenew.com\/blog\/wp-ttn-blog\/uploads\/2026\/09\/opensearch_permissions_model-1024x572.jpg\" alt=\"AWS IAM vs. OpenSearch Fine-Grained Access Control (FGAC)\" width=\"625\" height=\"349\" srcset=\"https:\/\/www.tothenew.com\/blog\/wp-ttn-blog\/uploads\/2026\/09\/opensearch_permissions_model-1024x572.jpg 1024w, https:\/\/www.tothenew.com\/blog\/wp-ttn-blog\/uploads\/2026\/09\/opensearch_permissions_model-300x167.jpg 300w, https:\/\/www.tothenew.com\/blog\/wp-ttn-blog\/uploads\/2026\/09\/opensearch_permissions_model-768x429.jpg 768w, https:\/\/www.tothenew.com\/blog\/wp-ttn-blog\/uploads\/2026\/09\/opensearch_permissions_model-624x348.jpg 624w, https:\/\/www.tothenew.com\/blog\/wp-ttn-blog\/uploads\/2026\/09\/opensearch_permissions_model.jpg 1376w\" sizes=\"auto, (max-width: 625px) 100vw, 625px\" \/><p id=\"caption-attachment-83152\" class=\"wp-caption-text\">AWS IAM vs. OpenSearch Fine-Grained Access Control (FGAC)<\/p><\/div>\n<p>When <strong>Fine-Grained Access Control (FGAC)<\/strong> is enabled, AWS IAM only authenticates identity; internal OpenSearch security authorizes actions. You must map your execution role to two built-in roles:<\/p>\n<ul>\n<li><code>manage_snapshots<\/code>: Allows registering repositories and manual snapshots\/restores.<\/li>\n<li><code>snapshot_management_full_access<\/code>: Allows creating and managing automated SM policies.<\/li>\n<\/ul>\n<h3>OpenSearch Dashboards (GUI)<\/h3>\n<ol>\n<li>Navigate to <strong>Security<\/strong> \u2192 <strong>Roles<\/strong>.<\/li>\n<li>For both <code>manage_snapshots<\/code> and <code>snapshot_management_full_access<\/code>, open <strong>Mapped users<\/strong> \u2192 <strong>Manage mapping<\/strong>, paste your execution role ARN under <strong>Backend roles<\/strong>, and click <strong>Map<\/strong>.<\/li>\n<\/ol>\n<div id=\"attachment_83408\" style=\"width: 1034px\" class=\"wp-caption aligncenter\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-83408\" class=\"size-full wp-image-83408\" src=\"https:\/\/www.tothenew.com\/blog\/wp-ttn-blog\/uploads\/2026\/09\/opensearch_roles_mapping.png\" alt=\"OpenSearch Roles Mapping\" width=\"1024\" height=\"451\" srcset=\"https:\/\/www.tothenew.com\/blog\/wp-ttn-blog\/uploads\/2026\/09\/opensearch_roles_mapping.png 1024w, https:\/\/www.tothenew.com\/blog\/wp-ttn-blog\/uploads\/2026\/09\/opensearch_roles_mapping-300x132.png 300w, https:\/\/www.tothenew.com\/blog\/wp-ttn-blog\/uploads\/2026\/09\/opensearch_roles_mapping-768x338.png 768w, https:\/\/www.tothenew.com\/blog\/wp-ttn-blog\/uploads\/2026\/09\/opensearch_roles_mapping-624x275.png 624w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><p id=\"caption-attachment-83408\" class=\"wp-caption-text\">OpenSearch Roles Mapping<\/p><\/div>\n<h2>Step 4: Register the S3 Repository with awscurl<\/h2>\n<p>Because OpenSearch endpoints require <a href=\"https:\/\/docs.aws.amazon.com\/general\/latest\/gr\/signing_aws_api_requests.html\" target=\"_blank\" rel=\"noopener noreferrer\">AWS Signature Version 4 (SigV4)<\/a> authentication, standard <code>curl<\/code> fails without signed headers. Use <a href=\"https:\/\/github.com\/okigan\/awscurl\" target=\"_blank\" rel=\"noopener noreferrer\"><code>awscurl<\/code><\/a> to sign HTTP requests using your instance credentials:<\/p>\n<pre><code class=\"language-bash\">sudo yum install python3 python3-pip -y\r\nsudo pip3 install awscurl<\/code><\/pre>\n<p>Register your repository:<\/p>\n<pre><code class=\"language-bash\">awscurl -XPUT \"https:\/\/search-my-opensearch-domain-xxxxxx.us-east-1.es.amazonaws.com\/_snapshot\/daily-snapshots\" \r\n  --service es \r\n  --region us-east-1 \r\n  -H 'Content-Type: application\/json' \r\n  -d '{\r\n    \"type\": \"s3\",\r\n    \"settings\": {\r\n      \"bucket\": \"my-opensearch-backup-bucket\",\r\n      \"base_path\": \"opensearch-snapshots\/prod-cluster\/daily\",\r\n      \"region\": \"us-east-1\",\r\n      \"endpoint\": \"s3.us-east-1.amazonaws.com\",\r\n      \"role_arn\": \"arn:aws:iam::123456789012:role\/opensearch-s3-snapshot-role\"\r\n    }\r\n  }'<\/code><\/pre>\n<p><strong>Two Critical Gotchas to Avoid:<\/strong><\/p>\n<ul>\n<li><strong>No Trailing Slashes on <code>base_path<\/code>:<\/strong> Never end <code>base_path<\/code> with a slash (use <code>opensearch-snapshots<\/code>, not <code>opensearch-snapshots\/<\/code>), or OpenSearch creates double slashes (<code>\/\/<\/code>) and verification fails.<\/li>\n<li><strong>The S3 301 Error:<\/strong> If you hit <code>Status Code: 301 (The bucket must be addressed using the specified endpoint)<\/code>, your S3 bucket resides in a different region. Private VPC S3 Gateway Endpoints cannot route cross-region\u2014create the bucket in the same region as OpenSearch.<\/li>\n<\/ul>\n<p>Verify that OpenSearch connects to S3:<\/p>\n<pre><code class=\"language-bash\">awscurl -XGET \"https:\/\/search-my-opensearch-domain-xxxxxx.us-east-1.es.amazonaws.com\/_snapshot\/_all\" \r\n  --service es \r\n  --region us-east-1<\/code><\/pre>\n<p>If it returns <code>{\"daily-snapshots\":{\"type\":\"s3\", ...}}<\/code>, your cluster and S3 bucket are officially linked.<\/p>\n<h2>Step 5: Automate Daily Snapshots (No Lambda Needed)<\/h2>\n<p>Historically, automating snapshots required custom Lambda functions. OpenSearch includes a native <a href=\"https:\/\/opensearch.org\/docs\/latest\/tuning-your-cluster\/availability-and-recovery\/snapshots\/snapshot-management\/\" target=\"_blank\" rel=\"noopener noreferrer\">Snapshot Management (SM)<\/a> plugin that handles schedules and retention on-cluster (enabled by the <code>snapshot_management_full_access<\/code> role mapped in Step 3).<\/p>\n<p>Create the automated daily policy:<\/p>\n<pre><code class=\"language-bash\">awscurl -XPOST \"https:\/\/search-my-opensearch-domain-xxxxxx.us-east-1.es.amazonaws.com\/_plugins\/_sm\/policies\/daily-snapshot-policy\" \r\n  --service es \r\n  --region us-east-1 \r\n  -H 'Content-Type: application\/json' \r\n  -d '{\r\n    \"description\": \"Daily automated snapshot policy to S3 with 7-day retention\",\r\n    \"creation\": {\r\n      \"schedule\": {\r\n        \"cron\": {\r\n          \"expression\": \"0 20 * * *\",\r\n          \"timezone\": \"UTC\"\r\n        }\r\n      },\r\n      \"time_limit\": \"1h\"\r\n    },\r\n    \"deletion\": {\r\n      \"schedule\": {\r\n        \"cron\": {\r\n          \"expression\": \"0 21 * * *\",\r\n          \"timezone\": \"UTC\"\r\n        }\r\n      },\r\n      \"condition\": {\r\n        \"max_age\": \"7d\",\r\n        \"max_count\": 7,\r\n        \"min_count\": 1\r\n      },\r\n      \"time_limit\": \"1h\"\r\n    },\r\n    \"snapshot_config\": {\r\n      \"repository\": \"daily-snapshots\",\r\n      \"indices\": \"*\",\r\n      \"date_format\": \"yyyy-MM-dd-HH-mm\",\r\n      \"timezone\": \"UTC\",\r\n      \"include_global_state\": true\r\n    }\r\n  }'<\/code><\/pre>\n<p>Every night at 20:00 UTC, OpenSearch snapshots all indices to S3. At 21:00 UTC, it purges snapshots older than the last 7. The lifecycle runs completely hands-free.<\/p>\n<h2>Step 6: Testing a Safe Restore (The Index Renaming Trick)<\/h2>\n<p>A backup strategy you have never tested is only a guess. Run these commands directly in <strong>OpenSearch Dashboards \u2192 Dev Tools<\/strong> (Console tab) or via <code>awscurl<\/code> from your Bastion.<\/p>\n<p>When restoring, avoid overwriting live data by restoring into isolated test indices using <code>rename_pattern<\/code> and <code>rename_replacement<\/code> with wildcards via the <a href=\"https:\/\/docs.aws.amazon.com\/opensearch-service\/latest\/developerguide\/managedomains-snapshots.html#managedomains-restore-snapshots\" target=\"_blank\" rel=\"noopener noreferrer\">Snapshot Restore API<\/a>.<\/p>\n<h3>1. Run an on-demand snapshot (supports wildcards):<\/h3>\n<pre><code>PUT _snapshot\/daily-snapshots\/manual-test-snapshot\r\n{\r\n  \"indices\": \"application-logs-*,service-logs-*\",\r\n  \"ignore_unavailable\": true,\r\n  \"include_global_state\": false\r\n}<\/code><\/pre>\n<p><em>(Tip: Use <code>*,-.*<\/code> to snapshot all indices while excluding hidden system indices).<\/em><\/p>\n<h3>2. Restore multiple indices with pattern renaming:<\/h3>\n<p>You do not need to list indices individually. Use wildcards to restore all matching indices at once:<\/p>\n<pre><code>POST _snapshot\/daily-snapshots\/manual-test-snapshot\/_restore\r\n{\r\n  \"indices\": \"application-logs-*\",\r\n  \"rename_pattern\": \"(.+)\",\r\n  \"rename_replacement\": \"$1_restored\",\r\n  \"include_global_state\": false\r\n}<\/code><\/pre>\n<p>OpenSearch restores chunks into <code>*_restored<\/code> indices. Verify document counts with <code>GET _cat\/indices\/*restored*?v<\/code>, then delete test indices (<code>DELETE *restored<\/code>) without risking production data.<\/p>\n<h2>Key Takeaways from the Trenches<\/h2>\n<ul>\n<li><strong>Organize S3 Paths Cleanly:<\/strong> Structure paths like <code>opensearch-snapshots\/&lt;env&gt;\/&lt;service&gt;\/<\/code> for clean audits and replication.<\/li>\n<li><strong>Consolidate Small Shards:<\/strong> Snapshots run per shard; thousands of tiny shards cause CPU spikes. Consolidate small indices.<\/li>\n<li><strong>Cross-Account Restores:<\/strong> Since snapshot files reside in standard S3 buckets, migrations simply require granting the target account&#8217;s OpenSearch role read access to your bucket.<\/li>\n<\/ul>\n<h2>Wrapping Up<\/h2>\n<p>AWS automated snapshots provide a short-term rollback window, but customer-managed S3 snapshots give you genuine data ownership.<\/p>\n<p>Once configured, your backups are portable, your retention policies are automated, and your disaster recovery strategy is real.<\/p>\n<p><em>All policy templates, shell scripts, and Dev Tools commands are available on <a href=\"https:\/\/github.com\/RootUserGit\/opensearch-s3-snapshots\" target=\"_blank\" rel=\"noopener noreferrer\">GitHub<\/a>.<\/em><\/p>\n<\/article>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>If you run Amazon OpenSearch Service in production, automated hourly snapshots sound like a good safety net. In reality, they have major operational catches: Backups sit in a hidden, AWS-managed bucket you cannot inspect or download. You cannot export them across accounts or regions for disaster recovery. You cannot retain them past 14 days for [&hellip;]<\/p>\n","protected":false},"author":1811,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"iawp_total_views":4,"footnotes":""},"categories":[2348],"tags":[248,1916,4843,1892,7760],"class_list":["post-83151","post","type-post","status-publish","format-standard","hentry","category-devops-technology","tag-aws","tag-cloud","tag-database","tag-devops","tag-opensearch"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.0.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"If you run Amazon OpenSearch Service in production, automated hourly snapshots sound like a good safety net. In reality, they have major operational catches: Backups sit in a hidden, AWS-managed bucket you cannot inspect or download. You cannot export them across accounts or regions for disaster recovery. You cannot retain them past 14 days for\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Rahul Singh\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/www.tothenew.com\/blog\/why-aws-automated-snapshots-arent-enough-how-to-automate-opensearch-backups-to-your-own-s3-bucket\/\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.0.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"TO THE NEW BLOG\" \/>\n\t\t<meta property=\"og:type\" content=\"blog\" \/>\n\t\t<meta property=\"og:title\" content=\"Why AWS Automated Snapshots Aren\u2019t Enough: How to Automate OpenSearch Backups to Your Own S3 Bucket | TO THE NEW Blog\" \/>\n\t\t<meta property=\"og:description\" content=\"If you run Amazon OpenSearch Service in production, automated hourly snapshots sound like a good safety net. In reality, they have major operational catches: Backups sit in a hidden, AWS-managed bucket you cannot inspect or download. You cannot export them across accounts or regions for disaster recovery. You cannot retain them past 14 days for\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/www.tothenew.com\/blog\/why-aws-automated-snapshots-arent-enough-how-to-automate-opensearch-backups-to-your-own-s3-bucket\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/www.tothenew.com\/blog\/wp-content\/themes\/ttn\/images\/social-logo.png\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/www.tothenew.com\/blog\/wp-content\/themes\/ttn\/images\/social-logo.png\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary\" \/>\n\t\t<meta name=\"twitter:site\" content=\"@tothenew\" \/>\n\t\t<meta name=\"twitter:title\" content=\"Why AWS Automated Snapshots Aren\u2019t Enough: How to Automate OpenSearch Backups to Your Own S3 Bucket | TO THE NEW Blog\" \/>\n\t\t<meta name=\"twitter:description\" content=\"If you run Amazon OpenSearch Service in production, automated hourly snapshots sound like a good safety net. In reality, they have major operational catches: Backups sit in a hidden, AWS-managed bucket you cannot inspect or download. You cannot export them across accounts or regions for disaster recovery. You cannot retain them past 14 days for\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/www.tothenew.com\/blog\/wp-content\/themes\/ttn\/images\/social-logo.png\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/why-aws-automated-snapshots-arent-enough-how-to-automate-opensearch-backups-to-your-own-s3-bucket\\\/#article\",\"name\":\"Why AWS Automated Snapshots Aren\\u2019t Enough: How to Automate OpenSearch Backups to Your Own S3 Bucket | TO THE NEW Blog\",\"headline\":\"Why AWS Automated Snapshots Aren\\u2019t Enough: How to Automate OpenSearch Backups to Your Own S3 Bucket\",\"author\":{\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/author\\\/rahul-singh2\\\/#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/wp-ttn-blog\\\/uploads\\\/2026\\\/09\\\/opensearch_s3_flow-2-1024x572.jpg\",\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/why-aws-automated-snapshots-arent-enough-how-to-automate-opensearch-backups-to-your-own-s3-bucket\\\/#articleImage\"},\"datePublished\":\"2026-10-14T20:24:26+05:30\",\"dateModified\":\"2026-10-27T23:07:22+05:30\",\"inLanguage\":\"en-US\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/why-aws-automated-snapshots-arent-enough-how-to-automate-opensearch-backups-to-your-own-s3-bucket\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/why-aws-automated-snapshots-arent-enough-how-to-automate-opensearch-backups-to-your-own-s3-bucket\\\/#webpage\"},\"articleSection\":\"DevOps, aws, cloud, Database, devops, opensearch\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/why-aws-automated-snapshots-arent-enough-how-to-automate-opensearch-backups-to-your-own-s3-bucket\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.tothenew.com\\\/blog\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/category\\\/devops-technology\\\/#listItem\",\"name\":\"DevOps\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/category\\\/devops-technology\\\/#listItem\",\"position\":2,\"name\":\"DevOps\",\"item\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/category\\\/devops-technology\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/why-aws-automated-snapshots-arent-enough-how-to-automate-opensearch-backups-to-your-own-s3-bucket\\\/#listItem\",\"name\":\"Why AWS Automated Snapshots Aren\\u2019t Enough: How to Automate OpenSearch Backups to Your Own S3 Bucket\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/why-aws-automated-snapshots-arent-enough-how-to-automate-opensearch-backups-to-your-own-s3-bucket\\\/#listItem\",\"position\":3,\"name\":\"Why AWS Automated Snapshots Aren\\u2019t Enough: How to Automate OpenSearch Backups to Your Own S3 Bucket\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/category\\\/devops-technology\\\/#listItem\",\"name\":\"DevOps\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/#organization\",\"name\":\"TO THE NEW Blog\",\"url\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/author\\\/rahul-singh2\\\/#author\",\"url\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/author\\\/rahul-singh2\\\/\",\"name\":\"Rahul Singh\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/why-aws-automated-snapshots-arent-enough-how-to-automate-opensearch-backups-to-your-own-s3-bucket\\\/#authorImage\",\"url\":\"https:\\\/\\\/newersworld-sf-static.tothenew.net\\\/prod\\\/profilePicFolder\\\/58f85d8f-d6aa-46a5-85ab-8e7f2ff39699_Rahul-Singh-Profile-Pitcure.jpeg\",\"width\":96,\"height\":96,\"caption\":\"Rahul Singh\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/why-aws-automated-snapshots-arent-enough-how-to-automate-opensearch-backups-to-your-own-s3-bucket\\\/#webpage\",\"url\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/why-aws-automated-snapshots-arent-enough-how-to-automate-opensearch-backups-to-your-own-s3-bucket\\\/\",\"name\":\"Why AWS Automated Snapshots Aren\\u2019t Enough: How to Automate OpenSearch Backups to Your Own S3 Bucket | TO THE NEW Blog\",\"description\":\"If you run Amazon OpenSearch Service in production, automated hourly snapshots sound like a good safety net. In reality, they have major operational catches: Backups sit in a hidden, AWS-managed bucket you cannot inspect or download. You cannot export them across accounts or regions for disaster recovery. You cannot retain them past 14 days for\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/why-aws-automated-snapshots-arent-enough-how-to-automate-opensearch-backups-to-your-own-s3-bucket\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/author\\\/rahul-singh2\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/author\\\/rahul-singh2\\\/#author\"},\"datePublished\":\"2026-10-14T20:24:26+05:30\",\"dateModified\":\"2026-10-27T23:07:22+05:30\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/\",\"name\":\"TO THE NEW Blog\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"Why AWS Automated Snapshots Aren\u2019t Enough: How to Automate OpenSearch Backups to Your Own S3 Bucket | TO THE NEW Blog","description":"If you run Amazon OpenSearch Service in production, automated hourly snapshots sound like a good safety net. In reality, they have major operational catches: Backups sit in a hidden, AWS-managed bucket you cannot inspect or download. You cannot export them across accounts or regions for disaster recovery. You cannot retain them past 14 days for","canonical_url":"https:\/\/www.tothenew.com\/blog\/why-aws-automated-snapshots-arent-enough-how-to-automate-opensearch-backups-to-your-own-s3-bucket\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.tothenew.com\/blog\/why-aws-automated-snapshots-arent-enough-how-to-automate-opensearch-backups-to-your-own-s3-bucket\/#article","name":"Why AWS Automated Snapshots Aren\u2019t Enough: How to Automate OpenSearch Backups to Your Own S3 Bucket | TO THE NEW Blog","headline":"Why AWS Automated Snapshots Aren\u2019t Enough: How to Automate OpenSearch Backups to Your Own S3 Bucket","author":{"@id":"https:\/\/www.tothenew.com\/blog\/author\/rahul-singh2\/#author"},"publisher":{"@id":"https:\/\/www.tothenew.com\/blog\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/www.tothenew.com\/blog\/wp-ttn-blog\/uploads\/2026\/09\/opensearch_s3_flow-2-1024x572.jpg","@id":"https:\/\/www.tothenew.com\/blog\/why-aws-automated-snapshots-arent-enough-how-to-automate-opensearch-backups-to-your-own-s3-bucket\/#articleImage"},"datePublished":"2026-10-14T20:24:26+05:30","dateModified":"2026-10-27T23:07:22+05:30","inLanguage":"en-US","mainEntityOfPage":{"@id":"https:\/\/www.tothenew.com\/blog\/why-aws-automated-snapshots-arent-enough-how-to-automate-opensearch-backups-to-your-own-s3-bucket\/#webpage"},"isPartOf":{"@id":"https:\/\/www.tothenew.com\/blog\/why-aws-automated-snapshots-arent-enough-how-to-automate-opensearch-backups-to-your-own-s3-bucket\/#webpage"},"articleSection":"DevOps, aws, cloud, Database, devops, opensearch"},{"@type":"BreadcrumbList","@id":"https:\/\/www.tothenew.com\/blog\/why-aws-automated-snapshots-arent-enough-how-to-automate-opensearch-backups-to-your-own-s3-bucket\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/www.tothenew.com\/blog#listItem","position":1,"name":"Home","item":"https:\/\/www.tothenew.com\/blog","nextItem":{"@type":"ListItem","@id":"https:\/\/www.tothenew.com\/blog\/category\/devops-technology\/#listItem","name":"DevOps"}},{"@type":"ListItem","@id":"https:\/\/www.tothenew.com\/blog\/category\/devops-technology\/#listItem","position":2,"name":"DevOps","item":"https:\/\/www.tothenew.com\/blog\/category\/devops-technology\/","nextItem":{"@type":"ListItem","@id":"https:\/\/www.tothenew.com\/blog\/why-aws-automated-snapshots-arent-enough-how-to-automate-opensearch-backups-to-your-own-s3-bucket\/#listItem","name":"Why AWS Automated Snapshots Aren\u2019t Enough: How to Automate OpenSearch Backups to Your Own S3 Bucket"},"previousItem":{"@type":"ListItem","@id":"https:\/\/www.tothenew.com\/blog#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/www.tothenew.com\/blog\/why-aws-automated-snapshots-arent-enough-how-to-automate-opensearch-backups-to-your-own-s3-bucket\/#listItem","position":3,"name":"Why AWS Automated Snapshots Aren\u2019t Enough: How to Automate OpenSearch Backups to Your Own S3 Bucket","previousItem":{"@type":"ListItem","@id":"https:\/\/www.tothenew.com\/blog\/category\/devops-technology\/#listItem","name":"DevOps"}}]},{"@type":"Organization","@id":"https:\/\/www.tothenew.com\/blog\/#organization","name":"TO THE NEW Blog","url":"https:\/\/www.tothenew.com\/blog\/"},{"@type":"Person","@id":"https:\/\/www.tothenew.com\/blog\/author\/rahul-singh2\/#author","url":"https:\/\/www.tothenew.com\/blog\/author\/rahul-singh2\/","name":"Rahul Singh","image":{"@type":"ImageObject","@id":"https:\/\/www.tothenew.com\/blog\/why-aws-automated-snapshots-arent-enough-how-to-automate-opensearch-backups-to-your-own-s3-bucket\/#authorImage","url":"https:\/\/newersworld-sf-static.tothenew.net\/prod\/profilePicFolder\/58f85d8f-d6aa-46a5-85ab-8e7f2ff39699_Rahul-Singh-Profile-Pitcure.jpeg","width":96,"height":96,"caption":"Rahul Singh"}},{"@type":"WebPage","@id":"https:\/\/www.tothenew.com\/blog\/why-aws-automated-snapshots-arent-enough-how-to-automate-opensearch-backups-to-your-own-s3-bucket\/#webpage","url":"https:\/\/www.tothenew.com\/blog\/why-aws-automated-snapshots-arent-enough-how-to-automate-opensearch-backups-to-your-own-s3-bucket\/","name":"Why AWS Automated Snapshots Aren\u2019t Enough: How to Automate OpenSearch Backups to Your Own S3 Bucket | TO THE NEW Blog","description":"If you run Amazon OpenSearch Service in production, automated hourly snapshots sound like a good safety net. In reality, they have major operational catches: Backups sit in a hidden, AWS-managed bucket you cannot inspect or download. You cannot export them across accounts or regions for disaster recovery. You cannot retain them past 14 days for","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/www.tothenew.com\/blog\/#website"},"breadcrumb":{"@id":"https:\/\/www.tothenew.com\/blog\/why-aws-automated-snapshots-arent-enough-how-to-automate-opensearch-backups-to-your-own-s3-bucket\/#breadcrumblist"},"author":{"@id":"https:\/\/www.tothenew.com\/blog\/author\/rahul-singh2\/#author"},"creator":{"@id":"https:\/\/www.tothenew.com\/blog\/author\/rahul-singh2\/#author"},"datePublished":"2026-10-14T20:24:26+05:30","dateModified":"2026-10-27T23:07:22+05:30"},{"@type":"WebSite","@id":"https:\/\/www.tothenew.com\/blog\/#website","url":"https:\/\/www.tothenew.com\/blog\/","name":"TO THE NEW Blog","inLanguage":"en-US","publisher":{"@id":"https:\/\/www.tothenew.com\/blog\/#organization"}}]},"og:locale":"en_US","og:site_name":"TO THE NEW BLOG","og:type":"blog","og:title":"Why AWS Automated Snapshots Aren\u2019t Enough: How to Automate OpenSearch Backups to Your Own S3 Bucket | TO THE NEW Blog","og:description":"If you run Amazon OpenSearch Service in production, automated hourly snapshots sound like a good safety net. In reality, they have major operational catches: Backups sit in a hidden, AWS-managed bucket you cannot inspect or download. You cannot export them across accounts or regions for disaster recovery. You cannot retain them past 14 days for","og:url":"https:\/\/www.tothenew.com\/blog\/why-aws-automated-snapshots-arent-enough-how-to-automate-opensearch-backups-to-your-own-s3-bucket\/","og:image":"https:\/\/www.tothenew.com\/blog\/wp-content\/themes\/ttn\/images\/social-logo.png","og:image:secure_url":"https:\/\/www.tothenew.com\/blog\/wp-content\/themes\/ttn\/images\/social-logo.png","twitter:card":"summary","twitter:site":"@tothenew","twitter:title":"Why AWS Automated Snapshots Aren\u2019t Enough: How to Automate OpenSearch Backups to Your Own S3 Bucket | TO THE NEW Blog","twitter:description":"If you run Amazon OpenSearch Service in production, automated hourly snapshots sound like a good safety net. In reality, they have major operational catches: Backups sit in a hidden, AWS-managed bucket you cannot inspect or download. You cannot export them across accounts or regions for disaster recovery. You cannot retain them past 14 days for","twitter:image":"https:\/\/www.tothenew.com\/blog\/wp-content\/themes\/ttn\/images\/social-logo.png"},"aioseo_meta_data":{"post_id":"83151","title":null,"description":null,"keywords":null,"keyphrases":{"focus":{"keyphrase":"","score":0,"analysis":{"keyphraseInTitle":{"score":0,"maxScore":9,"error":1}}},"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":"","og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"Article","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":"-1","robots_max_videopreview":"-1","robots_max_imagepreview":"large","priority":null,"frequency":"default","local_seo":null,"limit_modified_date":false,"created":"2026-09-10 19:34:09","updated":"2026-10-27 17:37:23","focus_keyword":null,"additional_keywords":null,"truseo_locale":null,"ai":{"faqs":[],"keyPoints":[],"schemas":[],"titles":[],"descriptions":[],"socialPosts":{"email":{"subject":"","preview":"","content":""},"linkedin":[],"twitter":[],"facebook":[],"instagram":[]}},"breadcrumb_settings":null,"seo_analyzer_scan_date":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/www.tothenew.com\/blog\" title=\"Home\">Home<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/www.tothenew.com\/blog\/category\/devops-technology\/\" title=\"DevOps\">DevOps<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\tWhy AWS Automated Snapshots Aren\u2019t Enough: How to Automate OpenSearch Backups to Your Own S3 Bucket\n\t\t<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/www.tothenew.com\/blog"},{"label":"DevOps","link":"https:\/\/www.tothenew.com\/blog\/category\/devops-technology\/"},{"label":"Why AWS Automated Snapshots Aren\u2019t Enough: How to Automate OpenSearch Backups to Your Own S3 Bucket","link":"https:\/\/www.tothenew.com\/blog\/why-aws-automated-snapshots-arent-enough-how-to-automate-opensearch-backups-to-your-own-s3-bucket\/"}],"_links":{"self":[{"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/posts\/83151","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/users\/1811"}],"replies":[{"embeddable":true,"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/comments?post=83151"}],"version-history":[{"count":8,"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/posts\/83151\/revisions"}],"predecessor-version":[{"id":83947,"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/posts\/83151\/revisions\/83947"}],"wp:attachment":[{"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/media?parent=83151"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/categories?post=83151"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/tags?post=83151"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}