AWS Backup extends logically air-gapped vaults to FSx for NetApp ONTAP

AWS announced on September 28, 2026 that AWS Backup’s logically air-gapped vaults now support Amazon FSx for NetApp ONTAP. The vaults support sharing backups across accounts and AWS Organizations, including direct restore from a receiving account without first copying the backup. AWS positions that restore path as a way to reduce recovery time after data loss. AWS announcement

Protection and restore paths

AWS describes logically air-gapped vaults as storing immutable backups that are locked by default, with encryption using AWS owned keys or customer-managed keys. The announcement says FSx for NetApp ONTAP backups can be stored in these vaults within the same account or across accounts and Regions. Backup protection details

Teams can configure the feature through the AWS Backup console, AWS Command Line Interface or AWS SDKs. A backup plan can specify the logically air-gapped vault as its primary target or as a copy destination. AWS Resource Access Manager supports sharing the vault with another account for recovery or restore testing; the receiving account can then initiate a direct restore without an intermediate backup copy. Configuration and restore details

What changes for recovery planning

For recovery planning, the useful distinction is between protecting a backup and being able to restore it from another account. Direct restore removes a copy step from that workflow, but AWS’s announcement does not quantify the recovery-time improvement. AWS’s recovery-time statement

Engineering teams should test the receiving account’s permissions and the intended FSx restore workflow, then measure elapsed recovery time against their own objectives. Treat the shorter restore path as a runbook simplification—not proof that a recovery-time target will be met.

Availability depends on regional overlap

Support is available in all AWS Regions where both logically air-gapped vaults and Amazon FSx for NetApp ONTAP are available, rather than unconditionally across every AWS Region. Teams planning cross-Region recovery should verify that overlap before selecting destinations. Availability statement