# Restore jobs that actually ran — the schedule they ran on, whether each one completed, how long it took, and what it produced — plus the point-in-time recovery window that makes transaction-level recovery possible

> FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14
> Canonical page: /collect/backup-restore-testing

Recipe id: `backup-restore-testing` · cadence monthly · partial

> **Authored opinion.** AWS overlay v3.0.0, written
> against dataset 2026.07.14.01. The upstream
> FedRAMP rules name none of these tools; this mapping is ours.

## What it proves

- KSI `KSI-RPL-ABO`
- KSI `KSI-RPL-ARP`
- KSI `KSI-RPL-RRO`
- KSI `KSI-RPL-TRC`
- control `cp-10`
- control `cp-10.2`

## Collection

Kind: `cli`

```sh
# list-restore-testing-plans
aws backup list-restore-testing-plans --query 'RestoreTestingPlans[].{Plan:RestoreTestingPlanName,Schedule:ScheduleExpression,LastRun:LastExecutionTime,StartWindowHours:StartWindowHours}'
# list-restore-jobs
aws backup list-restore-jobs --by-created-after 2026-04-01T00:00:00Z --query 'RestoreJobs[].{Id:RestoreJobId,Type:ResourceType,Status:Status,Message:StatusMessage,Created:CreationDate,Completed:CompletionDate,Validation:ValidationStatus,Restored:CreatedResourceArn}'
# list-protected-resources
aws backup list-protected-resources --query 'Results[].{Arn:ResourceArn,Type:ResourceType,LastBackup:LastBackupTime,LastRecoveryPoint:LastRecoveryPointArn}'
# aurora-resources-protected-by-backup-plan
aws configservice get-compliance-details-by-config-rule --config-rule-name aurora-resources-protected-by-backup-plan --compliance-types NON_COMPLIANT
# rds-in-backup-plan
aws configservice get-compliance-details-by-config-rule --config-rule-name rds-in-backup-plan --compliance-types NON_COMPLIANT
# describe-db-instances
aws rds describe-db-instances --query 'DBInstances[].{Db:DBInstanceIdentifier,RetentionDays:BackupRetentionPeriod,LatestRestorable:LatestRestorableTime}'
# dynamodb-pitr-enabled
aws configservice get-compliance-details-by-config-rule --config-rule-name dynamodb-pitr-enabled --compliance-types NON_COMPLIANT
```

## Expected output

A RestoreTestingPlans list whose ScheduleExpression is the cron your recovery policy claims and whose LastExecutionTime proves the schedule is actually firing; a RestoreJobs list in which each job carries a Status of COMPLETED (the other states are PENDING, RUNNING, ABORTED and FAILED, with StatusMessage explaining a failure), a CreationDate and CompletionDate whose difference is the measured restore time, a CreatedResourceArn naming what was rebuilt, and a ValidationStatus of SUCCESSFUL, FAILED, TIMED_OUT or VALIDATING only where you wired validation; a Results list of protected resources each stamped with LastBackupTime; two empty NON_COMPLIANT sets; and a DB instance list whose LatestRestorableTime — the most recent point a PITR restore can target — sits within minutes of now, bounded by BackupRetentionPeriod days of history. Managed rule identifiers: AURORA_RESOURCES_PROTECTED_BY_BACKUP_PLAN, RDS_IN_BACKUP_PLAN, DYNAMODB_PITR_ENABLED

## Assertions

_No machine-checkable assertion is authored for this recipe._

## GovCloud

AWS Backup, AWS Config, RDS and DynamoDB are available in AWS GovCloud (US-East) and (US-West); resource, plan and recovery-point ARNs use partition arn:aws-us-gov. Restore testing is NOT available in AWS GovCloud (US) — drop the first command there, run your restore exercises on demand with backup start-restore-job, and evidence them from the same list-restore-jobs output (the jobs simply will not carry a restore testing plan ARN). Backup Audit Manager multi-account, multi-Region reporting is also unavailable, and cross-Region copy works only between the two GovCloud Regions, never in or out of them.

## Notes

A completed restore job is the strongest recovery evidence AWS emits, and it is still not the whole of CP-10. It proves a recovery point could be materialised into a resource and how long that took; it does not prove the restored system is functionally correct, that the data inside it is intact, or that the reconstitution ran to a known operational state. ValidationStatus does not close that gap either — restore testing validation is an EventBridge-triggered workflow you write, and PutRestoreValidationResult records whatever your own Lambda asserted, so treat it as your test result, not AWS's verdict (and note it cannot be set from the console, and once set it cannot be changed). RTO and RPO conformance is arithmetic you perform, not a field: compare CompletionDate minus CreationDate against your RTO, and the gap between LastBackupTime (or LatestRestorableTime) and the incident against your RPO. Restore testing also deletes the restored resource when the retention window closes, tagging it awsbackup-restore-test, so there is no lasting artifact beyond the job record — capture the output at collection time. Scope caveats: restore testing supports a fixed resource-type list (Aurora, DocumentDB, DynamoDB, EBS, EC2, EFS, FSx, Neptune, RDS, S3), rds-in-backup-plan evaluates AWS::RDS::DBInstance and AWS's own documentation notes it applies only to Aurora DB instances with clusters unsupported (aurora-resources-protected-by-backup-plan is the DB-cluster rule), and aurora-resources-protected-by-backup-plan is unavailable in a handful of Regions, none of them GovCloud. Backup existence is the CP-09 recipe's job; this recipe deliberately starts where that one stops.

## References

- {"title":"AWS Backup: Restore testing (plans, jobs, validation window, resource types)","url":"https://docs.aws.amazon.com/aws-backup/latest/devguide/restore-testing.html"}
- {"title":"AWS Backup: Restore testing validation (PutRestoreValidationResult)","url":"https://docs.aws.amazon.com/aws-backup/latest/devguide/restore-testing-validation.html"}
- {"title":"AWS CLI: backup list-restore-testing-plans","url":"https://docs.aws.amazon.com/cli/latest/reference/backup/list-restore-testing-plans.html"}
- {"title":"AWS CLI: backup list-restore-jobs (status and validation fields)","url":"https://docs.aws.amazon.com/cli/latest/reference/backup/list-restore-jobs.html"}
- {"title":"AWS CLI: backup list-protected-resources","url":"https://docs.aws.amazon.com/cli/latest/reference/backup/list-protected-resources.html"}
- {"title":"AWS Config managed rule: aurora-resources-protected-by-backup-plan","url":"https://docs.aws.amazon.com/config/latest/developerguide/aurora-resources-protected-by-backup-plan.html"}
- {"title":"AWS Config managed rule: rds-in-backup-plan","url":"https://docs.aws.amazon.com/config/latest/developerguide/rds-in-backup-plan.html"}
- {"title":"AWS Config managed rule: dynamodb-pitr-enabled","url":"https://docs.aws.amazon.com/config/latest/developerguide/dynamodb-pitr-enabled.html"}
- {"title":"AWS CLI: rds describe-db-instances (LatestRestorableTime, BackupRetentionPeriod)","url":"https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-instances.html"}
- {"title":"AWS Backup in AWS GovCloud (US) — restore testing not available","url":"https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-bkp.html"}