The 3-2-1-1-0 backup rule. We had everything except the zero
Backup looks simple until the day you need it.
This article is about the 3-2-1-1-0 rule: how many copies to keep, how to spread those copies, and why storing them is not enough. The last number is not another storage location. It stands for something more important: zero errors on restore.
The scene below is the starting point for that count, and for the reasoning behind each number.
A backup job can be green. That only says the process finished without an error. It does not say the data is complete, consistent, or restorable. Anyone who treats a green check as recovery finds out the opposite on the day they need the restore.
The 3-2-1-1-0 rule exists for that distinction. The first four numbers draw the topology of the copy. The zero requires that topology to have been exercised.
- 3 copies beyond the original
- 2 crossing a logical boundary (another account or another region)
- 1 in an immutable vault
- 1 local, for operational restore
- 0 errors after testing the backup and verifying that it recovers
What the first four numbers actually buy
Three copies beyond the original are not vanity. A snapshot in the same account, the same region, and the same IAM is one copy with different names. A retention mistake, an overly broad policy, or a compromised identity reaches all three at once. The second and third copies only exist if they fail for different reasons.
Two logical boundaries exist for that. Another AWS account does not share the same set of roles. Another region does not share the same blast radius of an AZ or a regional control. If production and backup authenticate to the same IdP, with the same admin, the design is lying: the boundary is cosmetic.
The immutable vault closes the hole that isolation alone does not close. Isolation blocks the easy path. Immutability blocks the delete, even when the path appears. Anyone who has read a ransomware incident knows the pattern: production goes down, and then the backup repository disappears. Without Vault Lock (or an equivalent) in a mode the operator cannot turn off in a panic, the copy is a target, not a plan.
The local copy is the other extreme. An isolated, immutable vault protects you on the worst day. It is not necessarily the fastest path on an ordinary Tuesday: a corrupted volume, a dropped table, an overwritten object. Operational restore needs a copy you can open without staging a cross-account exercise. Without it, the team either breaches the vault on every small incident, or lets the small incident become a large one.
That is failure engineering, not a poster. It is still incomplete.
The green job lies by omission
A successful backup job answers a narrow question: the writer persisted what was requested, to the configured destination, inside the window. It does not answer whether the incremental chain is intact. It does not answer whether the database was captured in a usable state (with a flush, a consistent snapshot, a native backup), or only as a disk in the middle of a write. It does not answer whether the KMS key for restore still exists, whether the identity doing the restore can read the vault, whether the destination engine accepts that version, or whether the time to return fits what the business calls acceptable.
Integrity means the backup is complete and coherent. Availability means you can reach it and apply it. Neither one is the job's exit code.
That is why the zero is not a quantity. It is not "one more vault". It is the acceptance criterion: restore on purpose, watch the data come back, measure how long it took, and only then call the design 3-2-1-1-0. Test the job. Test recoverability. Both. One without the other leaves a green check on a box that will not open.
The question the dashboard does not ask
"Do we have backups?" is the wrong question. Almost everyone does.
The right question is narrower and more honest: when was the last restore done on purpose, by someone who was not in a panic, against a real destination, and the result was a usable system?
If the answer is the dashboard, you have a copy. You might have the 3, the 2, and both 1s.
You are missing the zero.
