Amazon RDS keeps automated backups for a maximum of 35 days, and point-in-time recovery (PITR) can't reach past that window either. Aurora works inside the same ceiling, with a 1-to-35-day range and no way to switch automated backups off.
The second rule hurts more at 2 a.m. Every PITR restore creates a new DB instance (or a new Aurora cluster) and leaves the source alone, so recovering one bad table means rebuilding the whole database next to it and copying rows back by hand.
That copy-back script always takes longer than the estimate you gave your manager. Those two limits are why RDS backup solutions exist, and they're the lens I used to rank the eight below.
Here's the TL;DR:
Eon is the best RDS backup solution for Amazon RDS and Aurora teams that need to restore one table or only the rows that went bad, while keeping recovery points well past 35 days in a logically air-gapped vault.
AWS Backup is the native policy layer, with Vault Lock and cross-account copies, and Amazon RDS automated backups stay the free baseline for PITR, manual snapshots, and cross-Region automated backups.
Commvault (Clumio) adds tiered long-term retention, Rubrik suits security-led teams on one console, and N2WS runs snapshot orchestration from your own account. Veeam fits teams already on Veeam Backup & Replication, and Druva offers a SaaS vault outside your AWS Organization.
How I ranked these RDS backup solutions
I scored each option on five questions, all of which come up the first time a restore goes sideways:
- Restore scope: Can it bring back one table or a handful of rows, or does every recovery start with a brand-new instance?
- Retention past 35 days: What happens when audit asks for last year's data?
- Isolation: Would a stolen production credential reach the copies?
- Fit with AWS-native protection: Does it work alongside RDS automated backups and AWS Backup, or does it force a choice?
- Operational load and pricing clarity: How much do you have to run yourself, and can finance forecast the bill?
1. Eon: best for table- and row-level recovery with long retention
I put this one first because it runs alongside RDS automated backups and extends them. The platform handles cloud data protection and recovery through a single read-only role with no agents or appliances, and it covers RDS for MySQL, PostgreSQL, MariaDB, SQL Server, and Oracle, plus Aurora.
It can manage AWS-native PITR for RDS and Aurora, finding restore points once automated backups are on and setting PITR retention centrally across accounts and Regions, while the recovery points stay in your own account.
Past that window, its snapshot policies keep copies as long as your retention rules need, in an immutable, logically air-gapped vault inside a dedicated account. Access is time-bound, so a stolen production key doesn't reach recovery data.
Restores are where it pulls ahead. You can bring back the instance, one database, one table, or only the rows a SQL query matches, which lets you roll back the exact records hit in minutes while later good writes stay put.
It also fingerprints every table, restores the copy to a temporary instance, and compares the fingerprints (a restore test nobody has to remember to schedule). Database Explorer runs SQL against backed-up snapshots without a restore.
Ransomware detection (add-on) reads the logical contents of the database and correlates multiple independent signals (such as row-count drops, schema changes, and ransom notes) into one weighted score. Database detection is still in early access.
NETGEAR, a networking hardware company, cut recovery of a 10 TB SQL Server workload from 24 hours to under three hours (88% faster) after leaving a legacy backup provider, and its backup storage costs fell 35%.
Who it suits: Teams running RDS or Aurora across several accounts who need record-level rollback, retention past 35 days, and copies a compromised production key can't touch.
Pricing (as of October 2026): Usage-based, billed per GB per month on protected storage, with no tier ladder and flexible spending commitments. Ransomware protection is its own package on top, and the company claims up to 50% lower cost through global deduplication.
Weak spot: There's no public list price, and the reference list is shorter than the incumbents can show.
2. AWS Backup: best for centralized native policy across accounts
AWS Backup is the layer many teams already have. It manages policy for many accounts from a single management account in AWS Organizations, and for RDS it creates manual DB snapshots that share the instance's incremental chain.
Continuous backup gives you PITR to within one second of precision, going back up to 35 days, and AWS says RDS restores can reach the most recent 5 minutes of activity. Snapshot rules can run as often as every hour and keep copies for up to 100 years.
Vault Lock is the feature I'd switch on first. In compliance mode, once the grace time (at least 72 hours) ends, no user and not even AWS can change or delete the vault, and Cohasset Associates assessed it against SEC 17a-4, CFTC, and FINRA rules.
Cross-account copies work inside the same AWS Organization, although a copy of a continuous backup lands as a snapshot, so the PITR window stays in the source account. Scheduled restore testing and Backup Audit Manager both cover RDS and Aurora.
Who it suits: Any AWS shop that wants org-wide policy, write-once protection, and audit evidence with no third-party license. It's the base layer I'd keep under every other tool on this list.
Pricing (as of October 2026): You pay for storage, cross-Region transfer, restored data, and backup evaluations, with no minimum fee. RDS snapshots bill at $0.095 per GB-month in us-east-1 and share the free allocation with native backups.
That said, restores of RDS and Aurora snapshots are listed as free, which keeps recovery drills cheap.
Weak spot: Restores still create a new instance, and there's no item-level restore for RDS or Aurora. Amazon RDS instances also can't go into a logically air-gapped vault, while encrypted Aurora clusters can, at $0.0242 per GB-month in us-east-1.
Once AWS Backup takes over continuous backup, you can't change retention or the backup window from the RDS console, and PITR doesn't cover Multi-AZ DB clusters.
3. Commvault (Clumio): best for tiered long-term retention outside your account
Clumio, a Commvault company, puts in-account snapshots and logically air-gapped copies of RDS instances and Aurora clusters under a single policy. Commvault Cloud also protects RDS in its own product, but Clumio is the AWS-native line I'd evaluate for this job.
There are two tiers to understand. SecureVault Standard targets operational recovery under three months, with incremental copies every four hours and restores that start right away, while SecureVault Archive holds logical copies for longer retention.
Archive is also where record-level retrieval lives: you can query the copy and load specific records back into a database after a thaw period of up to 48 hours.
Engine coverage spans Aurora MySQL and Aurora PostgreSQL, MariaDB, MySQL, PostgreSQL, SQL Server, and Oracle SE2 and Enterprise Edition. Db2 isn't on the list.
Who it suits: Regulated teams that need long-term RDS retention outside the production account and can live with a two-day wait for archived records.
Pricing (as of October 2026): Clumio publishes list prices. RDS SecureVault Standard costs $0.14 per GiB-month with $0 restores (data transfer out fees still apply), and Aurora Standard costs $0.030 per GiB-month.
Archive runs $0.01 per GiB-month plus $0.025 per GiB restored, and an early deletion fee applies if you keep data less than 12 months.
Weak spot: The RDS Standard rate sits well above native snapshot storage ($0.095 per GB-month), and Archive can't restore a full database. Logically air-gapped copies have a minimum RPO of four hours, and Clumio uses RDS manual snapshots, so AWS snapshot quotas still apply.
4. Rubrik: best for security-led teams running one console across estates
Rubrik calls itself the Security and AI Operations Company, and its RDS support slots into that one-console model. You apply SLA policies to RDS instances across accounts and Regions, and setup uses a CloudFormation template that creates a cross-account IAM role without long-lived keys.
Its data sheet lists MySQL, SQL Server, Oracle, MariaDB, and PostgreSQL, and Rubrik protects transaction logs for point-in-time recovery, with restores it says land within minutes. Its original RDS protection runs on snapshot APIs, with replication across accounts and Regions, and in 2025 Rubrik added a purpose-built backup engine that started with RDS for PostgreSQL.
You also choose where the work runs. The customer-hosted model puts compute in your AWS account and leaves networking and IAM with you, while Rubrik Managed Cloud Protection runs compute and vault in Rubrik's environment with Object Lock immutability on by default.
Threat hunting is Rubrik's calling card across a broad estate, although file-based scanning reads storage files, and a managed database like RDS or Aurora never exposes its contents as files to scan.
Who it suits: Security-led organizations already running Rubrik on-prem or in other clouds that want RDS under the same policies and console.
Pricing (as of October 2026): Rubrik doesn't publish a price list, so expect a quote through sales.
Weak spot: Managed mode moves data outside your AWS organization by design and offers a narrower slice of configuration options. Its original snapshot-based RDS path is also subject to AWS's manual snapshot quota.
Rubrik announced Aurora protection in 2023, but I couldn't find record-level restore documented for RDS or Aurora, so ask for it in the proof of concept.
5. N2WS (now N2W): best for snapshot orchestration from your own account
N2W, formerly N2WS, runs as a Linux-based virtual appliance that you launch from an AMI in your own AWS account. It drives everything through AWS APIs and covers regular and custom RDS databases plus Aurora clusters, including Aurora Serverless.
Its strength is DR plumbing. Policies copy RDS snapshots cross-Region and cross-account, and schedules can run every 15 minutes (the pricing page advertises a 60-second interval).
For MySQL and PostgreSQL, it can also export snapshots in Parquet to an S3 repository you can protect with S3 Object Lock, and recover the database from there.
Two documented constraints shape the design, so plan for them early. AWS can't share snapshots encrypted with the default KMS key across accounts, and N2W's docs say its cross-account RDS copies land in the DR account in the original Region.
Who it suits: Teams that want DR orchestration they fully control, on pricing that doesn't climb with data volume.
Pricing (as of October 2026): A flat monthly subscription based on protected instances. Standard is $249 per month for 20 instances, 3 accounts, and 3 users, Advanced and Enterprise are quote-based, and every plan comes with a 30-day free trial.
Weak spot: You run and patch the server yourself, and upgrades arrive as a new AMI that wipes OS changes. RDS copies stay native snapshots unless you add the S3 copy, which excludes Aurora, and Aurora storage is licensed in 10 GiB increments.
6. Veeam: best for teams already standardized on Veeam Backup & Replication
Veeam's AWS protection now lives inside Backup & Replication 13 as the Veeam Plug-in for AWS, which adds backup appliances to the infrastructure you already manage. That matters a lot if your VM and hypervisor estate runs on Veeam today.
It works in two modes. The first takes cloud-native snapshots of RDS instances and Aurora clusters and replicates them to any Region in any account, and the second writes image-level backups of SQL Server and PostgreSQL (versions 12 through 17) to Amazon S3.
Image-level jobs spin up a temporary worker instance, pull the data, and remove the worker when the session ends, with no agent software inside your instances. That path also gives you database-level restore for SQL Server and PostgreSQL, which few tools here offer.
Who it suits: Veeam shops with a large VM footprint that also run SQL Server or PostgreSQL on RDS and want one console for both.
Pricing (as of October 2026): The plug-in is licensed per protected instance, and each RDS resource counts as one. The paid edition needs a Veeam Universal License subscription, and the SaaS option, Veeam Data Cloud for AWS, lists no US price.
A free edition covers up to 10 instances on standalone appliances, minus PostgreSQL image-level jobs, which is plenty for a lab.
Weak spot: Image-level backups cover SQL Server and PostgreSQL only, so MySQL, MariaDB, Oracle, and Aurora get snapshots. Workers need VPC DNS resolution, a public subnet with an internet gateway (or private endpoints), and two temporary security groups per job.
Azure and Google Cloud protection also come as separate plug-ins with their own appliances.
7. Druva: best for SaaS-delivered protection outside your AWS Organization
Druva, which brands its platform The Resilience Cloud, grew up in endpoint and SaaS protection and extends into AWS with two layers. CloudRanger handles snapshot orchestration, covering backup and retention, cross-Region and cross-account copies, DR plans, and scheduling.
RDS Airgap is the SaaS piece. It decouples a logically air-gapped copy from your AWS Organization and stores it in Druva's cloud using AWS KMS, and on Enterprise and Elite plans Data Lock blocks alterations and deletions.
Cluster support needs a careful read. Druva's own AWS support matrix (dated October 2025) says RDS Cluster backup and restore is not currently supported, while its RDS Airgap getting-started guide (updated May 2026) says you can protect RDS databases and RDS clusters.
Who it suits: SaaS-first teams, often already on Druva for endpoints or SaaS apps, that want an off-account copy of RDS without running any infrastructure.
Pricing (as of October 2026): Public cloud plans (Business, Enterprise, and Elite, plus a free trial) are priced per TB per month after deduplication, with no published dollar figures. Druva also says cross-Region copies carry no egress fee.
Weak spot: Airgap copies don't support RDS instances encrypted with AWS managed keys, and backups can fail once manual snapshots pass the account quota. Druva also documents no table- or record-level restore for RDS.
Copies held in Druva's cloud sit outside your account by design, which is the appeal, and that vendor boundary is an architecture tradeoff your security team should weigh.
8. Amazon RDS automated backups: best as the free baseline every team keeps on
Every option above works alongside this layer, and you should keep it on. RDS takes a storage volume snapshot of the whole instance, keeps incremental snapshots in S3, and uploads transaction logs every five minutes, which is what powers PITR on every engine.
Retention runs from 0 to 35 days on RDS, where the console default is seven days, and from 1 to 35 days on Aurora, where automated backups can't be disabled and the default is one day. Aurora's latest restorable time is typically within 5 minutes of the current time.
Manual snapshots cover the gap past 35 days because they don't expire, although each Region allows 100 of them by default (an adjustable quota). Since September 2025, you can copy RDS and Aurora snapshots cross-Region and cross-account in a single step.
Cross-Region automated backups replicate snapshots and transaction logs to a second Region for every RDS engine, with a default quota of 20 per account, though Multi-AZ DB clusters aren't supported. Aurora MySQL also has Backtrack, which rewinds a cluster in place within a 72-hour window, as long as Backtrack was turned on when the cluster was created or restored.
Who it suits: Every RDS and Aurora team. It's on by default, so the useful question is whether your retention is still sitting at the one-day API default.
Pricing (as of October 2026): Backup storage is free up to 100% of your total database storage in a Region, then $0.095 per GiB-month in US East (N. Virginia). Aurora backups beyond the free allocation cost $0.021 per GB-month.
Weak spot: There's no native table or row restore, Backtrack can't target a single table, and backups sit in the production account unless you copy them out. None of the RDS backup docs I checked describes a native snapshot lock, so immutability comes from AWS Backup Vault Lock.
How to pick the right one for your estate
Start with the incident that worries you most, then work backward to the tool:
- If a bad deploy or rogue script damages a few tables, shortlist the options that restore tables or rows, because rebuilding a whole instance for 40 broken records is a long night.
- If audit wants years of history, price AWS Backup snapshot rules against the Archive tier from Commvault (Clumio) using your real growth curve, and check how fast each can hand back the records.
- If a compromised admin account keeps you up at night, copy to a separate account and lock the vault in compliance mode, or pick a tool whose copies live outside production by design.
- If you already run Veeam, Rubrik, or Druva elsewhere, one familiar console is worth a lot, so long as the RDS coverage gaps above don't land on your engines.
Whatever you add, leave RDS automated backups on with a retention window you've chosen on purpose.
Where RDS recovery is heading
The RDS incidents I worry about most now start with automation or an AI agent holding valid credentials, and that changes what a bad day looks like. The damage tends to land in a few tables while the rest of the database keeps taking good writes.
My prediction is that within two years, buyers will judge RDS backup solutions by how few good writes a recovery throws away. Instance-level restore will still matter for the full outage, but row-level rollback will be the line item that decides the shortlist.
FAQ
Does AWS Backup support point-in-time recovery for RDS?
Yes. AWS Backup continuous backup restores RDS to within one second of precision, going back up to 35 days, although it doesn't cover Multi-AZ DB clusters and copies sent to other accounts or Regions become snapshots without PITR.
Can RDS backups live in a separate AWS account?
Yes. You can copy RDS and Aurora snapshots to another account (cross-Region in the same step since September 2025), and AWS Backup can copy to vaults in other accounts in the same AWS Organization, though RDS instances can't go into an AWS Backup logically air-gapped vault (Aurora can).
Which RDS backup solutions support Oracle?
Native RDS snapshots and PITR cover Oracle, AWS Backup covers it except RDS Custom for Oracle, and Commvault (Clumio) and Rubrik both document RDS for Oracle. Veeam protects Oracle with snapshots only, and the Commvault (Clumio) Archive tier excludes Oracle Enterprise editions.
How do you keep RDS backups longer than 35 days?
Take manual snapshots, which don't expire and default to a quota of 100 per Region, or use AWS Backup snapshot rules, which keep copies for up to 100 years and don't count toward that quota. PITR itself stays limited to 35 days, so anything older restores from a snapshot or a third-party retention tier.
