Cloud Backup Showdown: AWS Backup vs. Azure Backup vs. Veeam

Most teams don't need a fancy cloud backup product. They need to stop treating snapshots as backups. We see it constantly: a VMware admin proudly shows off a 72-hour-old snapshot as their recovery plan. Broadcom's own documentation flatly states that VMware snapshots are not backups—they're change logs, and if the base disk is gone, the snapshot alone won't save you. That's the contrarian claim we'll defend: for the majority of cloud workloads, the winning strategy isn't picking the most feature-rich tool; it's picking the tool that forces you to separate your backup copies from your primary data and then verifying those copies actually restore. Among the big three—AWS Backup, Azure Backup, and Veeam—AWS Backup wins for AWS-native shops that want policy-driven simplicity, but Veeam takes it for hybrid and multi-cloud environments where flexibility and mature recovery options matter more than native integration.

How we compare: RPO, RTO, immutability, and cost

We judge cloud backup tools on four criteria that actually decide recoveries: how much data you can afford to lose (RPO), how fast you must be back online (RTO), whether your backups are immutable or air-gapped, and the operational cost of keeping it all running. NIST SP 800-34 defines RPO as the point in time to which data must be recovered after an outage, and RTO as the maximum time a system can be unavailable before unacceptable impact. Those two numbers drive everything else.

For mission-critical systems, NIST suggests RTO under 1 hour and RPO under 5 minutes. That's the bar. If your tool can't hit that for your tier-1 apps, it's not the right tool for them.

Immutability is the other non-negotiable. NIST SP 800-209 defines immutability as the ability to lock data after creation, preventing alteration or deletion. CISA's modernized 3-2-1-1-0 rule adds exactly that: one immutable or air-gapped copy, and zero unverified backups. If your cloud backup can't produce an immutable copy, you're one compromised credential away from losing everything.

AWS Backup: the native choice for AWS shops

AWS Backup is a fully managed, policy-based service. For S3, you activate versioning, define a backup policy, and AWS Backup automates the creation of backups into an encrypted vault. It supports continuous backups for point-in-time restore (up to 35 days) and periodic snapshots for long-term retention (up to 99 years). The first backup of a bucket is full; subsequent ones are incremental at the object level. That's a solid RPO for many workloads—continuous backup can get you to near-zero data loss for S3.

But there's a catch: without a lifecycle expiration rule on versioning-enabled buckets, S3 storage costs can balloon because AWS Backup retains all versions. We've seen bills double in a month when someone forgot that rule. Also, for buckets with more than 300 million objects, the initial full backup can run at up to 17,000 objects per second, but smaller buckets crawl at around 1,000 objects per second. If you have a billion small objects, your first backup will take days.

Who it's for: Teams fully committed to AWS that want backup as a native, policy-driven extension of their infrastructure. It's not for hybrid environments or shops that need granular application-level recovery outside the AWS ecosystem.

Azure Backup: strong for Microsoft-centric workloads

Azure Backup integrates deeply with Azure VMs, SQL Server, and SAP HANA. It offers similar policy-based management and supports immutable vaults. The RPO/RTO story is comparable to AWS Backup for native workloads. But like AWS, it's sticky: once you're in, moving out means re-architecting. For pure Azure shops, it's a no-brainer. For anyone with on-prem or multi-cloud, it becomes another silo.

Who it's for: Organizations standardized on Azure that want backup managed through the same console, RBAC, and billing. Not ideal if you have significant non-Azure infrastructure.

Veeam: the flexible heavyweight for hybrid and multi-cloud

Veeam doesn't care where your data lives. It backs up AWS, Azure, VMware, Hyper-V, and physical workloads from a single platform. Its immutability story is mature: you can create hardened repositories that are truly air-gapped, and it supports the 3-2-1-1-0 rule natively. For RTO, Veeam offers instant recovery for VMs and granular file-level restores. The trade-off is complexity and cost—you need to manage the infrastructure, and licensing can be steep. But for hybrid environments, it's often the only tool that covers everything without three separate backup systems.

Who it's for: Enterprises with mixed infrastructure that need one tool to back up everything, and who value the ability to restore anywhere—on-prem, in AWS, or in Azure.

Head-to-head comparison

Here's the thing about snapshots: they're not backups. We've seen teams rely on AWS RDS automated backups—which are snapshots—and then get hit by ransomware that also encrypted the snapshots because they were in the same account. NIST SP 800-209 warns that attackers target backups and copies, and may poison them gradually. That's why any cloud backup strategy must include an immutable copy, ideally in a separate account or subscription with different credentials.

Testing is where most teams fail. CISA advises maintaining offline, encrypted backups and regularly testing them. NIST SP 800-209 recommends testing backups at least monthly for critical data, and performing an end-to-end test restore to a sandbox. We've seen organizations with perfect backup schedules discover during a real incident that their restore process took 30 hours because they never tested it.

• For AWS-only shops: AWS Backup wins. It's native, policy-driven, and integrates with S3 versioning and lifecycle rules. Just set those lifecycle rules to avoid cost surprises.
• For Azure-only shops: Azure Backup wins for the same reasons.
• For hybrid or multi-cloud: Veeam wins. It's the only one that covers everything without multiple tools, and its instant recovery can meet RTOs under 1 hour for VMs.

One more consideration: tape. LTO-9 offers up to 45 TB compressed per cartridge, with an inherent air gap that disk can't match. For long-term retention and true offline copies, tape still has a place, especially for compliance. But for day-to-day cloud backup, the three tools above are your realistic options.

The takeaway

Pick the tool that matches your infrastructure, not the one with the longest feature list. If you're all-in on AWS, AWS Backup gives you the least friction—just manage those versioning costs. If you're all-in on Azure, Azure Backup is the obvious choice. But if you have any mix of on-prem, AWS, and Azure, Veeam is worth the extra complexity because it eliminates the silos and gives you a single immutability and recovery strategy. Whichever you choose, do three things: create an immutable copy, test restores monthly, and never trust a snapshot as a backup. That's the difference between a minor incident and a career-ending outage.

Sources

• CISA (data backup guidance) - https://www.cisa.gov/stopransomware
• NIST SP 800-34 Rev. 1 (Contingency Planning Guide) - https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-34r1.pdf
• NIST SP 800-209 (Storage Infrastructure Security) - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-209.pdf
• Broadcom KB (VMware snapshot best practices 318825) - https://knowledge.broadcom.com/external/article/318825/best-practices-for-using-vmware-snapshot.html
• AWS S3 backup (User Guide) - https://docs.aws.amazon.com/AmazonS3/latest/userguide/backup-for-s3.html
• LTO Program (NewsBytes September 2022) - https://www.lto.org/newsbytes-september-2022/