Backup Vault Excessive Retention on Non-Prod

Signals that mark a non-prod vault over-retained

• Metadata: backup_retention_excessive (JSON bool, AWS Backup discoverer backup.go; true when Vault Lock MaxRetentionDays exceeds the 90-day non-prod ceiling) is the applicability gate, fail-closed. It carries no environment signal by itself (see non-prod gate below).
• Metadata: backup_warm_storage_beyond_floor_gb (float64 GiB, rides #2086; discoverer sums RecoveryPointByBackupVault.BackupSizeInBytes ÷ 2^30 over only the recovery points older than the 90d non-prod floor, omitted on scan error / zero total) supplies the GB term of the saving, exactly the GB that trimming retention to the floor actually deletes; abstains when absent or ≤0. This replaces the earlier backup_warm_storage_gb key, which summed all recovery points (the whole-vault quantity the aggregator prices the whole vault on) and made the “saving” equal the entire vault cost (OptimizedCost ≡ $0 on every firing). The key is absent until #2086 lands, so the rule abstains (fail-closed) until then.
• Metadata: max_retention_days (int): optional, enriches the description only.
• SKU rate: backup-warm-storage (aggregator AWSBackup warm-storage split, per-GB-hour) via TargetSKUCandidates → SetSKURates; abstains when the region’s offer has no warm-storage SKU.
• pricing: per-vault warm-storage monthly cost (calcBackupVault: warm_gb × rate × 24h × 30d = ×720); used only to cap the saving; abstains when absent or ≤0.
• resource.Name / resource.Tags feed the non-prod applicability gate; the discoverer emits no Tags for backup vaults today (no backup:ListTagsForResource call), so in practice only the vault name supplies a positive signal.

The 90-day non-prod retention ceiling

backupVaultNonProdRetentionCeilingDays=90

Pricing only the beyond-floor recovery points

concrete-or-abstain (cost-driven rightsizing): trimming the Vault Lock / backup-plan retention stops recovery points accruing warm-storage GB-month charges beyond the non-prod window. The saving prices only the warm storage that trimming actually deletes: the GB in recovery points beyond the non-prod floor, not the whole vault’s warm storage (pricing the whole-vault GB made SavingsUSD ≡ the entire vault cost, OptimizedCost ≡ $0): savings = backup_warm_storage_beyond_floor_gb × warm-storage-per-GB-hour-rate × 720, capped at the per-vault cost, with OptimizedCost > 0 on a firing. The ×720 (not the textbook 730) is mandatory to stay unit-identical with the aggregator’s own cost basis for this resource: calcBackupVault prices dailyCost = warmGB × rate × 24, and the monthly projection is dailyCost × 30 = warmGB × rate × 720. The rule abstains (returns nil) on any missing input (not excessive / no non-prod signal / no beyond-floor GB volume / no rate / no per-vault cost). It never fabricates a fraction and never emits a $0 advisory rec. The beyond-floor GB key rides #2086, so the rule abstains fleet-wide until that producer lands.

Trimming plan retention, and when Vault Lock blocks it

1. AWS Backup → Backup vaults → inspect the recovery-point retention distribution
2. AWS Backup → Backup plans → identify which plans target this vault
3. Edit each plan rule’s retention: 7-30 days non-prod, trimming toward the 90-day non-prod ceiling
4. If a Vault Lock ceiling enforces the excess, check its lock mode first: in GOVERNANCE mode, or in COMPLIANCE mode during the initial grace period, lower MaxRetentionDays via backup:UpdateBackupVault (in-place, replica-safe, no restart). In COMPLIANCE mode past the grace period the ceiling is immutable by design, so skip this step.