Back up Aiven for Apache Kafka to your own storage

Who backs up your data on Aiven​

Aiven for Apache Kafka is fully managed: Aiven runs the brokers, patches them, and keeps them durable and available. That covers infrastructure failure. It does not cover the failures a backup exists for — a bad deploy that poisons a topic, an accidental delete, or a poison record you need to roll back. Those are your data and your responsibility, and a managed service does not offer self-service point-in-time restore of them. A logical copy in a bucket you own closes that gap. See the disaster recovery use cases for the failure modes a backup covers.

Because Aiven speaks the standard Kafka protocol, OSO Kafka Backup needs no Aiven-specific integration. It connects over your service's bootstrap endpoint as an ordinary client and reads your topics the same way it does on any other cluster.

Connecting to Aiven for Apache Kafka​

Aiven offers two authentication methods, and OSO Kafka Backup supports both. Client certificate (mTLS) is the default: download the access key, access certificate, and CA certificate from the Aiven console. SASL/SCRAM is available once you enable it in the service's Advanced configuration; the default user is avnadmin. Every key below comes from the configuration reference.

mode: backup
backup_id: aiven-prod-daily

source:
bootstrap_servers:
  - kafka-abc123-myproject.aivencloud.com:12345
security:
  security_protocol: SSL
  ssl_ca_location: /etc/kafka-backup/aiven/ca.pem
  ssl_certificate_location: /etc/kafka-backup/aiven/service.cert
  ssl_key_location: /etc/kafka-backup/aiven/service.key

storage:
backend: s3
bucket: my-kafka-backups
region: eu-west-1
prefix: aiven/production

backup:
compression: zstd

mode: backup
backup_id: aiven-prod-daily

source:
bootstrap_servers:
  - kafka-abc123-myproject.aivencloud.com:12345
security:
  security_protocol: SASL_SSL
  sasl_mechanism: SCRAM-SHA256
  sasl_username: avnadmin
  sasl_password: ${AIVEN_KAFKA_PASSWORD}
  ssl_ca_location: /etc/kafka-backup/aiven/ca.pem

storage:
backend: s3
bucket: my-kafka-backups
region: eu-west-1
prefix: aiven/production

backup:
compression: zstd

kafka-backup backup --config aiven-backup.yaml

What gets backed up​

Every backup captures topic records with their timestamps and headers, consumer group offsets, and topic configuration, compressed with Zstd or LZ4. Restores can target the original Aiven service or a different cluster — including a self-managed cluster on another distribution — with topic and partition remapping, so backup and restore doubles as a migration path on or off Aiven.

Backing up the Aiven Schema Registry (Karapace) alongside topic data is an OSO Enterprise capability. The open source tool captures topic records, offsets, and configuration.