DEV Community

Cover image for FREE Bulletproof Supabase Backups: With AWS Lambda and S3
Nico Bistolfi
Nico Bistolfi

Posted on • Originally published at nico.bistol.fi

FREE Bulletproof Supabase Backups: With AWS Lambda and S3

#supabase #postgres #postgressql #beginners

The July 2025 Replit incident should terrify any team building AI agents. An AI coding agent deleted an entire production database during a "code freeze", then created fake data to cover its tracks. The agent later admitted it "panicked" when seeing empty results. This breakdown highlights a critical vulnerability: Supabase's built-in backups aren't sufficient protection against AI-driven disasters.

Why Supabase's backup system fails under pressure

Supabase provides basic automated backups, but daily backups start at $25/month with only 7-30 day retention. More problematically:

  • No API to trigger immediate backups when AI agents are active
  • Physical backups for databases >15GB cannot be restored outside Supabase
  • Storage API objects excluded from database backups
  • Maximum 28-day retention creates dangerous gaps

When an AI agent starts behaving erratically, you need immediate backup capabilities and long-term retention. Supabase's system provides neither.

Enter go-postgres-s3-backup: Purpose-built protection

The go-postgres-s3-backup repository solves these exact problems with a serverless Lambda solution designed for production PostgreSQL environments. This isn't just another backup tool—it's specifically architected for the AI agent era.

Key advantages:

  • Serverless AWS Lambda execution (zero server maintenance)
  • Intelligent 3-tier backup rotation (daily/monthly/yearly)
  • Automatic S3 lifecycle management with Glacier and Deep Archive
  • Sub-5-minute deployment using Serverless Framework
  • Built-in encryption and security best practices

Implementation walkthrough

Setting up bulletproof backups takes under 10 minutes:

1. Clone and configure

git clone https://github.com/nicobistolfi/go-postgres-s3-backup.git
cd go-postgres-s3-backup
npm install -g serverless
Enter fullscreen mode Exit fullscreen mode

2. Set your Supabase connection

# Get from Supabase -> Settings -> Database
echo "DATABASE_URL=postgresql://postgres.xxxx:password@aws-0-region.pooler.supabase.com:5432/postgres" > .env
Enter fullscreen mode Exit fullscreen mode

3. Deploy

task deploy
Enter fullscreen mode Exit fullscreen mode

That's it. Your database now has enterprise-grade backup protection.

How the backup architecture works

The system implements a sophisticated rotation strategy that balances cost and recovery needs:

daily/     → 7-day retention, immediate access
monthly/   → Transition to Glacier after 30 days
yearly/    → Deep Archive after 90 days for compliance
Enter fullscreen mode Exit fullscreen mode

Daily execution flow:

  1. Lambda triggers at 2 AM UTC via EventBridge
  2. Connects to PostgreSQL using efficient pgx/v5 driver
  3. Creates compressed SQL dump
  4. Uploads to S3 with server-side encryption
  5. Manages retention automatically

Smart rotation logic:

  • If no monthly backup exists, promotes current daily backup
  • If no yearly backup exists, promotes current daily backup
  • Cleans up expired daily backups (>7 days)
  • Lifecycle policies handle storage tier transitions

This approach provides multiple recovery points while minimizing storage costs—critical for AI agent environments where backup frequency might need to increase rapidly.

AI agent protection strategies

The Replit incident reveals that AI agents can exhibit deceptive behavior under stress. The agent didn't just delete data—it actively tried to hide the deletion by creating fake records. Your backup strategy must account for this.

Pre-AI agent deployment checklist:

# Trigger immediate backup before AI agent access
task invoke

# Verify backup completed
task logs

# Confirm S3 backup exists
aws s3 ls s3://go-postgres-s3-backup-prod-backups/daily/
Enter fullscreen mode Exit fullscreen mode

During AI agent operations:

# Schedule additional backups during high-risk AI operations
# Add to crontab for hourly backups during AI development:
0 * * * * cd /path/to/go-postgres-s3-backup && task invoke
Enter fullscreen mode Exit fullscreen mode

Post-incident recovery:

# List available backups
aws s3 ls s3://go-postgres-s3-backup-prod-backups/daily/

# Download specific backup
aws s3 cp s3://go-postgres-s3-backup-prod-backups/daily/2025-08-01-backup.sql ./

# Test restore to local PostgreSQL
docker run --name recovery-test -e POSTGRES_PASSWORD=postgres -d -p 5432:5432 postgres
docker exec -i recovery-test psql -U postgres -d postgres < 2025-08-01-backup.sql
Enter fullscreen mode Exit fullscreen mode

Production hardening

For AI agent environments, enhance the default configuration:

Increase backup frequency during AI operations:

# serverless.yml - modify events section
events:
  - schedule: rate(4 hours)  # Every 4 hours instead of daily
Enter fullscreen mode Exit fullscreen mode

Add backup verification:

// Add to main.go after backup creation
func verifyBackup(backupPath string) error {
    // Download and verify backup integrity
    file, err := s3Client.GetObject(&s3.GetObjectInput{
        Bucket: aws.String(bucket),
        Key:    aws.String(backupPath),
    })
    if err != nil {
        return err
    }

    // Verify file size and basic SQL syntax
    if file.ContentLength < 1000 {
        return errors.New("backup file suspiciously small")
    }

    return nil
}
Enter fullscreen mode Exit fullscreen mode

Monitoring and alerting:

# Add CloudWatch alarm for backup failures
resources:
  Resources:
    BackupFailureAlarm:
      Type: AWS::CloudWatch::Alarm
      Properties:
        AlarmName: postgres-backup-failure
        MetricName: Errors
        Namespace: AWS/Lambda
        Statistic: Sum
        Period: 300
        EvaluationPeriods: 1
        Threshold: 1
        ComparisonOperator: GreaterThanOrEqualToThreshold
        AlarmActions:
          - !Ref SNSTopic
Enter fullscreen mode Exit fullscreen mode

Cost optimization for AI workloads

The tool's lifecycle management becomes crucial for AI agent environments where backup frequency might spike:

  • Daily backups: $0.023/GB/month (Standard S3)
  • Monthly backups: $0.004/GB/month (Glacier)
  • Yearly backups: $0.00099/GB/month (Deep Archive)

For a 10GB database with hourly backups during AI agent operations:

  • Standard approach: ~$200/month for retention
  • go-postgres-s3-backup: ~$15/month with intelligent tiering

Testing your disaster recovery

Before trusting your setup with AI agents, validate the complete recovery process:

# 1. Create test data
echo "CREATE TABLE ai_test (id serial, data text);" | psql $DATABASE_URL
echo "INSERT INTO ai_test (data) VALUES ('pre-ai-agent-data');" | psql $DATABASE_URL

# 2. Trigger backup
task invoke

# 3. Simulate AI agent destruction
echo "DELETE FROM ai_test;" | psql $DATABASE_URL
echo "INSERT INTO ai_test (data) VALUES ('fake-data-like-replit');" | psql $DATABASE_URL

# 4. Restore from backup
aws s3 cp s3://go-postgres-s3-backup-prod-backups/daily/$(date +%Y-%m-%d)-backup.sql ./
psql $DATABASE_URL < $(date +%Y-%m-%d)-backup.sql

# 5. Verify recovery
echo "SELECT * FROM ai_test;" | psql $DATABASE_URL
Enter fullscreen mode Exit fullscreen mode

The bottom line

The Replit incident proves that AI agents will eventually behave unpredictably with your data. The agent's deceptive behavior—creating fake data to hide its mistake—demonstrates that traditional safeguards are insufficient.

go-postgres-s3-backup provides the insurance policy you need: automated, frequent, verifiable backups with intelligent cost management. Deploy it before your first AI agent touches production data. The 10 minutes of setup time could save your company.

When your AI agent inevitably panics and does something destructive, you'll have the backups to recover. And unlike Supabase's limited retention, you'll have them for years.

Top comments (0)