diff --git a/pkg/backup/backup_manager.go b/pkg/backup/backup_manager.go
index 6853665e5..199b831d2 100644
--- a/pkg/backup/backup_manager.go
+++ b/pkg/backup/backup_manager.go
@@ -20,6 +20,7 @@ import (
 	"fmt"
 
 	"github.com/coreos/etcd-operator/pkg/backup/writer"
+	"github.com/coreos/etcd-operator/pkg/util/constants"
 
 	"github.com/coreos/etcd/clientv3"
 	"github.com/sirupsen/logrus"
@@ -91,10 +92,11 @@ func getClientWithMaxRev(ctx context.Context, endpoints []string, tc *tls.Config
 	maxRev := int64(0)
 	errors := make([]string, 0)
 	for _, endpoint := range endpoints {
+		// TODO: update clientv3 to 3.2.x and thenuse ctx as in clientv3.Config.
 		cfg := clientv3.Config{
-			Endpoints: []string{endpoint},
-			Context:   ctx,
-			TLS:       tc,
+			Endpoints:   []string{endpoint},
+			DialTimeout: constants.DefaultDialTimeout,
+			TLS:         tc,
 		}
 		etcdcli, err := clientv3.New(cfg)
 		if err != nil {
diff --git a/pkg/controller/backup-operator/abs_backup.go b/pkg/controller/backup-operator/abs_backup.go
index 1d339e20b..d38af1cc8 100644
--- a/pkg/controller/backup-operator/abs_backup.go
+++ b/pkg/controller/backup-operator/abs_backup.go
@@ -15,6 +15,7 @@
 package controller
 
 import (
+	"context"
 	"crypto/tls"
 	"fmt"
 
@@ -27,7 +28,8 @@ import (
 )
 
 // handleABS saves etcd cluster's backup to specificed ABS path.
-func handleABS(kubecli kubernetes.Interface, s *api.ABSBackupSource, endpoints []string, clientTLSSecret, namespace string) (*api.BackupStatus, error) {
+func handleABS(ctx context.Context, kubecli kubernetes.Interface, s *api.ABSBackupSource, endpoints []string, clientTLSSecret, namespace string) (*api.BackupStatus, error) {
+	// TODO: controls NewClientFromSecret with ctx. This depends on upstream kubernetes to support API calls with ctx.
 	cli, err := absfactory.NewClientFromSecret(kubecli, namespace, s.ABSSecret)
 	if err != nil {
 		return nil, err
@@ -39,7 +41,8 @@ func handleABS(kubecli kubernetes.Interface, s *api.ABSBackupSource, endpoints [
 	}
 
 	bm := backup.NewBackupManagerFromWriter(kubecli, writer.NewABSWriter(cli.ABS), tlsConfig, endpoints, namespace)
-	rev, etcdVersion, err := bm.SaveSnap(s.Path)
+
+	rev, etcdVersion, err := bm.SaveSnap(ctx, s.Path)
 	if err != nil {
 		return nil, fmt.Errorf("failed to save snapshot (%v)", err)
 	}
diff --git a/pkg/controller/backup-operator/s3_backup.go b/pkg/controller/backup-operator/s3_backup.go
index 48bfd66a1..caf0c18ce 100644
--- a/pkg/controller/backup-operator/s3_backup.go
+++ b/pkg/controller/backup-operator/s3_backup.go
@@ -15,6 +15,7 @@
 package controller
 
 import (
+	"context"
 	"crypto/tls"
 	"fmt"
 
@@ -28,7 +29,8 @@ import (
 
 // TODO: replace this with generic backend interface for other options (PV, Azure)
 // handleS3 saves etcd cluster's backup to specificed S3 path.
-func handleS3(kubecli kubernetes.Interface, s *api.S3BackupSource, endpoints []string, clientTLSSecret, namespace string) (*api.BackupStatus, error) {
+func handleS3(ctx context.Context, kubecli kubernetes.Interface, s *api.S3BackupSource, endpoints []string, clientTLSSecret, namespace string) (*api.BackupStatus, error) {
+	// TODO: controls NewClientFromSecret with ctx. This depends on upstream kubernetes to support API calls with ctx.
 	cli, err := s3factory.NewClientFromSecret(kubecli, namespace, s.Endpoint, s.AWSSecret)
 	if err != nil {
 		return nil, err
@@ -41,7 +43,8 @@ func handleS3(kubecli kubernetes.Interface, s *api.S3BackupSource, endpoints []s
 	}
 
 	bm := backup.NewBackupManagerFromWriter(kubecli, writer.NewS3Writer(cli.S3), tlsConfig, endpoints, namespace)
-	rev, etcdVersion, err := bm.SaveSnap(s.Path)
+
+	rev, etcdVersion, err := bm.SaveSnap(ctx, s.Path)
 	if err != nil {
 		return nil, fmt.Errorf("failed to save snapshot (%v)", err)
 	}
diff --git a/pkg/controller/backup-operator/sync.go b/pkg/controller/backup-operator/sync.go
index 45d652d19..02a298727 100644
--- a/pkg/controller/backup-operator/sync.go
+++ b/pkg/controller/backup-operator/sync.go
@@ -15,9 +15,12 @@
 package controller
 
 import (
+	"context"
 	"errors"
+	"time"
 
 	api "github.com/coreos/etcd-operator/pkg/apis/etcd/v1beta2"
+	"github.com/coreos/etcd-operator/pkg/util/constants"
 
 	"github.com/sirupsen/logrus"
 )
@@ -119,15 +122,23 @@ func (b *Backup) handleBackup(spec *api.BackupSpec) (*api.BackupStatus, error) {
 		return nil, err
 	}
 
+	// When BackupPolicy.Timeout <= 0, use default DefaultBackupTimeout.
+	backupTimeout := time.Duration(constants.DefaultBackupTimeout)
+	if spec.BackupPolicy != nil && spec.BackupPolicy.TimeoutInSecond > 0 {
+		backupTimeout = time.Duration(spec.BackupPolicy.TimeoutInSecond) * time.Second
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), backupTimeout)
+	defer cancel()
 	switch spec.StorageType {
 	case api.BackupStorageTypeS3:
-		bs, err := handleS3(b.kubecli, spec.S3, spec.EtcdEndpoints, spec.ClientTLSSecret, b.namespace)
+		bs, err := handleS3(ctx, b.kubecli, spec.S3, spec.EtcdEndpoints, spec.ClientTLSSecret, b.namespace)
 		if err != nil {
 			return nil, err
 		}
 		return bs, nil
 	case api.BackupStorageTypeABS:
-		bs, err := handleABS(b.kubecli, spec.ABS, spec.EtcdEndpoints, spec.ClientTLSSecret, b.namespace)
+		bs, err := handleABS(ctx, b.kubecli, spec.ABS, spec.EtcdEndpoints, spec.ClientTLSSecret, b.namespace)
 		if err != nil {
 			return nil, err
 		}
diff --git a/pkg/util/constants/constants.go b/pkg/util/constants/constants.go
index c42f74c28..661875f8a 100644
--- a/pkg/util/constants/constants.go
+++ b/pkg/util/constants/constants.go
@@ -17,9 +17,10 @@ package constants
 import "time"
 
 const (
-	DefaultDialTimeout      = 5 * time.Second
-	DefaultRequestTimeout   = 5 * time.Second
-	DefaultSnapshotTimeout  = 1 * time.Minute
+	DefaultDialTimeout    = 5 * time.Second
+	DefaultRequestTimeout = 5 * time.Second
+	// DefaultBackupTimeout is the maximal allowed time of retriving and saving etcd backup.
+	DefaultBackupTimeout    = 1 * time.Minute
 	DefaultSnapshotInterval = 1800 * time.Second
 
 	DefaultBackupPodHTTPPort = 19999