Backup Security

Backup Security ensures that your AWS backups are protected, immutable, and recoverable, even if your primary account is compromised by ransomware or insider threats.

AWS Backup Features

• Backup Vault Lock: WORM (write-once-read-many) protection; once locked in compliance mode and past the grace period, recovery points cannot be deleted early, even by root
• Cross-Account Backup: copy backups to a separate, restricted AWS account
• Cross-Region Backup: replicate backups to another AWS region for disaster recovery
• Encryption: all backups encrypted with KMS keys
• Access Policies: IAM policies and backup vault access policies control who can manage backups

Best Practices

• 3-2-1 Rule: 3 copies, 2 different storage types, 1 off-site (cross-account or cross-region)
• Enable Backup Vault Lock in compliance mode for immutable backups
• Use a dedicated backup account with restricted access
• Regularly test restores: untested backups are not backups
• Monitor with Config Rules to ensure all critical resources are backed up

How It Goes Wrong in Practice

Modern ransomware playbooks target backups before they target data. An attacker who obtains administrator credentials in your account does not start by encrypting your databases; they start by deleting your recovery points, so that when the encryption happens you have nothing to restore from. This is why "we have AWS Backup enabled" is not a ransomware answer on its own: if the same credentials that run production can also delete recovery points, your backups share the blast radius of the account. The subtler version of this failure involves vault lock mode selection. A vault locked in governance mode can have its lock removed by any principal with sufficient IAM permissions, which is exactly what a fully compromised admin identity has, so governance mode protects against mistakes and junior operators, not against a determined attacker holding your keys. Compliance mode closes that hole: once its cooling-off grace period (minimum 3 days) expires, the lock and the vault configuration become immutable and cannot be altered by any user or by AWS. But compliance mode has its own well-documented trap in the opposite direction: if a recovery point with an indefinite retention setting lands in a compliance-locked vault, it can never be deleted, and you will pay for that storage forever. Check your retention lifecycles before the grace period ends, not after.

Practical Check: Verify Vault Lock Status

Confirm whether a vault is actually locked, and how:

aws backup describe-backup-vault --backup-vault-name prod-vault

In the output, Locked set to true means Vault Lock is enforcing deletion protection, MinRetentionDays and MaxRetentionDays show the enforced retention window, and LockDate tells you when the compliance-mode grace period ends and the configuration becomes immutable. To create a compliance-mode lock, include the grace period parameter:

aws backup put-backup-vault-lock-configuration --backup-vault-name prod-vault --changeable-for-days 3 --min-retention-days 7 --max-retention-days 365

Omitting --changeable-for-days creates the lock in governance mode instead; including it (minimum value 3) selects compliance mode and starts the countdown to immutability.

Frequently Asked Questions

What is the difference between governance mode and compliance mode?
Governance mode locks the vault against everyone except principals with the IAM permissions to manage or remove the lock. Compliance mode is irreversible: after the grace period (at least 3 days, up to 36,500), neither you, nor your root user, nor AWS can change or remove the lock while recovery points remain in the vault. Use governance mode for operational guardrails and compliance mode when you need true immutability against a compromised administrator.

Can AWS delete my locked backups?
Not through the API, with one lifecycle exception: if you close the AWS account, AWS suspends it for 90 days with backups intact, and after that the vault contents are deleted even if Vault Lock was in place. Account closure protection is another argument for keeping backup copies in a separate, dedicated account under different administrative control.

Does Vault Lock cost extra?
The Vault Lock feature itself is free; you pay standard AWS Backup storage for what is in the vault. The financial risk is retention, not the lock: immutable backups with long retention accumulate storage costs you cannot cancel early, so size MinRetentionDays and MaxRetentionDays against your actual compliance obligations.

Is a locked vault in my production account enough?
It is a strong control against deletion, but a single account is still a single failure domain for access, billing, and human error. Combine Vault Lock with cross-account copies to a backup account and periodic restore testing; the 3-2-1 rule still applies in the cloud.