Design Secure Architectures · Topic 6 of 6
Data Protection, Backup and Retention
Protect stored data on AWS with S3 access controls, versioning, Object Lock, AWS Backup and lifecycle rules, and match each control to a requirement.
- 5 min
- Block Public Access is the main guard against accidentally exposed S3 data.
- Versioning recovers from overwrites and deletes, and a lifecycle rule should clean up old versions.
- MFA Delete adds a second factor to permanent deletion of versions.
What it is
Data security is more than encryption. You also control who can read the data, protect it from accidental or malicious change, keep copies for recovery, and decide how long it must be retained or deleted.
The exam asks you to turn a requirement such as "no one may delete these records for seven years" into the right AWS feature. Most of these scenarios involve Amazon S3, so this page focuses on it, then covers backup and database protection.
How it works
Controlling access to S3
Several layers work together.
- Block Public Access is a setting at the account or bucket level that overrides policies and ACLs which would make data public. It is turned on by default for new buckets.
- Bucket policies are resource policies that can allow or deny by principal, IP address, VPC endpoint, organization or encryption setting.
- Object Ownership with ACLs disabled makes the bucket owner own every object and moves control to policies. This is the recommended setting today.
- S3 Access Points give each application its own name and policy, which is easier than one huge bucket policy.
- Presigned URLs give a person temporary access to one object without an AWS identity.
For serving private content to customers, CloudFront with origin access control is better than making the bucket public.
Protecting against change and deletion
| Feature | What it does | Typical requirement |
|---|---|---|
| Versioning | Keeps every version of an object, and a delete adds a delete marker | Recover from overwrite or accidental delete |
| MFA Delete | Requires MFA to delete versions or change versioning | Extra protection against deletion by a stolen credential |
| S3 Object Lock | Write once, read many (WORM): objects cannot be changed or deleted for a set time | Regulatory retention |
| S3 Glacier Vault Lock | Locks a vault policy so that it can no longer be changed | Compliance rules for archives |
| Cross Region Replication | Copies new objects to a bucket in another Region | Separate copy for resilience or compliance |
Object Lock has two modes. In governance mode, users with special permission can remove the lock. In compliance mode, nobody, including the root user, can delete the object or shorten the period until it expires.
A legal hold keeps an object locked with no expiry date until you remove it. Replication and Object Lock both need versioning turned on.
Backup
AWS Backup is a central service for scheduling and managing backups across services such as EBS, RDS, DynamoDB, EFS, FSx and S3. A backup plan defines the schedule, retention and copy rules. Backups can be copied to another Region or account, and Backup Vault Lock makes them immutable.
Service level features also exist. RDS has automated backups and point in time recovery, and DynamoDB has point in time recovery and on demand backups.
EBS snapshots are incremental.
Retention and deletion
S3 lifecycle rules can move objects to cheaper classes and expire them after a number of days. They can also delete old noncurrent versions, which controls the cost of versioning.
DynamoDB can expire items automatically with Time to Live (TTL). CloudWatch Logs has a retention setting for each log group.
Integrity and audit
CloudTrail log file integrity validation lets you detect whether log files were changed after delivery. S3 checks data integrity with checksums. For data access auditing in S3, turn on CloudTrail data events, because object level API calls are not logged by default.
The words "cannot be deleted by anyone, even the root user, for a fixed period" mean Object Lock in compliance mode. The words "can be removed by authorized administrators" mean governance mode.
What to remember for the exam
- Block Public Access is the main guard against accidentally exposed S3 data.
- Versioning recovers from overwrites and deletes, and a lifecycle rule should clean up old versions.
- MFA Delete adds a second factor to permanent deletion of versions.
- Object Lock gives WORM protection, with governance and compliance modes, and it needs versioning.
- Glacier Vault Lock enforces a locked policy on a vault for compliance.
- AWS Backup centralizes backup plans and can copy backups across Regions and accounts.
- RDS and DynamoDB offer point in time recovery for protection against bad writes.
- Macie finds sensitive data in S3, and CloudTrail data events record object level access.
Common mistakes
Using versioning for compliance. Versioning can be suspended and versions can be deleted by those allowed to. Compliance retention needs Object Lock.
Confusing replication with backup. Replication copies a bad write or delete marker as well as good data, so it does not replace point in time recovery or immutable backups.
Skipping lifecycle rules after enabling versioning. Old versions pile up and increase storage cost.
Treating a presigned URL as private forever. Anyone who holds the URL can use it until it expires, so keep the expiry short.
Compliance mode cannot be undone during the retention period. Test with governance mode first, because a wrong retention date cannot be corrected later.
Check yourself
Which S3 feature prevents objects from being deleted or overwritten for a fixed period, even by the root user?
S3 Object Lock in compliance mode.
Why is replication not a replacement for backup?
Replication copies changes, including bad writes and deletions, so it does not give point in time recovery.
Which service gives one place to schedule backups across EBS, RDS, DynamoDB and EFS?
AWS Backup.
Topic 6 of 6 in Design Secure Architectures
Test yourself on Design Secure Architectures
The full AWS SAA-C03 question bank has 823 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.