Resilience, Migration, and Business Continuity · Topic 5 of 6
Backup Governance and Ransomware Protection
Run AWS Backup across accounts with backup policies and cross account copies, and stop ransomware with Vault Lock, S3 Object Lock and EBS snapshot lock.
- 5 min
- Backup policies in AWS Organizations push consistent backup plans to member accounts.
- Copy backups to a separate account and Region to limit blast radius.
- Vault Lock compliance mode becomes immutable after a grace time of at least 72 hours.
What it is
In a multi-account organization, backups must be consistent everywhere and impossible for an attacker to erase. AWS Backup centralizes backup plans, copies and reporting across accounts and Regions.
Immutability protects the copies. AWS Backup Vault Lock, Amazon S3 Object Lock and Amazon EBS snapshot lock store data in a write-once-read-many (WORM) form, so even a privileged user cannot delete it early.
How it works
Centralized backup with AWS Organizations
AWS Backup integrates with AWS Organizations. Backup policies attached to organizational units deploy backup plans to member accounts, so every account gets the same schedule, retention and copy rules without per-account setup.
Resources are usually selected by tag, so a new database tagged for backup is protected at once. A delegated administrator account can manage backup policies instead of the management account.
| Need | AWS Backup feature |
|---|---|
| Same plan in every account | Backup policies in AWS Organizations |
| Copy outside the source account | Cross-account copy to a vault in a central backup account |
| Survive a Region outage | Cross-Region copy |
| Prove backups meet policy | AWS Backup Audit Manager frameworks and reports |
| Prove backups actually restore | Restore testing |
| Stop early deletion | Vault Lock |
A separate backup account limits the blast radius. If attackers gain control of a production account, they still cannot reach the copies in the backup account.
AWS Backup Vault Lock
Vault Lock adds WORM protection to a backup vault. Delete or lifecycle change requests for recovery points in a locked vault are denied, including from the root user.
| Mode | Who can remove the lock | Use it for |
|---|---|---|
| Governance | Users with sufficient IAM permissions | Internal policy, testing retention settings |
| Compliance | Nobody, once the grace time ends | Regulatory retention and ransomware defense |
In compliance mode you set a grace time of at least 3 days (72 hours). During grace time the lock can still be changed or removed; after it, the vault and its lock are immutable while it holds recovery points. Minimum and maximum retention settings make backup and copy jobs fail if their retention is outside the range.
A logically air-gapped vault is a specialized vault that always uses Vault Lock compliance mode. It can be shared with other accounts through AWS Resource Access Manager, so a clean recovery account can restore from it quickly, and multi-party approval can control access to it.
Amazon S3 Object Lock
S3 Object Lock protects object versions and requires versioning on the bucket.
| Control | Effect |
|---|---|
| Governance mode retention | Most users cannot delete or overwrite the version; users with special permission can bypass |
| Compliance mode retention | No user, including the root user, can delete the version until retention ends |
| Legal hold | Blocks deletion with no end date until the hold is removed |
Because deletes on a versioned bucket only add a delete marker, the locked version is still there to restore.
Amazon EBS snapshot lock
EBS snapshot lock prevents deletion of a snapshot for a set duration or until a date. A locked snapshot cannot be deleted by any user while locked, whatever their IAM permissions, but it can still be used to create volumes.
Like the other locks, it has a governance mode and a compliance mode. In governance mode, users with the right IAM permissions can unlock it; compliance mode is the choice for regulatory WORM retention.
Defense in depth against ransomware
- Keep copies in a separate account and Region, with their own access controls.
- Use compliance mode locks for the copies you rely on.
- Encrypt with keys whose policies the production account cannot change.
- Run restore testing so you know the copies work.
- Use SCPs to deny actions that weaken protection, such as removing locks.
How the exam asks about this
- "Every account in the organization must back up tagged resources with the same schedule, managed centrally." -> AWS Backup policies in AWS Organizations with tag-based selection.
- "Backups must be impossible to delete, even by the root user, for seven years." -> AWS Backup Vault Lock in compliance mode with a minimum retention period.
- "Objects in an S3 bucket must be protected from deletion or overwrite by any user, including administrators." -> S3 Object Lock in compliance mode on a versioned bucket.
What to remember for the exam
- Backup policies in AWS Organizations push consistent backup plans to member accounts.
- Copy backups to a separate account and Region to limit blast radius.
- Vault Lock compliance mode becomes immutable after a grace time of at least 72 hours.
- Governance mode can be bypassed by users with the right permissions; compliance mode cannot.
- S3 Object Lock needs versioning; legal hold has no end date.
- Backup Audit Manager reports compliance; restore testing proves recoverability.
Compliance mode is permanent for its retention period. Backups with very long or "Always" retention in a compliance-locked vault keep costing money and cannot be deleted, so set retention carefully before the grace time ends.
Common mistakes
Storing backups in the same account as production. An attacker with admin rights in that account can delete the backups along with the data.
Choosing governance mode for a regulator. Governance mode can be removed by privileged users, which does not meet strict WORM requirements.
Treating replication as backup. S3 or database replication copies deletions and encryption as well, so it does not replace locked, point-in-time copies.
Check yourself
What happens to an AWS Backup Vault Lock in compliance mode after the grace time?
The vault and its lock become immutable, and no user or AWS can change or delete them while recovery points remain.
Why use a separate backup account?
It limits blast radius, because compromised credentials in a production account cannot reach backups stored in another account.
What must be enabled on an S3 bucket before it can use Object Lock?
Versioning, because Object Lock protects individual object versions.
Topic 5 of 6 in Resilience, Migration, and Business Continuity
Test yourself on Resilience, Migration, and Business Continuity
The full AWS SAP-C03 question bank has 850 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.