Data Protection · Topic 7 of 7
Data Classification, Backup and Retention
Find sensitive data with Macie, prevent public exposure, and protect backups and retention with Backup Vault Lock, Object Lock and secure deletion.
- 5 min
- Macie finds sensitive data in S3 using managed and custom data identifiers, and sends findings to Security Hub and EventBridge.
- S3 Block Public Access can be enabled for a whole account, and is the first control against public data.
- AWS Backup Vault Lock makes backups immutable. Cross account and cross Region copies protect against account compromise.
What it is
Encrypting data is only part of protecting it. You also need to know where sensitive data lives, stop it becoming public, keep recoverable copies that an attacker cannot erase, and delete it when policy says so.
This page connects classification, access exposure, backup and retention into one data protection lifecycle.
How it works
Discover and classify
Amazon Macie scans S3 buckets for sensitive data using managed data identifiers (such as personal data, financial data and credentials) and custom identifiers you define with regular expressions. Run scheduled or one time classification jobs, or turn on automated sensitive data discovery to sample buckets across the account continuously.
Findings go to Security Hub and EventBridge, so a detection can trigger a response such as tagging or moving an object. Use resource tags such as classification=confidential to drive access control and lifecycle rules, and tag consistently so ABAC and reporting work.
Macie covers S3 only. For other stores, classify by design and tagging, and use service features such as database column encryption.
Stop accidental exposure
| Control | What it does |
|---|---|
| S3 Block Public Access | Blocks public ACLs and policies, at the account level or the bucket level |
Bucket policies with aws:PrincipalOrgID | Limit access to the organization |
| S3 Access Points | Give each application its own policy and optionally a VPC restriction |
| Presigned URLs | Time limited access to one object, with the permissions of the signer |
| EBS snapshot and AMI block public access | Stop snapshots and images being shared with everyone |
| Access Analyzer | Reports resources shared outside the zone of trust |
Turn on Block Public Access for the account first, and then manage the rare exceptions. Presigned URLs act with the signer's permissions, so sign with a role that has only the access needed and keep the expiry short.
Backup
AWS Backup centralises backup policy across many services, including EBS, RDS, DynamoDB, EFS and S3, and across accounts and Regions.
- Backup plans define schedule, retention and lifecycle to cold storage.
- Backup vaults store recovery points and are encrypted with a KMS key.
- Vault Lock makes a vault write once read many, which prevents deleting recovery points or shortening retention. In compliance mode, it becomes immutable after a cooling off period.
- Cross account and cross Region copy keeps a copy outside the account that an attacker may control.
- Logically air gapped vaults hold recovery points in a vault with built in isolation, which can be shared for recovery.
- Backup Audit Manager reports on compliance of backups against your controls.
Ransomware and insider attacks go after backups first. A copy in another account, protected by Vault Lock and a separate KMS key, survives a compromise of the workload account.
Retention and immutability
| Feature | Use |
|---|---|
| S3 Object Lock | Retention periods and legal holds on objects, in governance or compliance mode |
| S3 Glacier Vault Lock | A locked policy on a Glacier vault that cannot be changed after it is locked |
| S3 Versioning with MFA delete | Recover deleted or overwritten objects, and require MFA for permanent deletes |
| Backup Vault Lock | Immutable backups |
| CloudTrail log validation | Prove log integrity |
Choose compliance mode when regulation requires that no one, including administrators, can delete data early. Choose governance mode when a small group may need to override.
Lifecycle and secure deletion
S3 lifecycle rules move data to cheaper storage and expire it on a schedule. DynamoDB time to live (TTL) removes expired items. For deletion, remember that data in backups, replicas and versions also needs to expire.
Crypto shredding means deleting the KMS key so that all data encrypted under it becomes unreadable. It is complete for data that was encrypted under a dedicated key once the KMS deletion waiting period ends, but it is irreversible and also destroys backups under that key. Use a separate key per data set or tenant if you may need this.
Privacy and data sovereignty
Use Regions and SCPs to keep data in approved locations, such as an SCP that denies actions outside chosen Regions. Replicate only to allowed Regions. Review cross Region copies and backups against residency rules.
Network exposure for data stores
Place databases in private subnets, restrict security groups, use VPC endpoints for S3 and DynamoDB with endpoint policies, and disable public accessibility on RDS. These controls reduce the chance that stored data is reachable at all.
What to remember for the exam
- Macie finds sensitive data in S3 using managed and custom data identifiers, and sends findings to Security Hub and EventBridge.
- S3 Block Public Access can be enabled for a whole account, and is the first control against public data.
- AWS Backup Vault Lock makes backups immutable. Cross account and cross Region copies protect against account compromise.
- Object Lock compliance mode cannot be bypassed by anyone, including root. Governance mode allows privileged override.
- Versioning with MFA delete protects against accidental or malicious permanent deletion.
- Crypto shredding deletes the KMS key to make encrypted data unreadable, but it is irreversible.
- Block public access exists for EBS snapshots and AMIs as well as S3.
- Use tags to carry the classification, and control access and lifecycle by tag.
For "protect backups from a ransomware attacker who gains administrator access to the production account", choose cross account copies in a locked vault under a separate key.
Common mistakes
Assuming Macie covers all data stores. It covers S3 only.
Treating encryption as the only control. An authorised but over permissive role can still read the plaintext.
Keeping backups only in the same account. An attacker with account access deletes both data and backups.
Forgetting copies. Deleting the primary data leaves replicas, versions and backups in place.
Locking a vault or an object in compliance mode is permanent for the retention period, so test the configuration in a non production vault before applying it.
Check yourself
Which service finds personal data in S3 buckets?
Amazon Macie, using managed and custom data identifiers.
How do you make backups immune to deletion by an attacker with admin rights?
Use AWS Backup Vault Lock in compliance mode and copy backups to a separate backup account.
What is crypto shredding?
Deleting the KMS key so that all data encrypted under it can no longer be read.
Topic 7 of 7 in Data Protection
Test yourself on Data Protection
The full AWS SCS-C03 question bank has 858 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.