Immutable Backups

Immutable backups preserve a recovery copy in a state that cannot be overwritten or deleted before its protection period ends. The essential control is storage-enforced retention, rather than a convention that administrators should not delete backups. This distinction matters during ransomware incidents: an attacker with production administrator credentials may attempt to destroy recovery points before encrypting live data.

Cloud implementations commonly use write-once, read-many storage, locked backup vaults, or snapshot retention locks. A backup policy determines when recovery points are created and how long they should be retained; an immutability control prevents prohibited changes to those recovery points. Scheduling backups alone does not provide immutability, and ordinary access policies may be insufficient when an attacker can change those policies.

Protection modes have different trust boundaries. Governance-style controls permit designated privileged identities to bypass or remove protection, making them useful where operational flexibility is required. Compliance-style controls prevent even highly privileged administrators from shortening established protection after any applicable configuration or cooling-off period. Engineers must understand when a lock becomes irreversible and which recovery points it protects before enabling it in production.

For example, an organization could create daily recovery points, copy supported backups into a dedicated backup account, and enforce retention in the destination vault. Production administrators should not control destination retention settings, backup deletion, or encryption-key administration. Cross-Region copies can additionally address regional disruption. Cross-account and cross-Region copying depend on resource support and encryption requirements, so the design must be checked for each workload rather than assumed to work uniformly.

On AWS, AWS Backup Vault Lock can enforce retention for recovery points in a backup vault. Amazon S3 Object Lock protects individual object versions using retention periods or legal holds, and requires S3 Versioning. New object versions can still be created, so protecting an older version does not prevent an attacker from uploading a corrupted replacement as the current version. Recovery procedures must identify and retrieve the known-good protected version. Amazon EBS Snapshot Lock provides retention protection for EBS snapshots independently of the mechanism that schedules their creation.

Replication and transfer are not substitutes for immutability. Replication can copy corrupted or encrypted source data into the destination, while synchronization may propagate unwanted changes according to its configuration. AWS DataSync moves data but does not inherently make the destination immutable. Similarly, Amazon Data Lifecycle Manager automates supported snapshot and image lifecycle operations but should not be treated as a retention lock. Transfer, replication, lifecycle management, and destination protection must be designed as separate controls.

Immutability also does not guarantee recoverability. A protected backup can contain malware, incomplete application state, or already-corrupted data. An attacker who cannot delete encrypted backups might still render them unusable by disabling or deleting their encryption keys. Protect key administration separately, retain necessary keys, monitor backup failures and retention changes, and regularly restore representative workloads into an isolated environment. Measure recovery point objectives and recovery time objectives rather than assuming a successful backup job proves that recovery will meet business requirements.

The principal trade-offs are storage cost, reduced deletion flexibility, and operational complexity. Long retention preserves more recovery options but increases costs and can conflict with data-deletion obligations. Irreversible locks can retain mistakenly captured sensitive data or unexpectedly large backups until protection expires. Test policies with nonproduction data, align retention with legal requirements and ransomware detection windows, and account for restore charges, archive retrieval delays, and application dependencies.