c2.18 Back up data and make it immutable

Centralize with AWS Backup

AWS Backup is a managed, policy-based service that centralizes and automates backups across AWS services — Amazon EBS, EC2, RDS, DynamoDB, EFS, S3, and more — replacing per-service scripts. Define backup schedules and retention as policy, and monitor activity centrally.

Make backups immutable and isolated

Backups only help if an attacker cannot destroy them:

• AWS Backup Vault Lock enforces WORM (write-once-read-many) immutability; in compliance mode the lock cannot be removed for the retention period.
• Logically air-gapped vault stores immutable, encrypted copies that are locked by default and can be shared for cross-account recovery.
• Keep backup copies in a separate account with tight access control so a compromise of the workload account does not reach them.

Scan backups for malware

An immutable backup still fails you if it already contained the ransomware. Amazon GuardDuty Malware Protection for AWS Backup scans your recovery points — EBS snapshots, EC2 AMIs, and S3 recovery points — after each backup completes, so you can restore from a copy known to be clean rather than reinfecting during recovery.

Backup on-premises to the cloud

Consider backing up on-premises infrastructure to the cloud to benefit from low-cost storage classes such as Amazon S3 Glacier. If your backup tool runs on-premises, evaluate a cloud-deployable option to avoid egress data-transfer costs.