AWS › AWS Backup & Disaster Recovery
How do backup vaults and vault lock in AWS Backup help protect against accidental or malicious data deletion?
IntermediateAnswer
A backup vault is a logical container that organizes and stores your backups, and Vault Lock lets you apply a write once read many policy to that vault, preventing anyone, including the account root user, from deleting backups or reducing their retention period before a specified time has passed, providing strong protection against accidental deletion or a malicious actor attempting to destroy your backup history.
aws backup put-backup-vault-lock-configuration --backup-vault-name my-vault --min-retention-days 30 --max-retention-days 365Real-world example A company subject to strict regulatory requirements enables Vault Lock on its backup vault, guaranteeing that even a compromised administrator account cannot delete critical compliance backups before their mandated retention period expires.