Backup & Replication Security

GOVERNANCE MODE:
├── Prevents most users from deleting backups
├── Users with special IAM permissions CAN delete
├── Useful for: Testing, flexible retention
└── Can be disabled by authorized admins

COMPLIANCE MODE:
├── NO ONE can delete backups (not even root)
├── Cannot be disabled once enabled
├── Retention period is immutable
├── Useful for: Regulatory compliance (SEC, FINRA)
└── WARNING: Irreversible once enabled!

Vault Lock Policy Properties:
├── MinRetentionDays: Minimum backup retention
├── MaxRetentionDays: Maximum backup retention
├── ChangeableForDays: Grace period before lock
└── After grace period: PERMANENTLY LOCKED

Retention Modes:
├── Governance Mode
│   ├── Blocks delete/overwrite
│   ├── Can be bypassed with s3:BypassGovernanceRetention
│   └── Good for: Most data protection needs
│
└── Compliance Mode
    ├── Blocks delete/overwrite
    ├── CANNOT be bypassed (ever)
    ├── Retention cannot be shortened
    └── Good for: Regulatory requirements

Legal Hold:
├── Prevents deletion regardless of retention
├── Can be applied/removed anytime
├── No expiration date
└── Useful for: Legal discovery, investigations

EBS Snapshots:
├── Encrypted snapshots remain encrypted
├── Cannot share encrypted snapshots cross-account directly
├── Must re-encrypt with shared key for cross-account
└── Snapshots inherit encryption from volume

RDS Snapshots:
├── Encrypted snapshots remain encrypted
├── Cannot share encrypted snapshots cross-account
├── Must copy snapshot with different key
└── Automated backups are not shareable

AMI Security:
├── AMIs can be shared publicly or privately
├── Encrypted volumes require key sharing
├── Launch permissions control who can use
└── Consider: Embedded secrets, sensitive data

BACKUP PLAN:
├── Backup rules (schedule, lifecycle)
├── Resource assignments (by tag or resource ID)
└── Copy rules (cross-region, cross-account)

BACKUP VAULT:
├── Storage container for recovery points
├── Encryption with KMS
├── Access policies
└── Optional Vault Lock

RECOVERY POINT:
├── Point-in-time backup
├── Stored in backup vault
├── Lifecycle rules (warm → cold → delete)
└── Can be restored or copied

Production Account (111111111111):
├── AWS Backup plan
├── Backup vault (source)
└── Copy rule → Target account

Backup Account (222222222222):
├── Backup vault (destination)
├── Vault Lock (COMPLIANCE mode)
├── Separate credentials
└── Limited access

Benefits:
├── Isolation from production compromise
├── Protection from account-level ransomware
├── Separation of duties
└── Compliance with backup isolation requirements

Primary Region (us-east-1):
├── Production workloads
├── Local backup vault
└── Copy rule → DR region

DR Region (us-west-2):
├── Backup vault (destination)
├── Recovery points replicated
└── Ready for disaster recovery

Considerations:
├── Data transfer costs
├── Encryption key availability in DR region
├── RPO/RTO requirements
└── Regional service availability

{
  "BackupPlan": {
    "Rules": [{
      "RuleName": "DailyBackup",
      "ScheduleExpression": "cron(0 5 ? * * *)",
      "TargetBackupVault": "production-vault",
      "CopyActions": [{
        "DestinationBackupVaultArn": "arn:aws:backup:us-east-1:BACKUP-ACCOUNT:backup-vault:isolated-vault"
      }]
    }]
  },
  "VaultLock": {
    "Mode": "COMPLIANCE",
    "MinRetentionDays": 30,
    "MaxRetentionDays": 365
  }
}

# 1. Add partner account to KMS key policy
aws kms put-key-policy \
  --key-id alias/shared-key \
  --policy-name default \
  --policy file://cross-account-key-policy.json

# 2. Copy snapshot with shared key
aws ec2 copy-snapshot \
  --source-region us-east-1 \
  --source-snapshot-id snap-xxx \
  --encrypted \
  --kms-key-id alias/shared-key

# 3. Share snapshot with partner account
aws ec2 modify-snapshot-attribute \
  --snapshot-id snap-yyy \
  --attribute createVolumePermission \
  --operation-type add \
  --user-ids 444455556666

1. CREATED (no lock)
   └── Vault accessible, no restrictions

2. LOCK INITIATED
   └── Grace period active (ChangeableForDays)
   └── Can abort lock during grace period

3. LOCKED (Governance)
   └── Requires IAM permission to delete
   └── Can be removed by authorized users

4. LOCKED (Compliance)
   └── Cannot be removed
   └── Cannot be modified
   └── Permanent until retention expires

# Create backup vault
aws backup create-backup-vault \
  --backup-vault-name my-vault \
  --encryption-key-arn arn:aws:kms:us-east-1:123456789012:key/xxx

# Put vault lock policy
aws backup put-backup-vault-lock-configuration \
  --backup-vault-name my-vault \
  --min-retention-days 30 \
  --max-retention-days 365 \
  --changeable-for-days 3

# Enable S3 Object Lock (at bucket creation)
aws s3api create-bucket \
  --bucket my-locked-bucket \
  --object-lock-enabled-for-bucket

# Put object with retention
aws s3api put-object \
  --bucket my-locked-bucket \
  --key file.txt \
  --body file.txt \
  --object-lock-mode COMPLIANCE \
  --object-lock-retain-until-date 2025-12-31T00:00:00Z

# Apply legal hold
aws s3api put-object-legal-hold \
  --bucket my-locked-bucket \
  --key file.txt \
  --legal-hold Status=ON