Question

A financial services company must implement a centralized, automated disaster recovery strategy for a fleet of EC2 instances, EBS volumes, and DynamoDB tables spread across multiple accounts in an AWS Organization. Compliance requires that all backups be retained for 7 years, be immutable (protected against deletion even by administrators), and be copied to a second AWS Region for DR. The team wants to minimize custom scripting and manage the policy centrally. Which approach best meets these requirements?

Accepted Answer

Use AWS Backup with a delegated administrator account, create a backup policy in AWS Organizations that assigns backup plans with cross-Region copy actions, and enable AWS Backup Vault Lock in compliance mode on the destination vaults.

Answer

Write Lambda functions triggered by EventBridge in each account to create EBS snapshots and DynamoDB exports, copy them cross-Region, and apply S3 Object Lock for immutability.

Answer

Use AWS Backup in each account independently with local backup plans, then use Data Lifecycle Manager to copy snapshots to the second Region and enable Vault Lock in governance mode.

Answer

Enable AWS Backup with cross-Region copy and apply Vault Lock in governance mode centrally through a delegated administrator, relying on SCPs to prevent deletion.