Question

A financial services company must retain database and file server backups in an immutable state for seven years to satisfy a regulatory requirement. Auditors demand assurance that no user — including administrators with full IAM permissions — can shorten the retention period or delete backups before they expire. The company already uses AWS Backup to centralize backups of Amazon EBS, Amazon RDS, and Amazon EFS resources. Which approach meets these requirements with the least ongoing operational effort?

Accepted Answer

Apply AWS Backup Vault Lock in compliance mode to the backup vault with a minimum and maximum retention period configured in the lock policy.

Answer

Attach an IAM policy to all administrator roles that denies the backup:DeleteRecoveryPoint action, and enable AWS CloudTrail to log any attempts.

Answer

Configure an AWS Backup vault access policy that grants delete permissions only to the root user and require MFA for those operations.

Answer

Enable AWS Backup Vault Lock in governance mode and rely on a service control policy to block deletion API calls organization-wide.