Question

A financial services company must implement a centralized backup strategy across dozens of AWS accounts for EBS volumes, RDS databases, and DynamoDB tables. Regulatory auditors require that backups be immutable and cannot be deleted or have their retention shortened by anyone — including account administrators and the root user — for a mandatory 7-year retention period. The solution must minimize custom operational tooling and enforce this centrally. Which approach best meets these requirements?

Accepted Answer

Use AWS Backup with a backup vault protected by AWS Backup Vault Lock in compliance mode, apply a backup plan enforcing the 7-year retention, and orchestrate across accounts using AWS Backup's Organizations integration.

Answer

Enable S3 Object Lock in governance mode on a centralized S3 bucket and write custom Lambda functions to copy all backups into it with a 7-year retention tag.

Answer

Use AWS Backup with a backup vault protected by Vault Lock in governance mode and attach an SCP denying deletion of recovery points.

Answer

Create manual EBS snapshots, RDS snapshots, and DynamoDB backups on a schedule via EventBridge, then apply IAM policies denying delete actions to all users.