Question

A healthcare company must ensure that its RDS, EFS, and DynamoDB backups cannot be deleted or shortened in retention by anyone—including the AWS account root user and administrators—for a regulatory retention period of 7 years. The security team also wants backups copied to a separate, dedicated backup account to protect against a compromised production account. Which approach meets these requirements?

Accepted Answer

Enable AWS Backup Vault Lock in compliance mode on a vault in a separate backup account, and configure a backup plan with cross-account copy into that locked vault.

Answer

Enable AWS Backup Vault Lock in governance mode on the production vault and rely on IAM policies to prevent deletion.

Answer

Enable S3 Object Lock in compliance mode on the AWS Backup service bucket and set a 7-year retention period.

Answer

Apply an SCP that denies backup:DeleteRecoveryPoint across the organization and store all backups in the production account.