Question

A financial services company must ensure that its EBS and RDS backups cannot be deleted or have their retention periods shortened by anyone—including administrators with full AWS Backup permissions—for a mandatory 7-year compliance retention. A SysOps administrator has already created an AWS Backup vault and a backup plan that copies backups into it. Which action will enforce this immutable retention requirement?

Accepted Answer

Apply AWS Backup Vault Lock in compliance mode with a minimum and maximum retention period, and let the cooling-off period elapse.

Answer

Attach an IAM policy to all administrators that denies the backup:DeleteRecoveryPoint action.

Answer

Enable AWS Backup Vault Lock in governance mode and set the retention to 7 years.

Answer

Enable EBS snapshot and RDS automated backup deletion protection in the respective service consoles.