Question

A financial services company must ensure that its RDS and EBS backups cannot be deleted or altered before their retention period expires, even by administrators with full IAM permissions. This is a regulatory requirement to protect against accidental deletion and ransomware. The team already centralizes backups using AWS Backup. Which action best satisfies this requirement?

Accepted Answer

Enable AWS Backup Vault Lock in compliance mode with a defined minimum and maximum retention period on the backup vault.

Answer

Attach an IAM policy to all administrators that denies the backup:DeleteRecoveryPoint action.

Answer

Enable AWS Backup Vault Lock in governance mode on the backup vault.

Answer

Enable versioning and MFA delete on the S3 bucket where AWS Backup stores recovery points.