Agent WranglersMED-5Required
Back up user files outside their bucket
Copy every original file to storage in a second account or provider that the app's keys cannot delete from. Old versions in the same bucket do not count as a backup.
How to do it
A stolen app key, a wrong lifecycle rule or a closed cloud account removes a bucket and all its versions together. Replicate new objects to a bucket in a second account, with credentials the app never holds. Lock each copy for the backup window with an object lock in compliance mode, or the same feature from your provider. Back up the originals, since thumbnails and video renditions can be rebuilt from them. Time how long a full rebuild takes, and back up the renditions too when it passes your recovery target in Set recovery targets. Do not replicate deletes, so a mass delete in the app leaves the backup whole. Erased files leave the backup when their lock and retention end. The database side is Back up off the machine, and encryption follows Encrypt backups.
How to check
Upload a test file, and within 1 hour a copy with the same SHA-256 sits in the backup account. A delete request on that copy, sent with the app's own keys, is refused. Delete the file in the app, and the backup copy stays until its lock ends.
Sources
- NIST SP 800-209 (Security Guidelines for Storage Infrastructure)
- Amazon S3 Object Lock
- Amazon S3 replication
Related rules
- OPS-44 Set recovery targets in Operations and observability
- OPS-46 Keep backups for a set time in Operations and observability
- OPS-45 Back up off the machine in Operations and observability
- DAT-26 Encrypt backups in Data and databases
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/files-and-media/storage-and-backups/file-backups">Agent Wranglers files and media playbook</a>. In code you write, add a comment next to it with the same link.