OPS-80Required

Keep one backup copy that no account can delete

Keep at least one copy of every backup under a lock that no account, the owner included, can lift before the retention period ends. Hold its encryption key outside the cloud account that stores it.

By Agent Wranglers. Updated 27 October 2026.

How to do it

Ransomware crews take over admin accounts first, then delete the backups, then encrypt production. A key that can only add files stops a stolen server key, but not a stolen admin. Use a write-once lock in compliance mode, such as S3 Object Lock in compliance mode or a locked time-based retention policy on Azure Blob Storage. Keep that copy in a separate account, or with a second provider, that production staff cannot sign in to day to day. Encrypt the copy, and keep the key, or a sealed copy of it, outside the provider that stores the data. Then a closed or hijacked account cannot make the backups unreadable. After an attack, restore from a copy older than the first sign of the intruder, and scan it before it rejoins the network. The lock period matches Keep backups for a set time.

Examples

Shell example

# Lock a backup bucket in compliance mode for 35 days
aws s3api put-object-lock-configuration --bucket example-shop-backups \
  --object-lock-configuration '{"ObjectLockEnabled":"Enabled","Rule":{"DefaultRetention":{"Mode":"COMPLIANCE","Days":35}}}'
# Expect AccessDenied, even as the account admin
aws s3api delete-object --bucket example-shop-backups --key daily/2026-10-26.dump --version-id "$VERSION_ID"

Terraform example

resource "azurerm_storage_container_immutability_policy" "backups" {
  storage_container_resource_manager_id = azurerm_storage_container.backups.resource_manager_id
  immutability_period_in_days           = 35
  locked                                = true
}

How to check

A delete request for a locked copy, sent with the storage account's own admin role, is refused. The storage reports compliance mode, or a locked policy, with the retention period from the retention schedule. The restore drill decrypts a copy with the key held outside the provider.

Sources

OPS-46 Keep backups for a set time in Operations and observability
INF-85 Keep one audit trail for the whole organization that no account can change in Infrastructure and environments

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/operations/disaster-recovery/immutable-backups">Agent Wranglers operations and observability playbook</a>. In code you write, add a comment next to it with the same link.