---
title: "Keep one backup copy that no account can · Agent Wranglers"
url: https://agentwranglers.se/playbook/operations/disaster-recovery/immutable-backups
id: OPS-80
level: Required
risk: data
updated: 2026-10-27
build: a2a6bdfed830
tokens: 1071
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Keep one backup copy that no account can delete

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Disaster recovery](https://agentwranglers.se/playbook/operations/disaster-recovery.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: OPS-80
- Level: Required
- Chapter: [Disaster recovery](https://agentwranglers.se/playbook/operations/disaster-recovery.md)
- Rule: Keep at least one copy of every backup under a lock that no account, the owner included, can lift before the retention period ends. Hold its encryption key outside the cloud account that stores it.
- Check: A delete request for a locked copy, sent with the storage account's own admin role, is refused. The storage reports compliance mode, or a locked policy, with the retention period from the retention schedule. The restore drill decrypts a copy with the key held outside the provider.
- Risk: Data leaked or lost
- How: Ransomware crews take over admin accounts first, then delete the backups, then encrypt production. A key that can only add files stops a stolen server key, but not a stolen admin. Use a write-once lock in compliance mode, such as S3 Object Lock in compliance mode or a locked time-based retention policy on Azure Blob Storage. Keep that copy in a separate account, or with a second provider, that production staff cannot sign in to day to day. Encrypt the copy, and keep the key, or a sealed copy of it, outside the provider that stores the data. Then a closed or hijacked account cannot make the backups unreadable. After an attack, restore from a copy older than the first sign of the intruder, and scan it before it rejoins the network. The lock period matches [Keep backups for a set time](https://agentwranglers.se/playbook/operations/disaster-recovery/backup-retention.md).

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### Shell example

```sh
# Lock a backup bucket in compliance mode for 35 days
aws s3api put-object-lock-configuration --bucket example-shop-backups \
  --object-lock-configuration '{"ObjectLockEnabled":"Enabled","Rule":{"DefaultRetention":{"Mode":"COMPLIANCE","Days":35}}}'
# Expect AccessDenied, even as the account admin
aws s3api delete-object --bucket example-shop-backups --key daily/2026-10-26.dump --version-id "$VERSION_ID"
```

### Terraform example

```hcl
resource "azurerm_storage_container_immutability_policy" "backups" {
  storage_container_resource_manager_id = azurerm_storage_container.backups.resource_manager_id
  immutability_period_in_days           = 35
  locked                                = true
}
```

## Sources

- [CISA #StopRansomware Guide](https://www.cisa.gov/stopransomware/ransomware-guide)
- [Amazon S3 Object Lock](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock.html)
- [Azure immutable storage for blobs](https://learn.microsoft.com/en-us/azure/storage/blobs/immutable-storage-overview)

## Related rules

- OPS-46 [Keep backups for a set time](https://agentwranglers.se/playbook/operations/disaster-recovery/backup-retention.md) in Operations and observability
- INF-85 [Keep one audit trail for the whole organization that no account can change](https://agentwranglers.se/playbook/infrastructure/identity-and-access/cloud-audit-trail.md) in Infrastructure and environments

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/operations/disaster-recovery/immutable-backups">Agent Wranglers operations and observability playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Back up off the machine](https://agentwranglers.se/playbook/operations/disaster-recovery/off-site-backups.md)
- Next: [Keep backups for a set time](https://agentwranglers.se/playbook/operations/disaster-recovery/backup-retention.md)
- [Disaster recovery](https://agentwranglers.se/playbook/operations/disaster-recovery.md)