Copy backups to Azure (and immutability)

[TomasoDoudou]

Hi all,

I want to copy our VMs and agent based backups to Azure, we are on Veeam 10, we backup 3 ESX hosts and roughly 50 VMs and 1 backup server taht contains File Shares.

I am looking for documentation on how to setup storage accounts in Azure, there are different options, and I am not sure which one to use :

- Storage v1/v2 or Blob (I'd guess blob)
- Access Tier: Cool or Hot (I'd guess cool for backups)
- Data protection soft delete for Blob, will it work? Does that secure us with ransomware?

All I could find is that immutability is supported in AWS and Wasabi, is there no support at all with Azure storage?

Thank you!

[dalbertson]

Here is a link on setting up with azure.

https://helpcenter.veeam.com/docs/backu ... ml?ver=100

Azure does not support object lock at this moment so immutability will not work with azure.

Blob (hot or cold) will be the type you would want to choose.

[dalbertson]

Also FYI wasabi does NOT support object lock (immutability) at this moment. They only support bucket level immutability which we do NOT support

[TomasoDoudou]

Thank you, what about Data protection soft delete for Blob, will it work? Does that secure us with ransomware?

[dalbertson]

No. That is more of a recycle bin. When blobs are deleted it gives you a chance to save them. This wont prevent ransomware from corrupting the data before deletion.

[dalbertson]

Do you have to use Azure? Right now the only option is AWS S3. There are a few on prem vendors that are / will support it. And Azure is working on support but i dont have an ETA for when.

[TomasoDoudou]

I can look at Amazon, can I use S3 Glacier?

[dalbertson]

Support currently for S3, S3-IA, and S3-IA 1Z. Glacier isn't supported at this moment.

We can however support Glacier and/or deep archive when you use the Storage Gateway in VTL mode. This would mean you write tape jobs to it.

[TomasoDoudou]

Cheers, I will test with S3-IA

Once I set the Object storage repository, what are the steps to follow? I have defined backup jobs and I would like these jobs to be copied to the bucket

[dalbertson]

Here is a good link for the helpcenter with directions. Let me know if you run into any issues

https://helpcenter.veeam.com/docs/backu ... ml?ver=100

[TomasoDoudou]

Thank you very much!

[wa15]

No. That is more of a recycle bin. When blobs are deleted it gives you a chance to save them. This wont prevent ransomware from corrupting the data before deletion.

On this topic, if soft delete AND versioning is enabled, wouldn't that let us recover an entire folder from a few days prior to the ransomware attack OR if the Azure stored data is deleted in Veeam maliciously?

[Gostev]

If you could get the bucket back to a consistent state somehow, then sure - you can always import those backups and restore.

However, getting to the consistent state where the data matches the metadata may present a huge challenge. Keep in mind that objects are being deleted all the time for legitimate reasons, for example by the retention policy. And you can't just restore ALL deleted objects - as it will result in bringing back all data objects and all versions of checkpoints objects that ever existed into the bucket. The backup import process will not be able to make any sense out of this mess.