immutable backup repositories in Veeam for AWS?

[ggillette-rcps]

Does Veeam for AWS support the 'immutable backups' feature of AWS buckets (Amazon S3 Object Lock)?

[Mike Resseler]

Hi Greg,

Not at this moment

Cheers
Mike

[mfongemie]

Is this still the case?
Thanks.

[nielsengelen]

This is still the case for now but is being looked into for a future release (no ETA for now though).

[tcarracino]

Can we just lifecycle the backups from the S3 bucket into Glacier via policy?

[Gostev]

No, the content of the bucket must be managed exclusively by Veeam.

[tcarracino]

So that would include replication settings to another region or account correct?

100% hands off the bucket and it is managed by Veeam?

[dalbertson]

You could do s3 replication to another region.

Could you describe your use case for this?

[tcarracino]

It is my understanding that it is a best practice in AWS to replicate your backups (Snapshots) "Out of Region / Out of Account".

That was how I was taught and it is the only way I know of to protect your data if the account itself is compromised. (Google "code spaces" hack from 2014)

Similar to off siting your data in a conventional backup use case, But in AWS that is done to a "Backup Account" in another region preferably.

I always recommend setting up log accounts and an organization (Such as Control Tower) if the account is big enough, and of Couse an audit account with cloud trail logs going there.

In many smaller instances you can combine these items (Audit account / backup account) as it should be another account that is locked down and uses MFA, etc.

This way you always have your cloud trail audit logs (So you can see what happened) and your snapshots so you can recover.

I also have setup a VPC in that other region (In the main account) and you can ask AWS to replicate your workspaces disk images as well. (Takes about a week)

Hope that helps!

Love VEEAM!

Tom

[dalbertson]

Great, thank you for the details. And yes it is important to make sure there are multiple layers of separation and copies.

We will take note of this and as we move forward we can update this thread with details.

Thank you for your support and enthusiasm.

[mrt]

is this possible yet? is it on the road map? thanks

[nielsengelen]

It is planned to have this in the next release of VB for AWS.

[mrt]

v5.1.0.39 was released November 17th, 2022 but I don't see any immutable options, am I missing them? Thanks

[Gostev]

He meant the next major release.