Ransomware and attackers increasingly delete or encrypt backups before striking. Immutable backups cannot be changed or deleted until a retention period ends, even with valid credentials. On S3-compatible storage this is done with versioning and Object Lock.
Before you start
- An S3-compatible provider that supports Object Lock (not all do; check documentation).
- Object Lock usually must be enabled when the bucket is created.
- Background: object storage explained.
Versioning
With versioning, overwriting or deleting an object keeps the previous versions. A delete only adds a "delete marker". This protects against accidents, but someone with enough permissions can still remove old versions.
Object Lock modes
| Mode | Who can delete before retention ends | Use |
|---|---|---|
| Governance | Users with a special bypass permission | Protection with an emergency override |
| Compliance | Nobody, including the account root | Strongest protection; retention cannot be shortened |
| Legal hold | Until the hold is removed | Indefinite hold independent of retention |
Test with governance mode first: compliance mode mistakes cannot be undone and you will pay for storage until retention expires.
Set it up
- Create a bucket with Object Lock enabled (this also enables versioning).
- Set a default retention, for example governance mode, 30 days.
- Add lifecycle rules to delete non-current versions after retention plus a margin, to control costs.
- Create a dedicated access key for the backup job allowed only to write (put) objects, not delete or change retention.
Back up to the locked bucket
Tools such as restic, Kopia, rclone and several backup applications support Object Lock or work with versioned buckets. Example with rclone (see rclone backups): use rclone copy rather than sync, so the job never tries to delete.
rclone copy /var/backups s3locked:server-backups/$(hostname) --s3-no-check-bucketTest restores
- Regularly restore a backup to a test server.
- Try deleting a locked object with the backup key to confirm it is refused.
- Check retention dates on objects in the provider console or with the S3 API.
Frequently asked questions
Does Object Lock encrypt data?
No. Encrypt backups separately (client-side encryption or provider encryption).
What retention should I use?
Long enough to detect an attack, often 14–90 days, balanced against storage cost.
Is a local NAS snapshot immutable too?
Some NAS systems offer immutable snapshots; combine them with an off-site copy.