> For the complete documentation index, see [llms.txt](https://docs.stoik.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stoik.io/cyber-best-practices/harden-your-environment/readme/immutable-s3-backups.md).

# Immutable S3 backups

You can use S3 Object Lock to

1. **Store objects using a WORM** (Write-Once-Read-Many) model. Object locking can help prevent objects from being deleted or overwritten for a specified period of time or indefinitely.
2. **Meet regulatory requirements** that mandate WORM storage, or to add an extra layer of protection against changes and deletion of backups.

AWS permissions required to perform the operation:

* `s3:PutObjectLockConfiguration`
* `s3:PutBucketVersioning`

### Enabling the Object Lock feature

* Object Lock can only be enabled for new S3 buckets. To enable Object Lock for an existing bucket, you must contact AWS Support for a price quote.
* When you create a bucket with Object Lock enabled, Amazon S3 automatically enables versioning for the bucket.
* If you create a bucket with Object Lock enabled, you cannot disable Object Lock or suspend versioning for the bucket.

{% stepper %}
{% step %}

### The S3 bucket does not exist

When you are in the [S3 bucket](https://s3.console.aws.amazon.com/s3/bucket/create) management centre, click Advanced Settings and then select Enable:

![](https://content.gitbook.com/content/jlP9dfgnu6hj9gyZJG1g/blobs/yJvmXcrmrEIxchIO2g8P/image%20png%20Sep%2014%202023%2002%2000%2054%207804%20PM.png)

Then configure the rest of your bucket. You then have two choices for configuring Object Lock:

1. **Governance mode**: Objects in the compartment cannot be deleted without elevated privileges and the AWS s3:BypassGovernanceRetention permission.
2. **Compliance Mode**: This mode provides the highest level of immutability available. It is impossible to delete buckets configured in this mode, even with AWS root account privileges.

We recommend that you configure your essential backups using **Compliance Mode**.

![](https://content.gitbook.com/content/jlP9dfgnu6hj9gyZJG1g/blobs/UVxi6pyaLHjG26fP2MDX/image%20png%20Sep%2014%202023%2002%2027%2052%202103%20PM.png)

Finally, choose your object retention period by configuring it according to your backup policy.

Sources:

* <https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-overview.html>
* <https://aws.amazon.com/fr/blogs/storage/how-to-manage-retention-periods-in-bulk-using-amazon-s3-batch-operations/>
  {% endstep %}

{% step %}

### The S3 bucket exists

You have contacted AWS Support and copying objects from your existing bucket to the bucket with Object Lock enabled is too costly.

We recommend that you configure your future backups using step 1 of this guide and apply the following security measures to your previous backups:

Once you have enabled MFA delete, only the ***root*** user can permanently delete S3 objects or change the versioning configuration on your S3 bucket. The root user must be authenticated by an MFA device to perform this action.

**To enable MFA delete for your bucket, follow these steps:**

* [Generate an access key and secret key](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user_manage_add-key.html) for the root user.
* [Configure an MFA device for the root user](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable_virtual.html#enable-virt-mfa-for-root) (if you haven't already done so).
* Configure the AWS Command Line Interface (AWS CLI) with the root user's credentials.
* Use the *PutBucketVersioning* API to enable the MFA delete feature:

```bash
aws s3api put-bucket-versioning --bucket mybucketname --versioning-configuration MFADelete=Enabled,Status=Enabled --mfa "arn:aws:iam::(accountnumber):mfa/root-account-mfa-device (pass)"
```

* Then verify that the configuration was successful:
* Check the Amazon S3 console to ensure that versioning is enabled for the bucket.
* Verify that MFA deletion is enabled, by using the *GetBucketVersioning* API:

```bash
aws s3api get-bucket-versioning --bucket mybucketname
{
  "Status": "Enabled",
  "MFADelete": "Enabled"
}
```

**If the result of the MFADelete JSON object is Enabled, the configuration has been completed successfully.**
{% endstep %}
{% endstepper %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.stoik.io/cyber-best-practices/harden-your-environment/readme/immutable-s3-backups.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.