How are backups protected against ransomware?
Backup data is stored in separate AWS infrastructure segments, logically isolated from the production environment. Multiple independent safeguards prevent unauthorized deletion by malware or ransomware:
CloudTrail S3 bucket: Versioning and MFA Delete enabled — deleting requires MFA authentication of the root account.
Aurora PostgreSQL: 30-day backup retention with deletion protection enabled.
DynamoDB: Point-in-time recovery on all tables with continuous backups.
Encryption: All backups are encrypted and accessible only to authorized personnel.
Immutability: Backup integrity is ensured through versioning and strict access controls; MFA Delete additionally protects the CloudTrail bucket. Additional immutability features (e.g., Object Lock) are continuously evaluated to further strengthen protection.