Regulated backups must be retained for seven years.
Prevent an administrator or compromised credentials from deleting them during the retention period.
Which feature is most appropriate?
Configure AWS Backup Vault Lock in compliance mode so recovery points cannot be deleted or have retention shortened during the locked period.
Detailed explanation
A hard-to-guess name does not control deletion permissions for backup recovery points.
A hard-to-guess name does not control deletion permissions for backup recovery points.
DNSSEC protects DNS responses and does not enforce backup retention.
DNSSEC protects DNS responses and does not enforce backup retention.
An alarm is not the backup vault and does not protect stored backups.
An alarm is not the backup vault and does not protect stored backups.
Vault Lock protects recovery points from deletion or retention reduction during the required period.
Vault Lock protects recovery points from deletion or retention reduction during the required period.
Check official documentation
Compare the following points with the official documentation.
AWS Backup Vault Lock compliance modeの公式説明を確認する。
What to confirm
通常のIAM権限とVault Lockによる保持制御を区別できる。
Key points
- Backup Vault Lock
- Compliance mode
- Retention period
Notes
- Environment: AWS公式SOA-C03試験ガイドとAWS公式ドキュメントの確認
- Confirm current AWS service behavior in the official documentation.
Foundation review
Immutability
Retention protection must be enforced outside ordinary administrative deletion choices.
Governance versus protection
Naming or alarm controls do not protect the backup data itself.