AVS Vault Security 2026: A Step-by-Step Configuration Guide

Why vault lock matters in 2026

Modern ransomware groups target recovery infrastructure, deleting or corrupting backup repositories before demanding payment. Standard IAM policies are insufficient against this threat because compromised admin credentials can often bypass traditional access controls. AWS Backup Vault Lock introduces an immutable guardrail that standard permissions cannot override. By applying a vault lock policy, you create a "write-once, read-many" state for your recovery points. Once a backup is written to the vault, it becomes legally and technically immutable for a specified retention period. Even if an attacker gains root access or exploits a vulnerability in your IAM roles, they cannot delete or modify these recovery points until the lock period expires.

The core goal is to ensure backups remain intact regardless of the compromise level of your AWS environment. Vault Lock transforms your backup strategy from a target into a fortress, providing a guaranteed, unalterable path to recovery.

Configure governance mode first

Start with Governance Mode to test your backup vault's immutability without risking accidental lock-in. This mode blocks standard deletion of recovery points, providing a critical layer of protection against ransomware. However, it allows users with sufficient IAM permissions to remove or change the vault lock configuration, making it ideal for compliance testing and initial setup.

Follow these steps to enable Vault Lock in Governance Mode via the AWS Backup console.

1

Open the Vault Lock settings

Navigate to the AWS Backup console and select your target backup vault from the list. Click the Settings tab, then scroll to the Vault Lock section. Select Configure Vault Lock to begin the setup process.

2

Select Governance Mode

In the configuration dialog, choose Governance Mode. This mode ensures that recovery points cannot be deleted while the lock is active, but it retains the flexibility to modify or remove the lock configuration if necessary for administrative purposes.

3

Review and confirm the policy

Review the generated Vault Lock policy. This policy defines the specific IAM permissions required to manage the lock. Ensure that only designated administrators have the rights to modify the configuration, preventing unauthorized changes.

4

Apply the configuration

Click Confirm to apply the Vault Lock policy. The vault is now protected in Governance Mode. You can verify the status by checking the vault settings, where the lock status should display as Governance.

Previous

1234

Next

With Governance Mode active, you can now test your backup retention and deletion workflows. This setup allows you to validate compliance requirements while maintaining the ability to correct any configuration errors before moving to Compliance Mode for permanent protection.

Switch to Compliance Mode

Governance Mode allows administrators to remove the vault lock, leaving your backups vulnerable to insider threats or compromised credentials. To achieve true immutable storage, you must transition your AWS Backup vault into Compliance Mode. This is the final, irreversible step in the AVS Vault Security configuration process.

Warning: Compliance Mode is permanent. Once enabled, the vault lock configuration cannot be deleted, modified, or disabled. Ensure all retention policies and IAM permissions are finalized before proceeding.

The Irreversibility of Compliance Mode

When a vault is in Governance Mode, users with sufficient IAM permissions can remove the lock configuration. This means an attacker who gains administrative access can simply use the vault and delete your backups. Compliance Mode eliminates this possibility.

In Compliance Mode, the vault lock configuration is locked down at the service level. No IAM policy can override this setting. Even if an attacker gains root access to your AWS account, they cannot delete the vault lock or modify the retention period. This provides the highest level of protection against ransomware and malicious insider activity.

How to Enable Compliance Mode

Enabling Compliance Mode requires using the AWS Backup console or CLI. You cannot enable it directly from Governance Mode; you must first delete the existing Governance Mode configuration and then enable Compliance Mode.

1. Delete the Governance Mode configuration: If your vault is currently in Governance Mode, you must delete the vault lock configuration. This step is necessary because you cannot convert a Governance Mode lock directly to Compliance Mode. Deleting the configuration does not delete your backup recovery points.

2. Enable Compliance Mode: Navigate to the vault settings and select "Enable Compliance Mode." You will need to confirm that you understand the irreversible nature of this action. AWS will apply a new vault lock configuration that locks the retention period for all recovery points in the vault.

3. Verify the configuration: After enabling Compliance Mode, verify that the vault is locked. You can do this by checking the vault settings in the AWS Backup console or by using the AWS CLI to describe the vault lock configuration.

IAM Policy Considerations

Even in Compliance Mode, you must manage IAM policies carefully. While the vault lock itself cannot be removed, you still need to grant users permission to create, restore, and manage backup recovery points. Ensure your IAM policies are scoped to these specific actions and do not include permissions that could inadvertently compromise the vault's integrity.

For example, avoid granting backup:DeleteVaultLockConfiguration or backup:PutVaultLockConfiguration to any user or role. These permissions are only needed to enable Compliance Mode initially. Once enabled, these permissions should be revoked to prevent any accidental or malicious changes.

Best Practices

• Test in a non-production environment: Before enabling Compliance Mode on critical production vaults, test the process in a development or staging environment. This helps you understand the steps and verify that your backup and restore workflows remain intact.
• Document your retention policies: Since Compliance Mode locks the retention period, ensure your retention policies are accurate and aligned with your business needs. You cannot extend or shorten the retention period once Compliance Mode is enabled.
• Monitor vault activity: Use AWS CloudTrail to monitor access to your backup vaults. This helps you detect any unauthorized attempts to access or modify your backups.

Tighten IAM permissions

Restricting access to vault management operations is the most effective way to prevent accidental or malicious deletion of backup data. While AWS Backup Vault Lock provides a final layer of protection, broad IAM permissions can undermine that security by allowing users with sufficient privileges to remove the lock configuration entirely.

You should implement a strict IAM policy that explicitly denies backup:DeleteBackupVault and backup:DeleteBackupVaultRecoveryPoint actions for all users except a designated security admin role. This ensures that even if an attacker gains access to a standard administrative account, they cannot bypass the vault lock to destroy your recovery points.

The following policy snippet demonstrates how to deny these critical actions for all users except those with the SecurityAdmin role. This approach follows the principle of least privilege, ensuring that vault management is restricted to only those who need it.

By combining these IAM restrictions with Governance Mode vault lock, you create a defense-in-depth strategy. Users without the SecurityAdmin role are locked out of both the data and the configuration, significantly reducing the risk of ransomware data destruction.

Verify your backup integrity

A locked vault is only as good as the data inside it. Before considering your configuration complete, you must validate that AWS Backup Vault Lock is active and that a restore operation succeeds. This final step closes the loop on security assurance, ensuring that your compliance posture is not just theoretical.

Follow this checklist to confirm your vault is correctly locked and recoverable:

If the restore fails or the lock status is unclear, review your IAM policies. Ensure that no overly permissive policies allow deletion of recovery points before the retention period expires. This validation step is critical for maintaining trust in your backup infrastructure.

Common vault lock: what to check next

Governance mode is the default setting for AWS Backup Vault Lock. In this mode, recovery points cannot be deleted once the lock is active. However, users with sufficient IAM permissions can still remove or change the vault lock configuration. This provides a balance between protection and administrative flexibility.

If you need stricter controls, you can transition the vault to Compliance mode. Unlike Governance mode, Compliance mode prevents even administrators from deleting or modifying the lock configuration until the retention period expires. This is essential for regulatory compliance where immutability is non-negotiable.