Immutable vault can help you protect your backup data by blocking any operations that could lead to loss of recovery points. Further, you can lock the Immutable vault setting to make it irreversible and use WORM (Write Once, Read Many) storage for backups to prevent any malicious actors from disabling immutability and deleting backups.
Supported scenarios for WORM storageNote
Ensure that the resource provider is registered in your subscription for Microsoft.RecoveryServices, otherwise Zone-redundant and vault property options like âImmutability settingsâ will not be accessible.
While Azure Backup stores data in isolation from production workloads, it allows performing management operations to help you manage your backups, including those operations that allow you to delete recovery points. However, in certain scenarios, you may want to make the backup data immutable by preventing any such operations that, if used by malicious actors, could lead to the loss of backups. The Immutable vault setting on your vault enables you to block such operations to ensure that your backup data is protected, even if any malicious actors try to delete them to affect the recoverability of data.
Making immutability irreversibleThe immutability of a vault is a reversible setting that allows you to disable the immutability (which would allow deletion of backup data) if needed. However, we recommend you, after being satisfied with the impact of immutability, lock the vault to make the Immutable vault settings irreversible and enable WORM storage for backups, so that any bad actors canât disable it. Therefore, the Immutable vault settings accept following three states.
State of Immutable vault setting Description Disabled The vault doesn't have immutability enabled and no operations are blocked. Enabled The vault has immutability enabled and doesn't allow operations that could result in loss of backups.However, the setting can be disabled.
Enabled and locked The vault has immutability with WORM storage enabled and doesn't allow operations that could result in loss of backups.As the Immutable vault setting is now locked, it can't be disabled.
Note that immutability locking is irreversible, so ensure that you take a well-informed decision when opting to lock.
Restricted operationsImmutable vault prevents you from performing the following operations on the vault that could lead to loss of data:
Choose a vault
Operation type Description Stop protection with delete data A protected item can't have its recovery points deleted before their respective expiry date. However, you can still stop protection of the instances while retaining data forever or until their expiry. Modify backup policy to reduce retention Any actions that reduce the retention period in a backup policy are disallowed on Immutable vault. However, you can make policy changes that result in the increase of retention. You can also make changes to the schedule of a backup policy.Note that the increase in retention can't be applied if any item has its backups suspended (stop backup).
Change backup policy to reduce retention Any attempt to replace a backup policy associated with a backup item with another policy with retention lower than the existing one is blocked. However, you can replace a policy with the one that has higher retention. Operation type Description Stop protection with delete data A protected item can't have its recovery points deleted before their respective expiry date. However, you can still stop protection of the instances while retaining data forever or until their expiry. Next stepsRetroSearch is an open source project built by @garambo | Open a GitHub Issue
Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo
HTML:
3.2
| Encoding:
UTF-8
| Version:
0.7.4