Creating immutable backups with AWS Backup Vault Lock

Create a resource policy that limits CopyFromBackupVault to the Backup Data Bunker Account. Apply it to the AWS Backup vaults in each member account. Create a customer-managed KMS key for each vault.

Set up a Backup Data Bunker account, create an AWS Backup Vault, and apply Vault Lock. Create a resource policy that limits CopyIntoBackupVault actions from specific OUs or accounts.

Create a customer-managed KMS key in a separate Key Vault account and share it with the Central Vault Account. Implement additional security controls, including MFA on critical KMS API calls.

Create a Service Control Policy that restricts access to appropriate IAM roles for backup operations into the Backup Data Bunker account.

Create an AWS Backup policy with a copy operation into the Backup Data Bunker account. Apply it to the member accounts.

Restrict access to the Backup Data Bunker account to specific users through AWS SSO and MFA, following a Break Glass workflow.

The authenticated user receives AWS STS temporary credentials through federation. These credentials provide specific access to the Backup Data Bunker.

Create audit reporting by using AWS Backup Audit Manager (BAM).

Create an organizational CloudTrail for recording and monitoring policy changes and Central Backup Vault access patterns.