Lion Cipher Lab
Make your backups ransomware-proof with S3 Object Lock (WORM immutability)
- Cloud Security
- Intermediate
- ~40 min
- Free · no account required
Why it matters
A ransomware crew's real goal isn't only to encrypt your live data — it's to make sure you can't recover, and the fastest way to do that is to hunt down and delete your backups first. CISA's own guidance is blunt: keep backups that an attacker who has broken into your environment cannot reach or destroy. In the cloud that means immutability. S3 Object Lock enforces WORM (Write Once, Read Many): once a version is locked, it cannot be overwritten or deleted — not by an attacker holding your admin credentials, not by a buggy script, and in compliance mode not even by the root account — until its…
What you'll learn
- S3 Object Lock (WORM immutability)
- governance vs compliance retention modes
- retention periods and legal holds
- proving a backup is undeletable
- s3:BypassGovernanceRetention and when it applies
- immutable-backup design against ransomware
- safe cleanup of locked objects
Steps in this lab
- Why immutability is the layer that survives a breach
- Create the locked bucket (Object Lock requires versioning)
- Upload a 'backup' and grab its version ID
- Lock it: a SHORT governance retention plus a legal hold
- Attack your own backup — and watch S3 refuse
- Governance vs compliance: who can override, and who can't
- Object Lock is not MFA-delete — and the pro move
- Clean up safely (and the warning that saves your account)