Zero data loss and a 4 h RTO with ransomware-resilient AWS backups for a SaaS provider

Client story

As a cybersecurity services provider, we partnered with a SaaS company to harden its AWS environment against ransomware. We removed the extortion risk by designing a backup architecture that attackers cannot break. Using AWS-native immutable backups, S3 Object Lock and a multi-layered disaster recovery strategy, we made sure the client’s critical data remains recoverable even if attackers gain full administrative control.

Challenge

Ransomware groups increasingly target backups to force victims to pay. For the SaaS company, traditional backup methods left openings:

• Attackers with admin access could delete or encrypt backups stored in the same AWS account.
• S3 buckets lacked immutability, so backups could be tampered with during an attack.
• No centralized disaster recovery plan existed for restoring systems if AWS accounts were compromised or deleted.

We needed a design that guaranteed recoverability even if attackers were inside the environment.

Solution

We implemented a multi-phase strategy to protect backups and enable rapid recovery.

1. Immutable backups for critical AWS services

AWS Backup in Compliance Mode:

• Configured undeletable backups for Amazon RDS, EC2, EBS and DynamoDB using AWS Backup’s immutable vaults.
• Enabled retention locks so backups cannot be deleted or altered during the retention period, even by admins.

S3 Object Lock for compliance:

• Applied WORM (write once, read many) policies to S3 buckets holding sensitive data, so backups cannot be encrypted or deleted.
• Used legal holds and fixed retention periods to meet regulatory requirements while blocking ransomware tampering.

2. Cross-account and cross-region replication

• Backups are replicated to a separate AWS account with restricted access, creating a logical air gap.
• Data is duplicated to a secondary AWS Region for geographic redundancy against regional outages or attacks.

3. Disaster recovery for worst-case scenarios

Account deletion protection:

• Automated daily backups are exported to an isolated AWS account, so data persists even if the primary account is deleted.
• The design uses AWS’s 14-day account recovery window to restore access if attackers delete the account.

Rapid restore workflows:

• Pre-configured AWS Elastic Disaster Recovery (DRS) templates enable full-environment restoration within hours.
• Regular drills validated a recovery point objective (RPO) of 24 hours and a recovery time objective (RTO) of 4 hours.

Architecture and tech stack

The primary account writes to immutable AWS Backup vaults and Object-Locked S3 buckets; those backups replicate to an isolated account and a secondary Region; and DRS templates rebuild the full environment from the protected copies.

• AWS Backup with Compliance Mode vaults
• Amazon S3 Object Lock (WORM)
• Cross-account and cross-region replication
• AWS Elastic Disaster Recovery
• Amazon RDS, EC2, EBS and DynamoDB

Results

The solution removed the ransomware risk and delivered:

• Zero data loss. Clean recovery points even after admin-level compromise.
• No ransom payments. Full environment restores from protected backups without paying attackers.
• Regulatory compliance. Audit-ready reports from AWS Backup and S3 give stakeholders evidence of data integrity.
• Business continuity. Uptime SLAs held in simulated attacks, preserving customer trust and revenue.

Combining AWS-native immutability, cross-account redundancy and automated disaster recovery gave the SaaS client a ransomware-proof backup strategy that follows AWS best practices for cyber resilience.

What made it work

Erbis’s takeaways from this engagement:

• Assume the attacker is an admin. Every control was designed to hold even when the person deleting backups has full rights in the primary account.
• Immutability plus distance. Retention locks stop tampering; a separate account and a second Region stop deletion and regional loss. Neither alone is enough.
• Rehearse the restore. RPO and RTO are only real once drills have produced them; pre-built DRS templates are what turned a plan into hours.
• Make compliance a by-product. Legal holds and audit-ready reports came from the same controls that block ransomware, not from a separate effort.