<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-cloud-backup-security
description: >-
  Implement and audit cloud backup security across AWS, Azure, and GCP to ensure
  backup encryption, access controls, cross-region replication, immutability
  policies, and recovery testing for disaster resilience.
domain: cybersecurity
subdomain: cloud-security
tags:
  - aws
  - azure
  - gcp
  - backup
  - disaster-recovery
  - encryption
  - immutability
  - cross-region
  - ransomware-protection
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1490"]
---

# Implementing Cloud Backup Security

## Overview

Cloud backup security is critical for ransomware resilience and disaster recovery.
Attackers increasingly target backup infrastructure to prevent recovery — deleting
snapshots, disabling backup plans, and removing cross-region replicas. This skill
covers securing backups across AWS Backup, Azure Backup, and GCP Backup with focus
on encryption, immutability (vault lock/WORM), access controls, cross-region
replication, and recovery testing.

Mode: `[MODE: BLUE]` with `[MODE: ARCHITECT]` layer — Backup security architecture.

## Prerequisites

| Requirement | Details |
|---|---|
| AWS CLI v2, Azure CLI, `gcloud` CLI configured | Required |
| AWS | `backup:*`, `ec2:DescribeSnapshots`, `rds:DescribeDBSnapshots` |
| Azure | `Backup Contributor`, `Backup Reader` roles |
| GCP | `roles/backupdr.admin` |
| Python 3.10+ with `boto3` | Required |

## Key Concepts

### AWS Backup Security

```bash
# List backup vaults
aws backup list-backup-vaults \
  --query 'BackupVaultList[].{Name:BackupVaultName,Encrypted:EncryptionKeyArn,Locked:Locked}' --output table

# Check vault lock (immutability) status
aws backup describe-backup-vault --backup-vault-name $VAULT_NAME \
  --query '{Name:BackupVaultName,Locked:Locked,MinRetention:MinRetentionDays,MaxRetention:MaxRetentionDays}'

# Enable vault lock (WORM - cannot be undone)
aws backup put-backup-vault-lock-configuration \
  --backup-vault-name $VAULT_NAME \
  --min-retention-days 30 \
  --max-retention-days 365

# List backup plans
aws backup list-backup-plans --query 'BackupPlansList[].{Id:BackupPlanId,Name:BackupPlanName}'

# Find unprotected EC2 instances (no backup plan)
PROTECTED=$(aws backup list-protected-resources --query 'Results[?ResourceType==`EC2`].ResourceArn' --output text)
aws ec2 describe-instances --query 'Reservations[].Instances[].InstanceId' --output text | tr '\t' '\n' | while read id; do
  echo "$PROTECTED" | grep -q "$id" || echo "[HIGH] EC2 $id — not protected by AWS Backup"
done

# Check EBS snapshot encryption
aws ec2 describe-snapshots --owner-ids self \
  --query 'Snapshots[?!Encrypted].{ID:SnapshotId,Volume:VolumeId,Size:VolumeSize}' --output table

# Check RDS backup retention
aws rds describe-db-instances \
  --query 'DBInstances[?BackupRetentionPeriod<`7`].{ID:DBInstanceIdentifier,Retention:BackupRetentionPeriod}' --output table

# Verify cross-region backup copy
aws backup list-copy-jobs --query 'CopyJobs[].{Source:SourceBackupVaultArn,Dest:DestinationBackupVaultArn,Status:State}'
```

### Azure Backup Security

```bash
# List Recovery Services vaults
az backup vault list --query "[].{Name:name,RG:resourceGroup,Location:location}" --output table

# Check soft delete status
az backup vault backup-properties show --name $VAULT_NAME --resource-group $RG \
  --query '{SoftDelete:softDeleteFeatureState,CrossRegionRestore:crossRegionRestoreFlag}'

# Enable soft delete and immutability
az backup vault backup-properties set --name $VAULT_NAME --resource-group $RG \
  --soft-delete-feature-state Enable

# List protected items
az backup item list --vault-name $VAULT_NAME --resource-group $RG \
  --query "[].{Name:properties.friendlyName,Type:properties.workloadType,Status:properties.protectionStatus}" \
  --output table

# Find unprotected VMs
az vm list --query "[].id" --output tsv | while read vm_id; do
  STATUS=$(az backup protection check-vm --vm-id "$vm_id" 2>/dev/null)
  [ -z "$STATUS" ] && echo "[HIGH] VM not backed up: $vm_id"
done
```

### GCP Backup Security

```bash
# List backup plans
gcloud backup-dr backup-plans list --project=$PROJECT_ID --location=$LOCATION \
  --format="table(name,state,backupVault)"

# List backup vaults
gcloud backup-dr backup-vaults list --project=$PROJECT_ID --location=$LOCATION \
  --format="table(name,state,enforcedRetention)"

# Check snapshot encryption
gcloud compute snapshots list \
  --format="table(name,diskSizeGb,snapshotEncryptionKey.sha256)"

# Verify cross-region snapshot
gcloud compute snapshots list \
  --filter="storageLocations:*" \
  --format="table(name,storageLocations,creationTimestamp)"
```

## Workflow

### Step 1: Inventory Backup Coverage

```bash
node scripts/agent.js --provider aws --output /tmp/backup_audit.json
```

### Step 2: Validate Recovery Capability

```bash
# AWS — test restore from backup
aws backup start-restore-job \
  --recovery-point-arn $RECOVERY_POINT_ARN \
  --iam-role-arn $RESTORE_ROLE_ARN \
  --metadata '{"SubnetId":"subnet-xxx","SecurityGroupIds":"sg-xxx"}'
```

## Detection

```yaml
title: Cloud Backup Security Detection
id: ed5953ed-7f1c-4376-ad1f-77de589540a5
status: experimental
description: Detects suspicious activity related to implementing cloud backup security techniques in cloud security context
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventName: "*Unauthorized*"
  condition: selection
level: medium
tags:
  - attack.t1490
  - attack.credential_access
falsepositives:
  - Automated cloud infrastructure provisioning by approved CI/CD pipelines
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Cloud Backup Security Detection | aws | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1490 |

## Verification

- [ ] All critical workloads covered by backup plans
- [ ] Backup vault lock (immutability) enabled on production vaults
- [ ] Cross-region backup replication configured
- [ ] Backup encryption with CMK (not default key)
- [ ] Soft delete enabled to prevent accidental deletion
- [ ] Backup access restricted — no broad IAM permissions to delete backups
- [ ] Recovery testing performed quarterly with documented RTO/RPO
- [ ] CloudTrail monitoring for DeleteBackupVault/DeleteRecoveryPoint events

## References

- [AWS Backup Security Best Practices](https://docs.aws.amazon.com/aws-backup/latest/devguide/security-best-practices.html)
- [Azure Backup Security Features](https://learn.microsoft.com/en-us/azure/backup/security-overview)
- [GCP Backup and DR](https://cloud.google.com/backup-disaster-recovery/docs)
- [NIST SP 800-184 — Cyber Event Recovery](https://csrc.nist.gov/publications/detail/sp/800-184/final)
