When "Delete" Must Be Impossible
Consider a scenario: a disgruntled sysadmin with root-level access decides to cause maximum damage on their last day. They delete every EC2 instance, every RDS database, and then — knowing you have backups — they delete every recovery point in every backup vault. Without a mechanism to prevent this, your backups offer no protection against an insider threat with sufficient privileges.
AWS Backup Vault Lock solves this by enforcing a Write-Once-Read-Many (WORM) model on a backup vault. Once a recovery point is written to a locked vault, it cannot be deleted by anyone — not by an IAM admin, not by the root user, not by AWS Support — until its retention period expires naturally.
This is the cloud equivalent of a tamper-evident seal on a physical archive.
The Two Modes
Governance Mode is the training wheels version. It enforces WORM semantics for most users, but IAM principals with the backup:DeleteBackupVaultLockConfiguration permission can still remove the lock. This is useful for:
- Testing your Vault Lock configuration before committing
- Environments where you need the option to override in exceptional circumstances
- Development and staging accounts
Compliance Mode is absolute. Once the cooling-off period expires, the lock configuration cannot be changed or removed by anyone. The specific guarantees are:
- The root user cannot delete recovery points
- AWS Support cannot unlock the vault even if you call and ask
- No IAM policy, SCP, or permission boundary can override it
- The only way the data leaves is by waiting for the retention period to expire
Vault Lock Configuration:
Mode: COMPLIANCE
Min Retention Days: 7
Max Retention Days: 2555 (7 years)
Cooling-off Period: 3 days
The Cooling-Off Period: Your Last Chance
When you apply Vault Lock in Compliance Mode, AWS gives you a cooling-off period (minimum 3 days, maximum 72 hours after creation — you set it). During this window, the lock is in a "pending" state. You can still modify or delete the lock configuration if you discover a mistake.
Once the cooling-off period expires, the lock becomes permanent for the duration of the retention period. There is no appeal process.
This is not a theoretical risk. A misconfigured retention period of "3650 years" instead of "3650 days" would obligate you to pay for that storage for millennia. The cooling-off period is your only safety valve.
Regulatory Use Cases
Vault Lock in Compliance Mode is specifically designed to satisfy regulations that require immutable records:
| Regulation | Requirement | How Vault Lock Satisfies It |
|---|---|---|
| SEC Rule 17a-4 | Financial records retained for 6 years, non-erasable | Compliance Mode with 6-year min retention |
| HIPAA | Medical records retained per state law (often 7-10 years) | Compliance Mode with appropriate retention |
| PCI DSS | Audit logs retained for 1 year | Compliance Mode with 1-year min retention |
| GDPR | Data retained only as long as necessary | Governance Mode (allows deletion when legally required) |
Note the GDPR case: GDPR's "right to erasure" requirement means you may need to delete data on request. Compliance Mode would prevent this. For GDPR workloads, Governance Mode is typically more appropriate.
A common interview question is: "Can the AWS root user delete a backup protected by Vault Lock in Compliance Mode?" The answer is no — and this surprises many candidates. Vault Lock in Compliance Mode is one of the very few AWS features that explicitly overrides root user permissions. The correct answer demonstrates that you understand the distinction between IAM-level controls (which root can bypass) and service-level immutability controls (which root cannot bypass).
Key Point: Vault Lock is not just a security feature — it is a compliance attestation mechanism. When an auditor asks "prove these backups cannot be tampered with," you can point to a Vault Lock configuration in Compliance Mode and provide the AWS Backup Audit Manager report showing the lock has been in place continuously. This is a qualitatively different answer than "we have IAM policies that restrict deletion" — IAM policies can be changed by an admin; Vault Lock in Compliance Mode cannot.