Finance policy forbids deleting recovery points before their retention ends. Operators who can use the backup vault can still delete those points today. The vault has no lock. What should be added?
Select an answer to reveal the explanation.
Short Explanation
You’re right to close the deletion path: an ordinary vault still lets operators with backup delete permission remove recovery points early. Add a compliance-mode AWS Backup Vault Lock so those points remain until retention ends; a second vault with the same access policy leaves that permission in place.
Full Explanation
A backup vault without a lock still allows a principal with backup delete permission to remove recovery points before retention ends, contrary to finance policy. Apply a compliance-mode AWS Backup Vault Lock to the current vault. After its cooling-off period, customers cannot remove or change the lock, and recovery points cannot be deleted before their retention ends. Creating a second vault with the same access policy does not remove the delete permission or lock the current vault. A bucket policy denying object deletes does not control an AWS Backup vault: recovery points are managed through Backup, not as objects addressed by the vault name. A laptop script that restores a point after deletion accepts the deletion rather than preventing it, and depends on the laptop being awake. Exam caveat: compliance mode can still be removed during its cooling-off period, which must be at least three days; the deletion ban is not immutable until that period ends. Practical check: after the lock date, try deleting a test recovery point with an operator role and confirm AWS Backup denies the request.