How to Protect Cloud Backup Storage With Separate Credentials and Immutability

Retrospective: this article looks back at events from December 2022, written in 2026 with the benefit of hindsight.

In the LastPass breach, attackers stole backups from cloud storage using credentials taken from an engineer's home computer. Backups need their own protection. Here is how to secure backup storage in AWS and Azure.

Principle 1: Separate administration

Backups should be administered by different identities, and ideally in a different account or subscription, than the production systems they protect.

AWS: use AWS Backup with backup vaults in a dedicated backup account; copy backups cross-account.
Azure: use Recovery Services or Backup vaults in a separate subscription with restricted RBAC.

Principle 2: Immutability

AWS: AWS Backup Vault Lock (compliance mode prevents deletion before retention ends, even by root) or S3 Object Lock for backups stored in S3.
Azure: immutable vaults for Azure Backup and immutability policies (time-based retention) on Blob Storage.

Principle 3: Strong access controls

Phishing-resistant MFA for all backup administrators.
Just-in-time access (PIM for Azure roles; temporary elevated permission sets in IAM Identity Center).
Multi-user authorization: Azure Backup's Resource Guard requires approval from a separate party for critical operations like disabling soft delete.

Principle 4: Encryption with controlled keys

Use customer-managed keys where needed, with key administrators separate from backup administrators.

Principle 5: Managed devices only

Administrators should access backup systems only from managed, compliant devices — never personal computers.

Principle 6: Test restores

Restore critical data regularly and measure time to recover.

Verify

Review who can delete backups or change retention. The list should be very short and protected with the strongest controls.