Vembu: How to Setup Immutable Backups to AWS S3

As most of you know, in the data protection realm, you want to follow the 3-2-1 rule! 3 copies of your data, on 2 types of media, 1 being off-site. I have an external HD that I backup my home-lab to with Vembu. See THIS post to see how I did that. I next setup a replication job to copy/replicate that data to an AWS S3 bucket. However, by default, S3 buckets are NOT IMMUTABLE.

With Ransomware being so rampant today, you want to make sure you’re backups are UNTOUCHABLE! This means, if your data gets encrypted, your backups DO NOT.

To do this, I found an option for the S3 buckets called OBJECT LOCK under ADVANCED SETTINGS. This permanently allows objects in that bucket to be locked. This puts the objects in that bucket into a “write-once, read-many” model.

UNFORTUNATELY, you cannot just turn this on for a bucket with data in it. So, below you’ll see how I created a new bucket and how I modified my Vembu job to use this bucket.

First, go to https://aws.amazon.com. In the search bar, type S3 (or click it if it’s in your recently used.

On the left side, under BUCKETS, click CREATE BUCKET.

Create a new bucket. The name must be lowercase with no spaces. Some characters are also not allowed. You can find the AWS Bucket naming rules here.

Setup the rest of the settings for your new bucket and scroll down to the bottom to ADVANCED SETTINGS – OBJECT LOCK.

Click ENABLE and VERSIONING automatically gets enabled. Click the box to acknowledge that Object Lock will Permanently allow objects to be locked.

Now, you can see my two buckets that I use with Vembu.

Next, it’s time to tell Vembu to backup to this new bucket! First step, is to LOGIN!

Once signed in, I’ll need to create a new backup repository. First, click the BACKUP SERVER and go to OBJECT STORAGE

Here, we’ll see where I created my S3 storage repository. Next, we’ll need to create a new repository that points to my new bucket. (You cannot edit an existing repository to point to a new bucket.)

Here, I’ll give it a name, select my credentials (which were already stored from the last repository setup), a region, and the bucket name. Also, you need to set a cache location.