{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/aws-backup-vault-lock-mode-grace-period/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/aws-backup-vault-lock-mode-grace-period/",
        "slug": "aws-backup-vault-lock-mode-grace-period",
        "url": "https://update.dsesecurity.com/updates/aws-backup-vault-lock-mode-grace-period/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/aws-backup-vault-lock-mode-grace-period.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/aws-backup-vault-lock-mode-grace-period/"
        },
        "title": "Choose the AWS Backup Vault Lock mode before its grace period closes",
        "summary": "A retention lock needs a deliberate mode, expiry review and final decision before it becomes immutable.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "continuity-recovery",
            "label": "Continuity & recovery",
            "alt": "Paired infrastructure paths converging on a stable recovered service.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "business-continuity",
                "name": "Business Continuity",
                "url": "https://update.dsesecurity.com/topic/business-continuity/"
            },
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-10-20T18:14:01+00:00",
        "modified_at": "2026-10-20T18:34:30+00:00",
        "reviewed_on": "2026-10-20",
        "reading_minutes": 2,
        "word_count": 282,
        "potentially_affected": "This concerns AWS Backup Vault Lock and recovery-point lifecycle settings. It does not establish that a particular legal retention requirement is met, or that an application can restore successfully.",
        "dse_recommendation": "DSE recommends inventorying existing recovery-point expiry dates before proposing a lock.",
        "primary_source": {
            "name": "AWS — AWS Backup Vault Lock",
            "url": "https://docs.aws.amazon.com/aws-backup/latest/devguide/vault-lock.html",
            "published_on": null,
            "authority": "docs.aws.amazon.com"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p>A retention lock needs a deliberate mode, expiry review and final decision before it becomes immutable.</p>\n<h2>Source facts</h2>\n<p>AWS distinguishes governance mode, whose lock can be removed by sufficiently authorized users, from compliance mode. A compliance lock becomes unchangeable after its grace period while recovery points remain. New jobs whose retention conflicts with configured minimum or maximum limits fail; those limits do not rewrite recovery points already in the vault. An indefinite recovery point can therefore create a permanent retention commitment.</p>\n<p>Source: <a href=\"https://docs.aws.amazon.com/aws-backup/latest/devguide/vault-lock.html\">AWS — AWS Backup Vault Lock</a>.</p>\n<h2>Applicability</h2>\n<p>This concerns AWS Backup Vault Lock and recovery-point lifecycle settings. It does not establish that a particular legal retention requirement is met, or that an application can restore successfully.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends inventorying existing recovery-point expiry dates before proposing a lock. Have the data owner approve the retention schedule and the administrator record the selected mode and exact lock date. Pilot the policy with disposable data. Schedule a decision meeting before the grace period expires, with explicit responsibility for removing an incorrect configuration while changes remain possible. Keep the retention owner and recovery operator separate in the written handoff. Make the final lock review a dated operational task with a named substitute approver. Ask the reviewer to identify the longest-lived existing point and explain its intended retirement, rather than approving only the settings that will affect future jobs.</p>\n<h2>Verification</h2>\n<p>Proposed verification: in an approved pilot vault, inspect lock mode, retention bounds and lock date. Submit test jobs with valid and invalid retention values and retain their results. Confirm an existing recovery point keeps its original lifecycle. Review the final configuration before the recorded deadline.</p>\n<h2>Official reference</h2>\n<p><a href=\"https://docs.aws.amazon.com/aws-backup/latest/devguide/vault-lock.html\">AWS — AWS Backup Vault Lock</a>. Reviewed October 20, 2026.</p>",
        "content_text": "A retention lock needs a deliberate mode, expiry review and final decision before it becomes immutable.\nSource facts\nAWS distinguishes governance mode, whose lock can be removed by sufficiently authorized users, from compliance mode. A compliance lock becomes unchangeable after its grace period while recovery points remain. New jobs whose retention conflicts with configured minimum or maximum limits fail; those limits do not rewrite recovery points already in the vault. An indefinite recovery point can therefore create a permanent retention commitment.\nSource: AWS — AWS Backup Vault Lock.\nApplicability\nThis concerns AWS Backup Vault Lock and recovery-point lifecycle settings. It does not establish that a particular legal retention requirement is met, or that an application can restore successfully.\nDSE recommendation\nDSE recommends inventorying existing recovery-point expiry dates before proposing a lock. Have the data owner approve the retention schedule and the administrator record the selected mode and exact lock date. Pilot the policy with disposable data. Schedule a decision meeting before the grace period expires, with explicit responsibility for removing an incorrect configuration while changes remain possible. Keep the retention owner and recovery operator separate in the written handoff. Make the final lock review a dated operational task with a named substitute approver. Ask the reviewer to identify the longest-lived existing point and explain its intended retirement, rather than approving only the settings that will affect future jobs.\nVerification\nProposed verification: in an approved pilot vault, inspect lock mode, retention bounds and lock date. Submit test jobs with valid and invalid retention values and retain their results. Confirm an existing recovery point keeps its original lifecycle. Review the final configuration before the recorded deadline.\nOfficial reference\nAWS — AWS Backup Vault Lock. Reviewed October 20, 2026.",
        "content_markdown": "A retention lock needs a deliberate mode, expiry review and final decision before it becomes immutable.\n\n## Source facts\n\nAWS distinguishes governance mode, whose lock can be removed by sufficiently authorized users, from compliance mode. A compliance lock becomes unchangeable after its grace period while recovery points remain. New jobs whose retention conflicts with configured minimum or maximum limits fail; those limits do not rewrite recovery points already in the vault. An indefinite recovery point can therefore create a permanent retention commitment.\n\nSource: [AWS — AWS Backup Vault Lock](https://docs.aws.amazon.com/aws-backup/latest/devguide/vault-lock.html).\n\n## Applicability\n\nThis concerns AWS Backup Vault Lock and recovery-point lifecycle settings. It does not establish that a particular legal retention requirement is met, or that an application can restore successfully.\n\n## DSE recommendation\n\nDSE recommends inventorying existing recovery-point expiry dates before proposing a lock. Have the data owner approve the retention schedule and the administrator record the selected mode and exact lock date. Pilot the policy with disposable data. Schedule a decision meeting before the grace period expires, with explicit responsibility for removing an incorrect configuration while changes remain possible. Keep the retention owner and recovery operator separate in the written handoff. Make the final lock review a dated operational task with a named substitute approver. Ask the reviewer to identify the longest-lived existing point and explain its intended retirement, rather than approving only the settings that will affect future jobs.\n\n## Verification\n\nProposed verification: in an approved pilot vault, inspect lock mode, retention bounds and lock date. Submit test jobs with valid and invalid retention values and retain their results. Confirm an existing recovery point keeps its original lifecycle. Review the final configuration before the recorded deadline.\n\n## Official reference\n\n[AWS — AWS Backup Vault Lock](https://docs.aws.amazon.com/aws-backup/latest/devguide/vault-lock.html). Reviewed October 20, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/aws-backup-vault-lock-mode-grace-period/",
                "url": "https://update.dsesecurity.com/updates/aws-backup-vault-lock-mode-grace-period/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-10-20"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/aws-backup-vault-lock-mode-grace-period/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Business Continuity",
                        "item": "https://update.dsesecurity.com/topic/business-continuity/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 3,
                        "name": "Choose the AWS Backup Vault Lock mode before its grace period closes",
                        "item": "https://update.dsesecurity.com/updates/aws-backup-vault-lock-mode-grace-period/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/aws-backup-vault-lock-mode-grace-period/#article",
                "identifier": "https://update.dsesecurity.com/updates/aws-backup-vault-lock-mode-grace-period/",
                "url": "https://update.dsesecurity.com/updates/aws-backup-vault-lock-mode-grace-period/",
                "headline": "Choose the AWS Backup Vault Lock mode before its grace period closes",
                "description": "A retention lock needs a deliberate mode, expiry review and final decision before it becomes immutable.",
                "abstract": "A retention lock needs a deliberate mode, expiry review and final decision before it becomes immutable.",
                "articleBody": "A retention lock needs a deliberate mode, expiry review and final decision before it becomes immutable.\nSource facts\nAWS distinguishes governance mode, whose lock can be removed by sufficiently authorized users, from compliance mode. A compliance lock becomes unchangeable after its grace period while recovery points remain. New jobs whose retention conflicts with configured minimum or maximum limits fail; those limits do not rewrite recovery points already in the vault. An indefinite recovery point can therefore create a permanent retention commitment.\nSource: AWS — AWS Backup Vault Lock.\nApplicability\nThis concerns AWS Backup Vault Lock and recovery-point lifecycle settings. It does not establish that a particular legal retention requirement is met, or that an application can restore successfully.\nDSE recommendation\nDSE recommends inventorying existing recovery-point expiry dates before proposing a lock. Have the data owner approve the retention schedule and the administrator record the selected mode and exact lock date. Pilot the policy with disposable data. Schedule a decision meeting before the grace period expires, with explicit responsibility for removing an incorrect configuration while changes remain possible. Keep the retention owner and recovery operator separate in the written handoff. Make the final lock review a dated operational task with a named substitute approver. Ask the reviewer to identify the longest-lived existing point and explain its intended retirement, rather than approving only the settings that will affect future jobs.\nVerification\nProposed verification: in an approved pilot vault, inspect lock mode, retention bounds and lock date. Submit test jobs with valid and invalid retention values and retain their results. Confirm an existing recovery point keeps its original lifecycle. Review the final configuration before the recorded deadline.\nOfficial reference\nAWS — AWS Backup Vault Lock. Reviewed October 20, 2026.",
                "datePublished": "2026-10-20T18:14:01+00:00",
                "dateModified": "2026-10-20T18:34:30+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/aws-backup-vault-lock-mode-grace-period/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/aws-backup-vault-lock-mode-grace-period/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Choose the AWS Backup Vault Lock mode before its grace period closes"
                },
                "articleSection": [
                    "Business Continuity",
                    "Cybersecurity",
                    "IT"
                ],
                "keywords": [
                    "Business Continuity",
                    "Cybersecurity",
                    "IT",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Business Continuity",
                        "url": "https://update.dsesecurity.com/topic/business-continuity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    }
                ],
                "wordCount": 282,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "AWS — AWS Backup Vault Lock",
                    "url": "https://docs.aws.amazon.com/aws-backup/latest/devguide/vault-lock.html"
                }
            }
        ]
    }
}