# Choose the AWS Backup Vault Lock mode before its grace period closes

> A retention lock needs a deliberate mode, expiry review and final decision before it becomes immutable.

- Canonical URL: https://update.dsesecurity.com/updates/aws-backup-vault-lock-mode-grace-period/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:14:01+00:00
- Modified: 2026-10-20T18:34:30+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: Business Continuity, Cybersecurity, IT
- Reading time: 2 minutes

## What you need to know

A retention lock needs a deliberate mode, expiry review and final decision before it becomes immutable.

## Potentially affected

This concerns AWS Backup Vault Lock and recovery-point lifecycle settings. It does not establish that a particular legal retention requirement is met, or that an application can restore successfully.

## DSE recommendation

DSE recommends inventorying existing recovery-point expiry dates before proposing a lock.

## Article

A retention lock needs a deliberate mode, expiry review and final decision before it becomes immutable.

## Source facts

AWS distinguishes governance mode, whose lock can be removed by sufficiently authorized users, from compliance mode. A compliance lock becomes unchangeable after its grace period while recovery points remain. New jobs whose retention conflicts with configured minimum or maximum limits fail; those limits do not rewrite recovery points already in the vault. An indefinite recovery point can therefore create a permanent retention commitment.

Source: [AWS — AWS Backup Vault Lock](https://docs.aws.amazon.com/aws-backup/latest/devguide/vault-lock.html).

## Applicability

This concerns AWS Backup Vault Lock and recovery-point lifecycle settings. It does not establish that a particular legal retention requirement is met, or that an application can restore successfully.

## DSE recommendation

DSE recommends inventorying existing recovery-point expiry dates before proposing a lock. Have the data owner approve the retention schedule and the administrator record the selected mode and exact lock date. Pilot the policy with disposable data. Schedule a decision meeting before the grace period expires, with explicit responsibility for removing an incorrect configuration while changes remain possible. Keep the retention owner and recovery operator separate in the written handoff. Make the final lock review a dated operational task with a named substitute approver. Ask the reviewer to identify the longest-lived existing point and explain its intended retirement, rather than approving only the settings that will affect future jobs.

## Verification

Proposed verification: in an approved pilot vault, inspect lock mode, retention bounds and lock date. Submit test jobs with valid and invalid retention values and retain their results. Confirm an existing recovery point keeps its original lifecycle. Review the final configuration before the recorded deadline.

## Official reference

[AWS — AWS Backup Vault Lock](https://docs.aws.amazon.com/aws-backup/latest/devguide/vault-lock.html). Reviewed October 20, 2026.

## Primary reference

- Name: AWS — AWS Backup Vault Lock
- Authority: docs.aws.amazon.com
- URL: https://docs.aws.amazon.com/aws-backup/latest/devguide/vault-lock.html
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Choose the AWS Backup Vault Lock mode before its grace period closes,” DSE Security, https://update.dsesecurity.com/updates/aws-backup-vault-lock-mode-grace-period/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.