How to enable the immutable backup feature-Cloud Backup(Cloud Backup)-阿里云帮助中心

To improve backup security, meet enterprise compliance and audit requirements, and protect important data from accidental or malicious deletion, Cloud Backup provides the immutable backup WORM (Write-Once, Read-Many) feature. Following the write-once, read-many principle, this feature ensures that data cannot be modified or deleted once written, effectively reducing the risk of data loss caused by operational errors or malicious behavior. This topic describes how to enable immutable backup and immutable archive.

Usage notes

After you enable immutable backup or immutable archive, the data cannot be deleted or modified within the retention period, even by users who have the corresponding permissions. The backup data is automatically deleted after the configured retention period ends.

After you enable Immutable Backup or Immutable Archive, you cannot disable it.
Supported regions: For more information, see Features available in each region.
Rules for Immutable Backup:
- Immutable backup does not affect normal backup and restore operations.
- Supported objects: general backup vaults, database backup vaults (excluding Realtime Backup), and backup points in general backup policies and full machine backup policies. For more information, see Storage vault types.
- Unsupported objects: backup vaults whose Storage Vault Type is NAS Backup (30-day free trial), OSS Backup (30-day free trial), or Tablestore Backup (30-day free trial).
- SAP HANA backups do not support immutable backup.
- For general backup policies, general backup vaults, and database backup vaults:
  - You can enable immutable backup in a general backup policy or directly in the Modify Backup Vault panel. The effect is the same.
  - After the feature is enabled, all existing and newly created backup points in the backup vault are locked.
  - If replication is enabled, the backup vaults and backup points replicated to the remote site are also locked.
- For full machine backup policies:
  - Only full machine backup points generated after the feature is enabled are locked. Existing full machine backup points are not locked.
  - If replication is enabled, the backup points replicated to the remote site are also locked.
  - Normal use of the corresponding cloud disks and snapshots, such as creating cloud disks and sharing snapshots, is not affected.
Rules for Immutable Archive:

This feature applies to archive vaults whose storage vault type is archive and whose retention period is not permanent.

Enable immutable backup

Method 1: Enable immutable backup in vault management

Log on to the Cloud Backup console.
In the navigation pane on the left, click Storage Vaults.
Find the target backup vault. In the Actions column of the vault, choose More > Modify Backup Vault.
In the Modify Backup Vault panel, turn on the Immutable Backup switch.

Important
After immutable backup is enabled, the backup vault and all backup data in the vault cannot be deleted before they automatically expire. After immutable backup is enabled, it cannot be disabled.
In the dialog box, click Confirmation.

After immutable backup is enabled, the backup vault and all its backup data cannot be deleted before they automatically expire.
In the Modify Backup Vault panel, click OK.

Method 2: Enable immutable backup when you create a backup policy

Log on to the Cloud Backup console.
In the navigation pane on the left, choose Backup > Policy Center.
In the top navigation bar, select a region.
On the Policy Center page, click Create Backup Policy.
In the Create Policy panel, turn on the Immutable Backup switch. Configure the other parameters as needed. For more information about the parameters, see Parameters.

Important
Both General Backup Policy and ECS Instance Backup Policy support immutable backup. After Immutable Backup is enabled, the backup vault and all backup data in the vault cannot be deleted before they automatically expire. After immutable backup is enabled, it cannot be disabled.

The Immutable Backup switch is located in the Data Security section of the backup data management area.

The Immutable Backup switch is located in the Data Security section of the Backup Data Management area in the Create Policy panel.
In the Create Backup Policy panel, click OK.

After the operation is complete, the Data Lock Mode column of the target backup vault displays Locked.

Enable immutable archive

Log on to the Cloud Backup console.
In the navigation pane on the left, click Storage Vaults.
Find the target archive vault. In the Actions column of the vault, choose More > Configure Archive Vault.
In the Configure Archive Vault panel, turn on the Immutable Archive switch. In the Immutable Archive section, turn on the immutable archive switch.

Important
After immutable archive is enabled, the archive vault and all archived data in the vault cannot be deleted before they automatically expire. After immutable archive is enabled, it cannot be disabled.
In the dialog box, click Confirmation.

The dialog box states that after immutable archive is enabled, the archive vault and all archived data in the vault cannot be deleted before they automatically expire.
In the Configure Archive Vault panel, click OK.
After the operation is complete, the Data Lock Mode column of the target archive vault displays Locked. After immutable archive is enabled, the archive vault displays a Locked tag and its retention period in the list, for example, Retention: 2 years.

FAQ

In the Modify Backup Vault panel of vault management, why can't I find the Immutable Backup feature?

You can enable immutable backup only for backup vaults of the General Backup and Database Backup types. For backup vaults whose Storage Vault Type is NAS Backup (30-day free trial), OSS Backup (30-day free trial), or Tablestore Backup (30-day free trial), immutable backup cannot be enabled.

Can I disable immutable backup after enabling it for a backup vault?

No. After immutable backup is enabled, the feature cannot be disabled. After immutable backup is enabled, the backup vault and backup data cannot be deleted before they automatically expire. Normal backup and restore operations are not affected.