Backup tamper protection
Backup tamper protection is suitable for industries such as insurance and finance that need to retain critical business data long-term. After you enable the feature, the backups that an instance generates automatically cannot be deleted or tampered with through the console or API during the configured retention period; manual backups are not protected. When an instance is released, at least one backup set is retained long-term, except for local-disk instances and standalone instances. Backup tamper protection cannot be disabled after it is enabled.
Backup tamper protection is in public preview. To use the feature, submit a ticket to request access from technical support. For the enablement conditions and applicable instance types, see Limits.
How it works
Backup tamper protection is enabled for individual instances. After you enable the feature, the following protection scope and rules apply:
Protected backups — All backups that the instance generates automatically, including data backups and log backups. Manual backups are not converted into immutable backups and are not covered by tamper protection.
Protection method — Protected backups become immutable backups. They cannot be modified or deleted through the console or API during the configured retention period, and they expire after the retention period ends.
Policy changes — Backup policies can only be strengthened. Retention periods can only be extended, backup frequency can only be increased, and enabled backup capabilities cannot be disabled.
Instance release — At least one backup set is retained long-term when the instance is released, and the backup policy cannot be modified after the instance is released.
Irreversible — Backup tamper protection cannot be disabled after it is enabled.
Limits
Before you enable backup tamper protection, make sure that the following conditions are met:
Backup tamper protection is in public preview. The feature is available only after you submit a ticket to request access.
At least two backup days per week are required. The system does not raise this setting automatically, so you must adjust it yourself. If fewer than two backup days per week are configured, the operation to enable the feature fails, so adjust the backup frequency first.
The instance type must fall within the supported capability scope. Log backup is not automatically enabled for standalone instances, and the instance release retention policy cannot be configured for local-disk instances or standalone instances.
Automatic adjustments at enablement
When you enable backup tamper protection, the system automatically raises the current backup policy to a configuration that meets the protection requirements. The system does not lower existing settings. For differences in supported instance types, see Limits.
Setting | Automatic adjustment |
Full Backup retention period | At least 7 days. If the original retention period is shorter than 7 days, it is changed to 7 days. |
Log backup | Automatically enabled, with a retention period of at least 7 days. |
Instance release retention policy | At least one backup set is retained long-term after the instance is released. |
Enable backup tamper protection
This operation is irreversible: after you enable backup tamper protection, you cannot disable it. Before you enable the feature, check the backup frequency, retention periods, and geo-redundancy settings. After the feature is enabled, you cannot shorten the retention periods of full backups, log backups, high-frequency backups, or geo-redundant backups, and you cannot decrease the backup frequency. You also cannot disable log backup, high-frequency backup, backup within seconds, or geo-redundancy after they are enabled. For the complete rules, see Modify backup policies after enablement.
Log on to the ApsaraDB for MongoDB console and go to the details page of the target instance.
In the left-side navigation pane, choose Backup and Restoration.
In the Backup Settings section, make sure that at least two backup days per week are selected. If fewer than two days are selected, the operation to enable the feature fails, so adjust the backup frequency first. Also check the Full Backup retention period. This setting does not need to be adjusted manually. If the original retention period is shorter than 7 days, it is automatically raised to 7 days after you enable the feature.
Click Edit and turn on the Tamper-Proof Backup switch.
In the confirmation dialog box, read the message, confirm that the information is correct, and click OK.
After the feature is enabled, the Tamper-Proof Backup status changes to Enabled. The switch is grayed out and cannot be turned off. If the enable operation fails, make sure that at least two backup days per week are selected, adjust the backup frequency, and then repeat the preceding steps.
Modify backup policies after enablement
After you enable backup tamper protection, changes to the backup policy fall into the following two categories.
Disallowed changes
Shortening the retention period of full backups, log backups, high-frequency backups, or geo-redundant backups.
Decreasing the backup frequency, including selecting fewer backup days per week, extending the high-frequency backup interval, reducing geo-redundancy cycles, or lowering the annualized backup frequency of advanced backup.
Disabling enabled log backup, high-frequency backup, backup within seconds, or geo-redundancy.
Enabling high-frequency backup for standard backup. If you require high-frequency backup, use advanced backup.
Deleting a backup policy from advanced backup.
Lowering the instance release retention policy. This policy can be raised only in the order 0 → 1 → 2.
Allowed changes
Extending the backup retention period or increasing the backup frequency.
Enabling new backup capabilities, including log backup, backup within seconds, and geo-redundancy. You can also add a high-frequency backup policy to advanced backup.
Changing only the backup start time, or changing the backup days while keeping the number of backup days per week unchanged.