Points clés à retenir
- Amazon S3 durability helps protect against infrastructure failures,but additional backup protection is needed for accidental deletion,misconfiguration,compromised credentials,and data corruption.
- Clumio helps protect S3 data with continuously updated,immutable,air-gapped copies that remain available even if the source AWS account is compromised.
- Protégerion groupsetpolicies let you define which S3 bucketsetobjects are protected,along with backup frequency,retention,storage tier,and recovery options.
- Clumio Retour en arrière helps provide point-in-time rollback for versioned S3 buckets,while SecureVault supports object-,prefix-,and bucket-level recovery from immutable backups.
- Testing restores before an incident helps teams become familiar with the recovery processetrespond more quickly when data is lostoucorrupted.
Amazon S3 is designed for 99.999999999% (11 nines) of data durability. Meaning that S3 objects should remain recoverable even if hardwareouinfrastructure components fail.
However,durability will only take you so far.
It doesn’t help if a file is accidentally deleted,a lifecycle rule is misconfigured,an identityetaccess management (IAM) credential is compromised,or someone runs a batch delete against the wrong S3 prefix.
In this post,I’ll walk through how Clumio protects Amazon S3 data and,more specifically,how to recover deletedoucorrupted files after an incident. I’ll cover setting up a protection groupetbackup policy,as well as findingetrestoring specific objects using the backup calendar,and performing point-in-time recovery using Clumio Retour en arrière.
How Clumio Protégers S3 Data
Clumio is a SaaS-based,agentless backup service for AWS. For S3 specifically,rather than taking periodic snapshots of a bucket,it instead reads change events (object creations,updates,and deletions)etkeeps a continuously updated,air-gapped,immutable copy of your data. This is what makes it possible to recover cleanly even if the source account itself has been compromised.
Everything Starts with a Protégerion Group
A protection group is a named collection of oneoumore S3 buckets. Buckets can be grouped based on tags,prefixes,storage classes,or manually selected. A policy is then attached to the protection group,and it’s the policy that defines the backup mechanisms that will apply to the group.
Creating a Protégerion Group
1) To create a protection group,clickProtéger,Protégerion groups,S3 protection groups.
Creating an S3 protection group
2) Then clickCreate protection group,and give it a name that reflects the workload,like prod-customer-data. Select Protection automatisée to add buckets by account,region,or tag. This will apply to future buckets that meet the selection criteria as well as what exists today. After that,click Suivant.
Configuring automated protection
There’s also the option to select buckets manually,and after completing the selection,click Suivant.
Applying a Policy
LeDefault Policy performs monthly in-region backups with one-month retention,using SecureVault Standard,which creates a secondary,air-gapped copy of your objects. Restaurations typically complete in minutesetsupport instant access.
3) To create your own policy,clickCreate new policy,name the policy,and select the S3 asset type.
Creating a policy
Configuring Backup FrequencyetRetention Settings
4) Click the checkbox to enableSecureVault,and you have the option to configure the backup frequency in terms of the number of days between backups,or select continuous backups,to back up your data at frequent intervals throughout the day. This enables point-in-time recovery for any point in time during the day.
5) ChooseSauvegarde continue, and set the retention for one month.
6) Click the checkbox to enableRetour en arrière,for point-in-time rollbacks. Note that S3 buckets must be configured with versioning enabled in order for rollbacks to work.
7) UnderAdditional options,set the backup window to an appropriate time.
8)Backup destinationis set to in-region by default. Note that transfer charges will apply if you store backups in a different AWS region.
9) UnderSecureVault backup tier,select SecureVault Standardfor instant restores.SecureVault Archive is designed for data that will be retained for a long period,and should only be used when you can tolerate a 24- to 48-hour restore time.
10) Click the checkbox to enableThreat Scan,which is a service that scans every backup execution to help flag compromised filesetidentify safe,uncompromised restore points to prevent environment reinfection. After that,click Add,and Économiser.
Configuring the policy
11) Check that the new policy is selected for your protection group,then click Suivant.
12) UnderAdvanced options,you can choose which S3 storage classes to protect,whether you want all versions of an objectouthe latest version,includeouexclude certain prefixes,or include objects based on their creation date. Then click SuivantetCreate.
Advanced options
After that the new protection group will appear,and the first backup will be performed during the configured backup window.
Protégerion groups view
Verifying Your Backups
1) When you need to perform a restore,due to data being missingouidentified as corrupt,navigate to Protégerion groups,select the relevant S3 protection group to view the available backupsetClumio Retour en arrière Syncs. A blue dot in the calendar indicates that a successful backup exists for that day.
Viewing successful backups
2) View theRetour en arrière Syncson a per-bucket basis by selecting theRetour en arrière tab from inside the protection group,and verify that continuous backup has been functioning correctly.
Retour en arrière Syncs available for point-in-time restore
Restoring Data
In this example,I have some missing call transcripts. Each missing file has the prefix of transcript. I also have a file that is corrupted,named customers.csv. Luckily,I have a full backup as well as multiple point-in-time Retour en arrière Syncs to restore from.
S3 shows only a single call transcript; the rest have been deleted accidentally.
1) From theRestauration menu,select S3 buckets,and select the bucket that has missing files; then from the Retour en arrière dropdown,select Roll back.
Using Retour en arrière to roll back to a point-in-time
2) Select the bucket to roll back,choose the dateettime,and then filter based on object key,sizeouS3 storage class. After that,click avoir cliqué sur « Aperçu »to view the files available to roll back.
Selecting files to roll back to a point in time
3) Choose to roll back to the same source bucket,or specify a different bucket to roll back to. Then,click Copyto begin the rollback job.
4) View the progress of the rollback in theTasksmenu.
Viewing rollback progress
5) Suivant,to restore the corrupted customers.csv file,I’ll click on the previous night’s backup in the backup calendar,then select Restauration. There’s a choice to instantly access a read-only copy,restore the objectourestore multiple files based on bucket nameouprefix. 
Restoring from backup
6) SelectRestauration object,then searchetselect the object to restore,and click Suivant.
Selecting a single object to restore
7) Select the version to restore,and click Suivant.
Selecting a version to restore
8) Choose which AWS account,region,and bucket to restore to,and then begin the restore.
Set the destination before beginning the restore.
9) After the restore shows as successfully completed,the restored file should be available in S3.
Leobject is restored.
My Recommendation: Don’t Wait for an Incident
With a protection groupetpolicy in place,Clumio helps provide more than one way back from an S3 incident: Retour en arrière for near-instant,in-place,point-in-time rollback on versioned buckets,and SecureVault for restoring data from an immutable,air-gapped backup.
Both help support recovery at object,prefix,and bucket granularity,allowing you to choose the recovery approach that best fits the incident. And in both cases,recovery comes down to a few clicks rather than having to manually review multiple S3 versions.
Finally,the best time to test this is before you actually need it. Set up a protection group on your critical S3 buckets today,and run practice restores until they become second nature. Lenext time something disappears,you’ll already know exactly how to get it back.
To get started today,demander une démonstrationoutwo-week free trial.
FAQ
Q: Why do Amazon S3 buckets need backup if S3 provides 11 nines of durability?R : S3 durability is designed to protect data against hardwareetinfrastructure failures,but it does not prevent logical data loss. Accidental deletions,misconfigured lifecycle rules,compromised IAM credentials,and unintended batch operations can still result in lostoucorrupted data.
Q: How does Clumio protect Amazon S3 data?R : Clumio uses S3 change events to help maintain a continuously updated,immutable,air-gapped copy of protected data. This approach helps provide an independent recovery path even when the source AWS accountoudata has been compromised.
Q: What is an S3 protection group in Clumio?R : A protection group is a named collection of oneoumore S3 buckets that share a protection policy. Buckets can be selected manuallyouautomatically based on criteria such as AWS account,region,tags,prefixes,or storage classes.
Q: What is the difference between Clumio Retour en arrièreetSecureVault?R : Retour en arrière helps provide point-in-time rollback for S3 buckets with versioning enabled,making it useful for quickly reversing unwanted changes. SecureVault helps maintain an immutable,air-gapped backup that can be used to restore individual objects,prefixes,or larger sets of data.
Q: What is the difference between SecureVault StandardetSecureVault Archive?R : SecureVault Standard is designed for faster recoveryethelps support instant access to protected data. SecureVault Archive is intended for longer-term retentionetis better suited to data for which a 24- to 48-hour restore time is acceptable.
Q: How can teams prepare for an S3 data recovery incident?R : Configure protection groupsetappropriate backup policies for critical S3 buckets before an incident occurs. Regularly test object restoresetpoint-in-time rollbacks so the recovery process is familiar when production data needs to be recovered.
Faye Ellis is Principal Training Architect – AWS at Pluralsight.
