Setting Up Immutable Backups to S3 with Veeam

In ransomware attacks, backups are now often the first target. Once inside the network, the attacker finds the backup server, takes over an administrator account, deletes the backups first and only then encrypts the servers. A company whose backups have been deleted is no better off than a company that never had any.

Immutable backup is the protection designed for exactly this scenario. In this article we walk through, conceptually and step by step, how immutable backups are set up with Veeam Backup and Replication on S3-compatible object storage.

What Is an Immutable Backup?

An immutable backup is one that nobody can delete, overwrite or encrypt for a period you define. "Nobody" is the important word: even if the backup administrator's password is stolen, the backup cannot be deleted before that period ends.

The general idea is simple. Here we focus on how this protection is put into practice with Veeam and S3.

How S3 Object Lock Works

In S3-compatible object storage, immutability is provided by a feature called Object Lock. A locked object cannot be deleted or changed until its retention period expires.

Object Lock usually has two modes:

• Governance mode: users with a special permission can remove the lock or shorten the period. It is useful for testing and transitions, but if that privileged account is compromised, the protection can be bypassed.
• Compliance mode: nobody, including the storage provider's administrators, can delete the object or shorten the period until it expires. This is the mode that genuinely protects against ransomware.

Technical details worth knowing:

• Versioning must be enabled on the bucket for Object Lock to work.
• Object Lock is usually enabled when the bucket is created. Turning it on for an existing bucket later is not possible with every provider.
• Veeam manages the lock period on objects itself. It is therefore recommended not to set a separate default retention rule at bucket level; otherwise you may end up with locks that do not match your backup chains.

Key Concepts on the Veeam Side

Object storage repository

In Veeam, an S3-compatible bucket is added as an object storage repository. You need the endpoint address, access key, secret key, bucket and folder. When adding the repository, you tick the option to make recent backups immutable for a set number of days and choose the period.

Current Veeam versions support writing backup jobs directly to object storage. However, the common and recommended design is to keep a local repository for fast restores and send a copy to object storage.

Scale-out Backup Repository (SOBR) and the capacity tier

A Scale-out Backup Repository is a Veeam construct that manages several repositories as a single logical repository. It has two main tiers:

• Performance tier: local disks or a local backup appliance. Recent backups live here and restores are fastest from here.
• Capacity tier: S3-compatible object storage. Backups can be sent here in two ways: in copy mode, every new backup is copied to object storage as soon as it is created; in move mode, backups older than a set age are moved from local disk to object storage to free up space.

Copy mode is stronger against ransomware, because an immutable copy of the newest backup exists straight away. Alternatively, you can send copies to object storage with a separate backup copy job.

Step-by-Step Setup Flow

1. Prepare the bucket. Create a bucket with versioning and Object Lock enabled, or ask your provider to prepare one with these settings.
2. Create a dedicated access key. Define a key for Veeam that has rights only to this bucket and is not used for anything else.
3. Add the repository to Veeam. Add it as an object storage repository and set the immutability period.
4. Configure the SOBR or a copy job. Set the local repository as the performance tier and the S3 repository as the capacity tier, and enable copy mode.
5. Enable encryption. Turn on Veeam encryption for backups going to object storage and keep the password somewhere safe, independent of the backup server.
6. Watch the first backup. The first full upload can take a long time depending on your bandwidth. Later incremental backups will be much smaller.

Planning Retention Correctly

The most common mistake is confusing the immutability period with the retention period. They are different things:

• Retention period: how long backups are kept in total, for example 30 daily backups and 12 monthly backups.
• Immutability period: how much of that time is locked, for example the last 14 days.

When choosing the immutability period, ask: how many days could an attacker stay in the network unnoticed? Attackers often spend time moving around before they encrypt anything. If the period is too short, the clean backups may already be unlocked by the time the attack is discovered.

For performance reasons, Veeam extends lock periods in blocks. As a result, some backups may stay locked a few days longer than the period you set. Allow for this extra margin when planning capacity.

If you keep long-term GFS (weekly, monthly, yearly) backups, remember that these can also be kept immutable for their own retention periods. That is a real advantage for data with legal retention requirements.

The 3-2-1-1-0 Rule

The classic 3-2-1 backup rule has been extended with two extra points for the ransomware era:

• 3 copies of your data (one being production),
• 2 different media,
• 1 copy in another location,
• 1 copy offline or immutable,
• 0 errors: backups verified and restore-tested.

A local Veeam repository plus an immutable copy on S3 covers the first four points. The zero-errors point can only be met with regular testing.

Cost Planning

When estimating the cost of immutable backup, pay attention to three things:

• Data that cannot be deleted during the lock: because locked backups cannot be removed early, you will need somewhat more storage than with a conventional repository.
• Change rate: the size of daily incremental backups depends on how much your data changes. Database-heavy environments generate more change than file servers.
• Restore traffic: in a disaster you may need to download all your data. With a provider that charges for egress, the worst day becomes the most expensive day.

At CloudRUX, Standard S3 costs 0.015 USD per GB per month (14.90 USD for 1 TB). Enterprise S3, designed for immutable Veeam backups, costs 49 USD per month for 1 TB and includes Object Lock, replication across two data centres, a Veeam-ready setup, an SLA and a monthly report. Prices exclude VAT.

Restore Testing: The Real Exam for a Backup

An untested backup is just a hope. Once immutable backup is in place, do the following regularly:

• At least once a month, restore a single file and a complete virtual machine from a backup in object storage.
• Use Veeam's SureBackup feature to verify automatically that backups can be started.
• Try to delete a locked backup and confirm the operation is refused. That is the clearest proof the protection really works.
• Record restore times and compare them with what the business expects. Setting clear RPO and RTO targets helps here.

Common Mistakes

• Reusing the Veeam key elsewhere: if the same access key is used on several systems, compromising one puts all of them at risk.
• Staying in governance mode: if you do not switch to compliance mode after testing, a compromised privileged account can remove the protection.
• Storing the encryption password on the backup server: if the server is lost, so is the password, and the cloud copy cannot be opened.
• Joining the backup server to the domain: separating backup infrastructure from the production identity system makes it harder for an attacker to reach the backups.
• Not tracking capacity growth: locked data cannot be deleted early, so the capacity plan needs regular review.

Frequently Asked Questions

Can I enable Object Lock on my existing S3 bucket later?

That depends on the provider. The safest approach is to create a new bucket with versioning and Object Lock enabled and point Veeam at it.

How long should the immutability period be?

There is no single right answer, but a few days is usually not enough. For most organisations two to four weeks is a sensible starting point. Longer periods can be planned for data with legal retention requirements.

I have a local backup appliance. Why do I need the cloud?

A local appliance gives fast restores, but it shares the same risks in a fire, flood, theft or an attack that takes over the whole network. An immutable copy in another location is the last line of defence in those scenarios.

Is Veeam encryption the same as Object Lock?

No. Encryption stops data being read; Object Lock stops it being deleted or changed. We recommend using both together.

CloudRUX Enterprise S3 and BaaS

Anyone can buy S3 storage; what matters is that it is set up correctly, monitored, and that an engineer is by your side on the day of a disaster. CloudRUX Enterprise S3 provides Veeam-ready immutable storage across two data centres in Turkey at a fixed monthly price. If you would rather hand over the whole backup process, our managed backup service has Turkish-speaking engineers run your Veeam jobs for you. See our S3 page and BaaS page for details, or get in touch to review your current backup setup with us.