中文
devexamples
← Workflows

阅读中文版本

Backup Encryption Audit Workflow

Verify backups are encrypted at rest and in transit, keys are separate from the data, access is restricted, and restores still work with the keys.

intermediate~90 minbackupsecurityencryption

Objective

Ensure backups are encrypted and their keys are managed so a backup leak does not expose data.

Environment

  • Backup storage and encryption configuration
  • Key management records

Steps

1. Confirm backups are encrypted at rest

Confirm backups are encrypted at rest and in transit.

Expected state: Data is ciphertext on the wire and on disk.

2. Verify keys are held separately

Verify keys are held separately from the backup data.

Expected state: A storage leak does not yield plaintext.

3. Restrict who and what can read

Restrict who and what can read backups and keys.

Expected state: Access is minimized and audited.

4. Restore a sample to confirm decryption

Restore a sample to confirm decryption still works after key operations.

Expected state: Recoverability is proven.

Decision points

Keys in the same account as backups?

  • Separate account or key store
  • Same account

Separate the key store; co-location defeats the purpose of encryption.

Who can restore?

  • Break-glass with audit
  • Any operator

Restrict restore to a break-glass role with auditing; broad restore rights equal broad data access.

Expected outcome

Encrypted backups with separately managed keys, restricted access, and a proven restore using those keys.

Verification

Confirm a sample restore succeeds and that backup storage alone does not permit decryption without the key.

Cleanup

Record the audit, key references, and access review results.

Overview

Ensure backups are encrypted and their keys are managed so a backup leak does not expose data. Confirm a sample restore succeeds and that backup storage alone does not permit decryption without the key.

Steps

  1. Confirm backups are encrypted at rest and in transit. Expected state: Data is ciphertext on the wire and on disk.
  2. Verify keys are held separately from the backup data. Expected state: A storage leak does not yield plaintext.
  3. Restrict who and what can read backups and keys. Expected state: Access is minimized and audited.
  4. Restore a sample to confirm decryption still works after key operations. Expected state: Recoverability is proven.
# verify a sample can be decrypted only with the key
aws s3 cp s3://backups/db.dump.enc ./db.enc
aws kms decrypt --ciphertext-blob fileb://db.enc --key-id alias/backup > /dev/null

Verification

  • Encrypted backups with separately managed keys, restricted access, and a proven restore using those keys.

Decision points

  • Keys in the same account as backups? Options: Separate account or key store; Same account. Recommended: Separate the key store; co-location defeats the purpose of encryption.
  • Who can restore? Options: Break-glass with audit; Any operator. Recommended: Restrict restore to a break-glass role with auditing; broad restore rights equal broad data access.