Last modified August 13, 2026

Immutable Backups

Learn how to use the Guided Immutable Backup Wizard to configure ransomware-proof, write-once backups in JetBackup 5.

Immutable Backups provide a robust defense against ransomware, accidental deletion, and compromised credentials by ensuring that once backup data is written to a destination, it cannot be modified, overwritten, or deleted by any user—including administrators and root users—for a specified period.

With immutability enforced, your backup files cannot be altered, overwritten, or deleted by any user—including:

Attackers using compromised administrator credentials.
Malicious insiders with elevated permissions.
The root storage account or root server administrator.

How Object Lock Works

JetBackup 5 utilizes the S3-Compatible storage-level feature called Object Lock to achieve data immutability for a specified retention period.

WORM (Write-Once, Read-Many) Model: Once a backup file version is written and locked, its retention policy is stored directly with the file. The remote storage provider enforces this policy independently of your JetBackup server.
Bucket Versioning: Object Lock protects individual object versions, meaning bucket versioning must be enabled on your destination. When newer versions of a backup object are uploaded, older locked versions retain their original, immutable protection.
Compliance Mode: JetBackup exclusively uses Compliance Mode for Object Lock protection. Other modes (like Governance Mode) permit administrative overrides, which could be exploited if administrative storage accounts are compromised. Compliance Mode completely removes the administrative bypass—no user, including the root user of the storage provider, can delete or shorten the lock duration of the protected data.

JetBackup 5 features a guided Immutable Backup Wizard to streamline the setup of immutable backup jobs in three simple steps: Learn, Storage, and Backup Job.

Important Considerations & Object Lock Rules:

Lock Duration Longer Than Retention: When a snapshot reaches its scheduled retention limit while its S3 lock is still active, S3 rejects the deletion request. JetBackup automatically defers cleanup and displays Object Lock: skipping delete of locked file in the cleanup logs. Cleanup retries every 6 hours and completes automatically once the S3 lock window naturally expires.
Lock Duration Shorter Than Retention: If the lock window expires before job retention ends, backups lose immutability early and become vulnerable to deletion or tampering prior to scheduled cleanup. Use the Object Lock Efficiency score to ensure the lock duration is longer than the retention period.
Write-Once Protection Settings: Immutability and safety buffer settings are write-once when an immutable destination is attached to a job. They cannot be modified mid-lifecycle to prevent weakening protection on previously written snapshots.
Database Storage Overhead: Database backups use a semi-incremental approach: if no tables or schema changes are detected since the last run, JetBackup skips generating a new dump. However, for active databases with frequent updates (e.g., table modifications or session writes), a full dump is regenerated on each run. Because Object Lock prevents deleting or overwriting objects during an active lock period, every newly generated database dump remains locked and billable on your destination storage until its individual lock window expires.

Object Lock Extension & Renewal Behavior:

Object Lock is renewed only during backup runs.
A backup extends the lock duration on a file only when less than 50% of the current lock period remains.
To ensure locks continue to be renewed, keep this backup job running regularly on schedule and configure alerts to notify of any job failures. If backup runs stop, existing locks will eventually expire and won’t be renewed.

The Immutable Backup Wizard

Step 1: Learn

The first step of the wizard introduces S3 Object Lock, explains how it works, and covers what to expect when using immutable backups.

Write-once protection: Every backup is protected the moment it’s written with S3 Object Lock, preventing modification or deletion until the retention period expires.
Incremental & Immutable: Maintain efficient incremental backups by extending protection on existing objects instead of reuploading unchanged data.
Storage-Enforced Security: Protection is enforced by the storage provider itself - not by JetBackup - making backups resilient against ransomware, compromised servers, and privileged accounts.
Compliance Ready: Supports Object Lock Compliance Mode to help meet organizational and regulatory requirements for immutable backup retention.
Smart Retention Advisor: Receive recommendations for retention periods that balance ransomware protection, recovery objectives, and storage costs.
Flexible S3 Support: Use JetBackup Storage or any supported S3-compatible provider with Object Lock (Compliance Mode), giving you the freedom to choose the storage platform that fits your business.

Step 2: Storage

This step guides you through selecting or configuring a compatible destination that has Object Lock enabled.

Storage Requirements and Considerations:

Compatibility & Setup:
- Compatible destination: Use JetBackup Storage or a supported S3-compatible storage destination.
- Object Lock required: The bucket must have Object Lock enabled and use Compliance Mode. Some providers require Object Lock to be enabled when the bucket is created, and for some providers, the setting is permanent when enabled for the bucket.
- Required permissions: The destination credentials must allow JetBackup to upload objects and manage their Object Lock retention settings.
Compliance Mode Guarantees:
- Retention cannot be overridden: Objects protected in Compliance Mode cannot be modified or deleted until their retention period expires, including by administrators, the root storage account, or the storage provider.
- Retention cannot be shortened: Once an object is locked, its retention date can be extended but cannot be reduced or removed.
Cost & Planning:
- Plan retention carefully: Choose backup schedules and retention settings that provide sufficient protection without locking data longer than your operational or compliance needs.

Selecting Object Lock Destinations:

Click Create JetBackup Storage Destination or Use S3-Compatible Destination to link a new destination.
Select an available destination from the Object Lock Destinations list. Every selected destination will store an immutable copy of the backups.

Step 3: Backup Job

This step allows you to configure your Backup Job settings and fine-tune your retention locks for Object Lock.

Job Name: Enter a unique name for internal identification of the job.
Destinations: Displays the pre-selected destination from Step 2. Immutability is enforced by these destinations and cannot be turned off here.
Backup Type: Choose between Accounts, Directories, or Server Backup (BMR).
Backup Contains: Select the account features to back up.
Backup Structure: Select the backup structure.

Deduplication is not available when an immutable destination is selected. You must use Incremental, Compressed, or Archived instead.
Encrypted Backups: (Archived or Compressed Structure Only) Choose whether to encrypt the backups. Please note that you must save your Master Encryption Key in order to restore the backups using the Disaster Recovery Wizard. You can copy the key from Settings -> Privacy and Security.
Retry Failed Items: Choose whether to retry backing up failed items one more time.
Account Filters: Add and test filters to include or exclude specific accounts.
Directories and Files to exclude: Exclude specific paths or folders, with recommended preset excludes.
Schedules: Assign backup schedules to the job.
Object Lock Efficiency: Evaluates the safety of your configured backup schedule retention.
- Score Efficiency: Displays an overall efficiency score (e.g., 100/100) calculating how effectively the selected lock duration covers the schedule’s backup retention requirement along with a safety buffer.
- Recommended Safe Window: Calculates the recommended lock duration (in days) required to maintain safe protection for snapshots given the backup schedule’s retention cycle. Adds a safe 20% buffer period on top of the retention period. If no schedule is assigned, uses the Manual Backups TTL.
- Selected Lock Duration: A slider allowing you to adjust the specific Object Lock duration (in days) applied to backup objects generated under this schedule. Configurations that are unsafe (below the recommended safe window) will be blocked.

FAQ

How to enable default retention period for Object Lock in S3 when the provider doesn’t allow it in the console.

If your S3 provider’s web console doesn’t offer a default retention period setting, you’ll need to enable it via their S3 API or CLI. The specific commands depend on your provider’s S3 implementation. You must enable Compliance Mode with a Default Retention period for Object Lock to function as expected.

Here are the general steps and considerations:

Enable Object Lock on the Bucket: You must first enable Object Lock for the bucket using the provider’s CLI or API. For AWS, this is typically done with the aws s3api put-object-lock-configuration command.
Set Default Retention Period: Once Object Lock is enabled, you can configure a default retention period. This setting automatically applies to all objects placed in the bucket unless overridden by an explicit retention setting on the object itself.

Because JetBackup locks the objects per your Schedule Lock Duration and ensures this always remains more than 50% of your selected lock duration, you can set the Default Retention Period to a value less than the recommended safe window, such as “1 day”.

Here’s an example of using the AWS CLI to enable Object Lock and set a default retention period:

Install AWS CLI

dnf install -y curl unzip && curl -fsSL https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip -o /tmp/awscliv2.zip && cd /tmp && unzip -q -o awscliv2.zip && ./aws/install --update && aws --version

Configure Default Retention



[root@server ~]# export AWS_ACCESS_KEY_ID='USER_ACCESS_KEY_ID'
export AWS_SECRET_ACCESS_KEY='USER_SECRET_ACCESS_KEY'
export AWS_REGION='us-east-1'
export AWS_ENDPOINT_URL_S3='https://us-east-1.storage.jetbackup.com'

aws s3api put-object-lock-configuration \
  --bucket 'my-object-lock-bucket' \
  --object-lock-configuration '{
    "ObjectLockEnabled": "Enabled",
    "Rule": {
      "DefaultRetention": {
        "Mode": "COMPLIANCE",
        "Days": 1
      }
    }
  }' \
  --no-cli-pager

Verify Default Retention

aws s3api get-object-lock-configuration \
  --bucket 'my-object-lock-bucket' \
  --no-cli-pager

Result:

{
    "ObjectLockConfiguration": {
        "ObjectLockEnabled": "Enabled",
        "Rule": {
            "DefaultRetention": {
                "Mode": "COMPLIANCE",
                "Days": 1
            }
        }
    }
}

Feedback

Was this page helpful?

Glad to hear it! Please tell us how we can improve.

Sorry to hear that. Please tell us how we can improve.