General information
Immutable (WORM: Write-Once Read-Many) storage locations are meant to be written only once and can be read/accessed as many times as needed.
This is the perfect solution to protect your backups for specified amount of time against ransomware/attackers as, once written, this data cannot be altered or erased. This helps ensure that the data is kept consistent and safe for restores when required.
Configuration
VM Backup will only support backup Immutability with Versioning and Object Locking enabled on the following cloud locations:
It's important to note the following:
- the Offsite Retention period will automatically be the same as the Immutable period
- a VM assigned to one immutable offsite backup location can also be assigned to another non-immutable offsite location
- the retention policy of both immutable and non-immutable offsite locations will be the same and match the immutable days to protect period as described above
- the retention policy of both immutable and non-immutable offsite locations will be the same and match the immutable days to protect period as described above
Security
It is not possible to manually delete backup data stored in immutable backup locations for the duration of the Immutable policy - both via VM Backup or via the cloud provider console itself.
Naturally, this is a security benefit as you can have peace of mind that any data in the backup location will remain as originally intended and cannot simply be tampered with/deleted (always assuming it is within that protect period timespan).
Costs
Some additional costs are incurred when taking immutable backups due to additional calls required to maintain the immutable status of the required backup data.