A company has recently recovered from a security incident that required the restoration of Amazon EC2 instances from snapshots. The company uses an AWS Key Management Service (AWS KMS) customer…

Moving EBS snapshots to S3 via lifecycle policies still stores the data within the same AWS account. If the account is compromised, an attacker with sufficient permissions can delete both the S3 objects and the KMS key, making recovery impossible.

AWS Systems Manager can back up disks, but backing up to instance store (ephemeral storage) provides no durability. Instance store data is lost when the instance stops or terminates, making this unsuitable for disaster recovery.

Creating a separate AWS account with limited privileges and granting it cross-account access to the KMS customer managed key (via key policy) allows that account to copy EBS snapshots into its own environment. Because the backup account has independent credentials and limited blast radius, a compromise of the primary account cannot delete snapshots stored in the secondary account, satisfying the recovery requirement.

AWS Backup with S3 Object Lock prevents deletion within the same account, but if the AWS account root user or a highly privileged IAM principal is compromised, Object Lock can be circumvented or the account itself can be used to remove protections.