Use governance mode when you want most users blocked from deleting backups but need a controlled way out. Use compliance mode only when backups must never be altered until retention ends, because after the grace period nobody can remove the lock, not even AWS.
What Vault Lock does
AWS describes Vault Lock as an optional feature of a backup vault that gives write once, read many protection. If any user, including the root user, tries to delete a backup or change its lifecycle in a locked vault, the operation is denied. That protects recovery points from accidental and malicious deletion, including by someone using stolen admin credentials.
The two modes
| Point | Governance | Compliance |
|---|---|---|
| Lock removable | Yes, by users with sufficient IAM permissions | Only during the grace time |
| Vault deletable with backups inside | By permitted users | No, once grace time ends |
| Grace time | Not applicable | Choose at least 3 days |
| Best for | Operational protection | Records that must be kept for a fixed time |
In the API, including the changeable for days parameter creates a compliance lock; leaving it out creates governance. AWS gives the minimum for that value as 3 days.
Steps to choose and roll out
- Decide the minimum retention you really need and write it down with the reason.
- Create the lock in governance mode on a test vault, with min and max retention set.
- Run a backup job whose retention is outside the range. AWS says such jobs fail, so you can confirm the limits work.
- Try to delete a recovery point as an admin. It should be denied.
- Review access policies so the identity that creates backups cannot also change the lock.
- Only then consider compliance mode, with a grace time long enough to catch mistakes.
Pitfalls AWS calls out
- After the grace time in compliance mode, the vault and lock are immutable and cannot be changed or deleted by any user or by AWS.
- Backups in a locked vault cannot be deleted until their lifecycle ends, so costs continue. Check for recovery points with retention set to always, because they will be kept forever.
- Closing the AWS account still leads to deletion of the vault contents after a 90 day suspension, even with a lock in place.
- Retention limits apply to new jobs, not to recovery points already in the vault.
- Disabling an image, for example an EC2 image, can block restoring from a backup even though the backup cannot be deleted.
Backup vault lock and your wider plan
A lock protects the copies. You still need to restore them, which needs keys, permissions and a clean place to restore. CISA's guide advises keeping backups offline and encrypted, and testing them regularly. Cross account copies add protection from account compromise.
Safeguard offers compliance and evidence automation, which can help you keep proof of backup controls for audits, and asset discovery to see what needs protecting. There is a free scan for repositories.
Quick check
Can I try compliance mode safely?
Use the grace time. During it you can remove or change the lock. After it, you cannot.
Does a lock protect against the account being closed?
No. AWS documents that closing the account eventually deletes vault contents even with a lock.
Sources
Last reviewed: 19 October 2026.
