Study guide
13.4 Lifecycle, Backup & Secure Replication Beyond S3: EFS, FSx, DLM, DataSync & Air-Gapped Vaults
AWS Certified Security – Specialty SCS-C03
Track your progress as you read
Finished sections get a check mark.
1 Chapter 0: Getting Started with the SCS-C03 Exam
0.1 SCS-C03 Exam Format, Domains & Study Strategy
2 Chapter 1: Security Monitoring, Alerting & Threat Detection Services
1.1 Workload Monitoring & Health Check Strategies 1.2 Amazon GuardDuty Architecture & Finding Types 1.3 AWS Security Hub & Automated Conformance Assessment 1.4 Amazon Macie & Automated Data Classification
3 Chapter 2: Enterprise Logging Architecture & Analysis
2.1 Multi-Account CloudTrail & Organization Trails 2.2 Amazon Security Lake & OCSF Log Normalization 2.3 Network Telemetry: VPC Flow Logs & Route 53 Resolver Logs 2.4 Troubleshooting Security Telemetry & Log Ingestion 2.5 Analyzing, Normalizing & Correlating Security Logs
4 Chapter 3: Incident Readiness, Response Planning & Automated Runbooks
3.1 Incident Response Planning & Blast Radius Mitigation 3.2 Testing & Validating Incident Response Plans 3.3 Automated Incident Remediation with EventBridge & Step Functions 3.4 Systems Manager OpsCenter & Incident Manager Runbooks
5 Chapter 4: Digital Forensics, Evidence Preservation & Root Cause Analysis
4.1 Forensic Artifact Capture & Chain of Custody 4.2 Threat Containment & Network Quarantine Techniques 4.3 Correlating Events & Root Cause Analysis with Amazon Detective
6 Chapter 5: Edge Protection, WAF & DDoS Mitigation
5.1 CloudFront Security Headers & Origin Access Control 5.2 AWS WAF Architecture & Advanced Rule Sets 5.3 AWS Shield Advanced & DDoS Defense Architectures 5.4 Edge Integrations: Managed Rule Groups, OCSF Ingestion, IoT Policies & CORS
7 Chapter 6: Compute Workload Hardening, Vulnerability Management & GenAI Security
6.1 Golden AMIs & Container Image Hardening Pipelines 6.2 Amazon Inspector Vulnerability Management & Patch Automation 6.3 Generative AI Security: Amazon Bedrock Guardrails & Model Protection 6.4 Instance Profiles, Service Roles & Execution Roles for Compute 6.5 Secure Administrative Access: Session Manager & EC2 Instance Connect
8 Chapter 7: Network Security, Segmentation, Private Connectivity & Encryption in Transit
7.1 Layered Traffic Filtering: SGs, NACLs & AWS Network Firewall 7.2 Hybrid Connectivity Security: VPN, Direct Connect & MACsec 7.3 Zero-Trust Access & Network Access Analysis 7.4 Enforcing Encryption in Transit: ELB Security Policies, TLS & HTTPS-Only Access 7.5 Private Access: VPC Endpoints, PrivateLink, Client VPN & Verified Access 7.6 Inter-Resource Encryption in Transit: Nitro, EMR, EKS & SageMaker AI
9 Chapter 8: Enterprise Authentication, Federation & Directory Services
8.1 AWS IAM Identity Center & Enterprise IdP Integration 8.2 Amazon Cognito User Pools & Identity Pools 8.3 AWS Security Token Service (STS) & Temporary Credential Workflows 8.4 Troubleshooting Identity & Authentication Failures
10 Chapter 9: Advanced Authorization Architecture & Policy Evaluation
9.1 Complete AWS Policy Evaluation Logic & Decision Flow 9.2 Permission Boundaries & Safe Admin Delegation 9.3 Attribute-Based Access Control (ABAC) with IAM Tags
11 Chapter 10: Least Privilege, Policy Validation & External Access Auditing
10.1 IAM Roles Anywhere & Amazon Verified Permissions 10.2 Auditing External & Unused Access with IAM Access Analyzer 10.3 Analyzing Authorization Failures & Policy Simulation
12 Chapter 11: Cryptographic Services: KMS Architecture & Key Governance
11.1 AWS KMS Architecture, Key Policies & Key Types 11.2 KMS Grants, Encryption Context & Multi-Region Keys 11.3 Imported Key Material (BYOK) & CloudHSM Key Stores
13 Chapter 12: Secrets Management, Sensitive Data Masking & PKI
12.1 AWS Secrets Manager & Systems Manager Parameter Store 12.2 Sensitive Data Masking in Telemetry & Messaging 12.3 AWS Certificate Manager (ACM) & Private CA Architecture
14 Chapter 13: Storage Encryption, Integrity, Lifecycle & Backup Protection
13.1 S3 Encryption Modes & S3 Bucket Keys 13.2 Data Integrity Protection: Object Lock, Vault Lock & Code Signing 13.3 Secure Data Lifecycle, Cross-Account Replication & Backup Vault Lock 13.4 Lifecycle, Backup & Secure Replication Beyond S3: EFS, FSx, DLM, DataSync & Air-Gapped Vaults
15 Chapter 14: Multi-Account Architecture, Organizations & Control Tower Governance
14.1 AWS Organizations Structure, Hierarchy & Resource Control 14.2 AWS Control Tower Landing Zone & Guardrail Framework 14.3 Delegated Administrator Architecture & Root User Governance 14.4 Centralized Resource Sharing with RAM & Service Catalog
16 Chapter 15: Compliance Automation, Infrastructure as Code Security & Auditing
15.1 Infrastructure as Code Security & Multi-Account Deployment 15.2 AWS Config, Conformance Packs & Automated Remediation 15.3 Audit Evidence Collection & Well-Architected Security Reviews
13.4 Lifecycle, Backup & Secure Replication Beyond S3: EFS, FSx, DLM, DataSync & Air-Gapped Vaults
Key Takeaways Explain This Topic AI
EFS lifecycle policies transition files into Infrequent Access (console default 30 days), into Archive (default 90 days), and back to Standard on first access.
FSx for Lustre persistent file systems support automatic daily backups retained 0–90 days; scratch and S3-linked file systems can't be backed up.
Amazon Data Lifecycle Manager automates EBS snapshots and EBS-backed AMIs, including cross-Region copies and archiving; AWS Backup covers many services centrally.
Logically air-gapped vaults lock recovery points in compliance mode and can be shared through AWS RAM so a separate account can restore after a compromise.
AWS DataSync encrypts transfers with TLS, verifies data integrity, and can run through a VPC interface endpoint over Direct Connect or VPN.
Last updated: September 2026
13.4 Lifecycle, Backup & Secure Replication Beyond S3: EFS, FSx, DLM, DataSync & Air-Gapped Vaults
Skills 5.2.3 and 5.2.4 extend data lifecycle and backup design beyond Amazon S3. The exam guide names Amazon EFS lifecycle policies , Amazon FSx for Lustre backup policies , Amazon Data Lifecycle Manager , AWS Backup , ransomware protection , and AWS DataSync . Questions usually combine retention requirements, cost, and resilience against attackers who have gained administrative access.
Amazon EFS Lifecycle Management
EFS lifecycle policies move files between storage classes based on when they were last accessed:
Policy Common Setting Effect
Transition into Infrequent Access (IA) 30 days since last access (the console default) Moves cold files to lower-cost IA storage
Transition into Archive 90 days since last access (the console default) Moves rarely read files to the lowest-cost class; requires Elastic throughput
Transition into Standard On first access Moves a file back to Standard when it is read again
Security-relevant EFS settings sit alongside lifecycle: encryption at rest must be chosen when the file system is created, a file system policy can deny aws:SecureTransport false to require TLS mounts, and access points enforce a POSIX user and root directory for each application. EFS replication keeps a read-only replica in another Region or Availability Zone for disaster recovery, and new file systems created in the console have automatic backups turned on through AWS Backup.
Amazon FSx for Lustre Backups
FSx for Lustre is often used for high-performance workloads that process data from S3.
Automatic daily backups are available for persistent file systems, with a retention period of 0–90 days ; 0 turns automatic backups off.
User-initiated backups are kept until you delete them.
Backups are not supported for scratch file systems or for file systems linked to an S3 data repository, so for those the source data in S3 must be protected instead.
AWS Backup can manage FSx backups alongside other resources, including copies to other Regions and accounts.
Amazon Data Lifecycle Manager (DLM)
DLM automates EBS snapshots and EBS-backed AMIs using tag-targeted policies: schedules, count- or age-based retention, cross-Region copies (re-encrypted with a destination KMS key), cross-account sharing, fast snapshot restore, and moving older snapshots to the lower-cost archive tier. Choose DLM when requirements are EBS-specific; choose AWS Backup when one policy must cover many services.
AWS Backup for Centralized, Tamper-Resistant Backups
AWS Backup applies backup plans (schedule, lifecycle to cold storage, retention, and copy actions) to resources selected by tag or ID across EBS, EC2, RDS, Aurora, DynamoDB, EFS, FSx, S3, and more.
Backup vaults encrypt recovery points; for services that AWS Backup fully manages, the vault's KMS key encrypts the backup independently of the source.
Organization backup policies push plans to member accounts, and cross-account copy within the organization moves recovery points to a separate backup account.
AWS Backup Vault Lock in compliance mode makes recovery points immutable after the grace period (Section 13.3).
Legal holds keep specific recovery points beyond their normal retention for litigation or investigations.
Restore testing restores recovery points on a schedule and validates them, proving recoverability.
AWS Backup Audit Manager evaluates backup activity against frameworks (for example, "resources are protected by a backup plan with minimum retention") and produces reports.
Logically Air-Gapped Vaults
A logically air-gapped vault is a special vault type for ransomware recovery. Its recovery points are locked in compliance mode, so they can't be deleted before retention ends, and the vault can be shared through AWS RAM with other accounts, even accounts outside the organization, which can restore directly from it. If the owning account is compromised, a recovery account can still restore, and multi-party approval can provide a trusted team with access when normal credentials are lost.
Ransomware-Resilient Backup Architecture
- Control Purpose
- Dedicated backup account in a separate OU Attackers in workload accounts can't reach backup copies
- Cross-account and cross-Region copies Survive account compromise and Regional events
Vault Lock (compliance mode) or logically air-gapped vault Prevent deletion or shortened retention, even by root
- SCPs denying backup deletion and policy changes in workload accounts Stop tampering with local backup settings
- Customer managed KMS keys in the backup account Keep decryption under the backup team's control
- Restore testing and Backup Audit Manager Prove backups exist and can be restored
- AWS DataSync for Secure Transfer and Replication
DataSync moves data between on-premises storage (NFS, SMB, HDFS, object storage), other clouds, and AWS storage services (S3, EFS, and FSx).
Encryption in transit : All data is encrypted with TLS between the DataSync agent (or source) and AWS.
Integrity verification : Tasks can verify only the data transferred, verify all data at the destination, or skip verification; checksums confirm that what arrived matches the source.
Private connectivity : Agents can activate with and send data through a VPC interface endpoint for DataSync, keeping transfers on Direct Connect or VPN.
Least privilege : DataSync assumes an IAM role you provide to write to S3 destinations; scope it to the target bucket and prefix.
Auditability : Task reports and CloudWatch Logs record which files transferred, were skipped, or failed verification.
Specialty Exam Pitfalls
Expecting backups for FSx for Lustre scratch file systems : Scratch and S3-linked file systems don't support backups; protect the S3 data instead.
Backups in the same account as the workload : An attacker with administrator access can delete them. Copy to an isolated account and lock the vault.
Choosing DLM for multi-service requirements : DLM covers EBS snapshots and AMIs only.
Confusing lifecycle with retention locks : EFS and S3 lifecycle policies change storage class or expire data; they don't prevent deletion. Use Vault Lock or Object Lock for immutability.