Protect S3 buckets with AWS Backup

S3's famous 11-nines durability statistic is about disk hardware. It says the platform won't silently lose your data to a failed drive. It says nothing about what happens when an IAM key with delete permissions is compromised, or when a Lambda function running a cleanup job gets a regex wrong. Those aren't hardware failures — they're permission events, and they're fully covered by the durability guarantee because the deletion happened exactly as requested.

The cost picture for S3 data loss is almost always dominated by labour and liability, not recovery infrastructure. A bucket holding regulated customer data that gets wiped has a reconstruction cost measured in engineering weeks (if upstream sources even exist), a breach notification cost that starts at legal fees and ends with churn, and a potential regulatory fine that dwarfs both. AWS Backup for S3 runs roughly $0.05 per GB-month for backup storage. For a 1 TB business-critical bucket that's about $50 per month — pennies against the exposure.

COV-006 is flagging buckets where no second protection layer exists. Finance's job here isn't to mandate coverage everywhere — it's to ensure the spend on backup storage is allocated to the data that actually justifies it, and that buckets holding regulated or revenue-critical data are never left in the unprotected column because nobody got around to deciding.

Priya is the finance business partner on call for the data platform team. The month-end continuity report lands and 34 buckets are flagged as unprotected. Rather than escalate all 34 as a security emergency, she asks the tiering question first: how many of these buckets hold data that would cost the company real money to lose?

Working with the platform lead, she groups the 34 into four data classes. Twelve are ephemeral — build caches, CDN thumbs, transient logs. Sixteen are operational — team-internal reports and tooling artifacts that could be regenerated from source in a day. Five are business-critical — customer-facing static assets and financial exports. One is regulated: sevenc3-patient-exports, nightly de-identified data shared with research partners under a BAA.

Her cost model takes ten minutes. The regulated bucket is 240 GB and growing; at $0.05/GB-month for backup storage plus request charges, AWS Backup with a 35-day retention runs roughly $15–20 per month. CRR to a second account adds another $6 in replication transfer. Total: under $30/month. Versus the cost of a breach notification on a patient data bucket — legal fees alone start at $50,000. She approves the spend on the spot and documents the decision for the cost review: regulated and business-critical buckets carry explicit backup cost; the other 28 are single-layer by design with a recorded reason.

The unit economics of S3 backup are unusually favourable — the cost of not protecting a bucket is almost always orders of magnitude larger than the cost of protecting it. AWS Backup for S3 runs about $0.05 per GB-month of backup storage plus request charges per snapshot. A 500 GB regulated bucket protected with a 35-day backup plan costs roughly $25–35 per month all in. That is the full, predictable insurance premium.

On the other side of the ledger, a deletion incident against a regulated bucket has a cost floor that begins with breach counsel ($25,000–$100,000 to assess and notify), rises with regulator involvement (HIPAA penalties range from $100 to $50,000 per record per violation), and peaks with customer churn. For any bucket holding data subject to HIPAA, GDPR, or PCI DSS, the math tips decisively in one direction: backup spend is not a nice-to-have.

The finance lever is to make data class the input, not bucket count. Blanket coverage of all S3 buckets in an account is waste — build caches and ephemeral logs don't need $0.05/GB/month backup storage. But regulated and business-critical buckets must be covered, and the finance contribution is to make sure the protection cost for those buckets is a budget line, not a surprise — and that the absence of a budget line for a regulated bucket is itself flagged as a risk.

The right metric for cost reviews is not "total S3 backup spend" but "percentage of regulated and business-critical buckets with funded backup coverage." A hundred percent on that metric, with every uncovered bucket in a lower tier by documented decision, is the financially defensible posture.

Amazon S3 is marketed on durability — the platform almost never loses data to hardware failure. What it doesn't protect against is an authorized deletion. A compromised credential, a misconfigured automation, or a developer running the wrong script can empty a bucket in minutes, and S3's durability guarantee will confirm that every delete completed successfully. Versioning slows this down but doesn't stop it: attackers now routinely delete every version in a loop.

COV-006 surfaces which buckets have no second protection layer beyond versioning. The severity is LOW because not every bucket matters equally — build artifacts and log caches can be regenerated. The leadership risk is the buckets it surfaces that should not be in that column: patient data, financial records, customer-facing assets. Those need a deliberate decision — a named protection tier backed by policy — not a default of "nobody checked yet."

The governance question this control raises is whether data classification is driving protection decisions, or whether protection (and its absence) is happening by accident. Organizations that answer this well have a tier list — regulated, business-critical, operational, ephemeral — and a standing rule for each tier. COV-006 findings are the leading indicator that the tier list either doesn't exist or isn't being enforced.

At a health-tech company, the CISO came back from a tabletop exercise with one uncomfortable answer: when the facilitator asked "if someone deleted all the data in the patient-export bucket tonight, what's the recovery path?" the answer was "we'd have to reconstruct from upstream sources — maybe 2–3 weeks of engineering work." The bucket had versioning. Nobody had tested whether the deleted versions were recoverable.

The finding that surfaced the gap wasn't a critical-severity alert — it was a LOW-severity continuity finding that had sat unactioned for six weeks because the team assumed versioning was sufficient. The CISO's read was not that the security team had failed; it was that there was no policy connecting data classification to mandatory protection tiers. The bucket held regulated data and nobody had ever said that regulated data requires at minimum AWS Backup plus a second-account copy.

After putting that tier policy in writing, the resolution took one sprint: the regulated bucket got AWS Backup with Vault Lock and cross-region replication in the second account; five business-critical buckets got AWS Backup with 35-day retention; the rest were classified and documented. The governance outcome was a clear answer to the CISO's tabletop question — and a standing rule so the next bucket created in that class couldn't skip coverage by accident.

The organizational risk of an unprotected bucket containing regulated data is not primarily technical — it's liability. HIPAA, GDPR, SOC 2, and PCI DSS all require demonstrable data backup and recovery procedures. A patient-data bucket with no point-in-time recovery path fails that requirement the moment a regulator or auditor asks. The question isn't whether the engineering team knows how to fix it; it's whether the organization had a policy that required it in the first place.

COV-006 is a signal about process maturity, not just technical gap. When this finding surfaces on a bucket holding regulated data, the root cause is almost never "nobody knew how to enable backup." It's that data classification didn't drive a mandatory protection policy, or the policy existed but wasn't enforced as new buckets were created. Both are governance failures, and both are invisible until something goes wrong.

The executive framing is about the strength of the decision record. When an auditor or a post-incident reviewer asks "why wasn't this bucket backed up?", there should be one of two answers: "it was, here's the backup plan" or "it was explicitly classified as ephemeral and single-layer by design, with sign-off on that date." An unprotected regulated bucket that nobody classified and nobody approved is the answer that produces the fine.