Immutable Backups in Google Cloud Storage with Arq
Arq 7 now includes support for Google Cloud Storage’s “object retention lock” API. If you use Arq to back up to Google Cloud Storage, Arq can make your backups immutable for a period of time that you choose. This provides extra protection against accidental deletion and malware/ransomware.
It’s very easy to set up.
First, in the Google Cloud Console, create a new bucket with both Object Retention (set to “Unlocked”) and Object Versioning enabled. Both settings are required.
Next, pick “New Storage Location” from Arq’s File menu, choose the Google Cloud Storage option, and follow the prompts to select the bucket you created.
Next, pick “New Backup Plan” from Arq’s File menu, choose the storage location you just created, and follow the prompts to create your backup plan.
Finally, edit your backup plan’s immutability options:
That’s it! Arq will add/extend a “compliance mode” lock to every object needed by the latest backup record to ensure it’s immutable for the number of days you chose.
Note: Arq stores data in de-duplicated form. Each new backup record points to the same data as the previous backup record except for new/modified/deleted items. Arq needs to refresh the object locks as de-duplicated objects age, so if you change the schedule, make sure Arq is still backing up often enough to maintain/extend those object locks. More about Arq and object lock is in the Arq 7 help.
Note:
If an attacker gains access to your Google Cloud account, they could delete the entire storage account or bucket itself. To protect against this, make sure you secure your Google Cloud account with a strong password and multi-factor authentication.