Cyber resilience on AWS: A reference approach for recovery from ransomware and destructive events

This article presents a comprehensive reference architecture for cyber resilience on AWS, focusing on recovery from ransomware and destructive events.

• Cyber resilience requires isolating recovery from production using separate AWS accounts
• Recovery Account owns logically air-gapped vault with deletion protection and Multi-party approval
• Isolated Recovery Environment (IRE) has no trust relationship or network path to production
• Validation pipeline combines malware scanning, workload checks, and log review before restore
• Select recovery points predating the compromise boundary, not necessarily the most recent backup
• Five-stage recovery workflow: timeline establishment, validation, approval, rebuild/restore, cutover
• Rebuild-Restore-Rotate framework: infrastructure from code, data from backup, credentials new
• AWS Backup Restore Testing and GuardDuty Malware Protection provide automated validation
• Multi-party approval records restore authorization as CloudTrail management events

The article provides a structured approach to cyber recovery that assumes production environment, backups, or recovery paths may be compromised, emphasizing isolation, validation, and credential rotation.