Forest Recovery: Add backup locations

This article describes how to add Backup Locations in Cayosoft Guardian.

Backup Locations are network file shares, Azure blob storages, or Amazon S3 storage where the backup files can be created and managed by Cayosoft Guardian. DC Backups are registered backup files that are located in Backup Locations.

Add a backup location

Network storage that supports SMB (Server Message Block) protocol version 3.0 (or higher), Amazon S3, and Azure blob storages can be added as Backup Locations in Cayosoft Guardian.

1. Open the Cayosoft Guardian web portal.
2. Expand the Forest Recovery node.
3. Select the Backup Locations node.

4. Expand the Add drop-down and select a backup locations type:

   • Network share
   • Azure Blob Storage
   • Amazon S3.

   

5. Complete the below fields depending on the backup location type.
6. Click Add to add a new backup location.

Network share

Azure Blob storage

Amazon S3 storage

How immutable storage works

The Make storage immutable option protects backup data from modification or deletion by leveraging native cloud provider immutability mechanisms. When enabled, backup files written to the storage cannot be altered or removed until the specified retention period expires. This provides ransomware protection and safeguards against accidental or malicious data loss.

Azure Blob Storage — Time-based immutability policies

When you enable immutable storage for Azure Blob Storage, Cayosoft Guardian performs the following steps:

1. Creates or reuses a storage account. New storage accounts are created with hardened security settings: TLS 1.2 minimum, public blob access disabled, shared key access disabled, HTTPS-only traffic, Standard LRS redundancy, and StorageV2 account type.

2. Creates a blob container. A new blob container is created with public access set to None and tagged with metadata identifying it as a Cayosoft Guardian Backup Location.

3. Applies a time-based immutability policy. After the container is created, Cayosoft Guardian applies a time-based immutability policy to the container. This policy specifies the ImmutabilityPeriodSinceCreationInDays value equal to the user-specified Retention period (days). Azure counts the retention period from each blob's creation time.

4. Enforces WORM protection. Once the immutability policy is active, blobs written to the container cannot be modified or deleted until their individual retention period (measured from the blob's creation time) expires. This is Azure's native Write Once, Read Many (WORM) storage mechanism applied at the container level.

5. Propagates settings to backup agents. The isImmutable and retentionPeriodInDays properties are stored in the Cayosoft Guardian data model and are passed to backup agents during backup plan execution, ensuring consistent enforcement.

Validation on existing containers: If the specified blob container already exists, Cayosoft Guardian validates that the container's immutability settings are consistent with the requested configuration. Errors are raised if the container lacks an immutability policy when one is requested, if the existing retention period differs from the requested value, or if the container has an immutability policy when non-immutable storage is requested.

Amazon S3 — Object Lock (Compliance mode)

When you enable immutable storage for Amazon S3, Cayosoft Guardian performs the following steps:

1. Creates an S3 bucket with Object Lock enabled. The bucket is created with ObjectLockEnabledForBucket set to true. This is required at bucket creation time — Object Lock cannot be added to an existing bucket that was created without it.

2. Enables bucket versioning. Versioning is a prerequisite for S3 Object Lock and is enabled automatically.

3. Configures Object Lock. An Object Lock configuration is applied to the bucket.

4. Sets per-object retention on upload. When individual backup files are uploaded, each object is tagged with Compliance mode retention and a RetainUntilDate calculated as the current time plus the specified Retention period (days). In Compliance mode, no user — including the AWS root account — can delete or overwrite the object before the retention date expires.

5. Propagates settings to backup agents. The isImmutable flag and retentionPeriodInDays value are passed to backup agents. The agent creates an S3 storage client with WORM options (ObjectLockMode = Compliance) so that every backup file uploaded is individually protected.

Validation on existing buckets: If using an existing bucket, Cayosoft Guardian verifies that both versioning and Object Lock are properly enabled. If immutable storage is requested but the bucket lacks Object Lock, or if immutable storage is not requested but the bucket has Object Lock, an error is will be thrown.

Key differences between Azure and AWS immutability

How to add/delete credentials

To edit the credentials:

1. Open the Cayosoft Guardian web portal.
2. Expand the Forest Recovery node.
3. Select the Backup Locations node.
4. Select the storage and click Properties.
5. On the General tab, click Edit.
6. Click Add + and select the credentials to be added.

For Token credential, specify:

• Account name — the account name for which the credential is being configured.
• Refresh token — the refresh token associated with the account.
• Type — the type of token credentials.

For Password credential, specify:

• Account name — the account name for which the credential is being configured.
• Password — the password associated with the account.
• Type — the type of password credentials.

To delete the credentials:

1. Expand the Forest Recovery node.
2. Select the Backup Locations node.
3. Select the storage and click Properties.
4. On the General tab, click Edit.
5. Click the vertical kebab icon and click Delete.
6. Confirm the deletion.