Immutability
Zerto allows you to preserve the Retention sets as unchangeable by keeping them as immutable, so they cannot be modified after creation. This protects from ransomware and malicious actors trying to delete or change the Extended Journal data residing within the Repository.
When enabled, Full Retention sets on the Repository will not be eligible for deletion nor modification until expiry per Retention policy, or for a user-defined period.
As such, these Retention sets are not eligible for deletion prior to the immutability expiry.
The Immutability feature is available for the following Repository types:
| • | Amazon S3 |
| • | Microsoft Azure |
| • | S3-Compatible Storage |
The Immutability feature is based on two capabilities of the cloud storage service:
| • | S3 Bucket versioning (storing multiple variants of an object). |
| • | S3 Object lock (storing objects using a write-once-read-many (WORM) model), using Compliance Retention mode. |
The immutability setting is defined at the Repository level and can be defined based on the VPG retention policy, or for a user-defined period. The default setting is to keep the data as immutable for 30 days.
Immutability setting adjustments are recorded in the Audit log for compliance purposes.
Only Full Retention sets can be set as immutable. The immutability will be set during the Retention process based on the current Repository immutability settings and protected ZVM time.
In the Restore wizard and the Manage Retention Sets wizard, immutable Repositories are marked with a lock (
).
Prerequisites
See Creating a Repository for Retention - Repository Prerequisites.
Enabling Immutability
To enable Immutability for a Repository:
| 1. | In the New Repository or Edit Repository window, select the "Make all following Retention sets immutable" checkbox. |
This checkbox is available only for eligible Repositories.
Note: In case the S3 Bucket versioning and/or S3 Object lock are disabled at the S3 Bucket level, the immutability configuration will not be set.
| 2. | Select Per VPG Retention Policy to make the Retention sets immutable until their expiry, as defined in the VPG Retention policy. |
Select For (duration) Days to determine a specific period for which the Retention Sets to be immutable. The default is 30.
Note: In case the period is longer than the planned expiry by VPG Retention Policy, the minimum will be applied.
| 3. | Click Save. |
Immutability will be set for all future Retention sets in this Repository.
Changing Immutability Settings or Disabling Immutability
You can change immutability settings for all subsequent Retention sets in a Repository, or disable Immutability, in the Edit Repository window. See Editing an Existing Repository for Retention.