Ransomware now targets entire cloud estates. In AWS, an attacker with stolen credentials often needs no malware: ordinary API calls can delete snapshots, disable logging or destroy data. Properly configured native services reduce that risk significantly.

ENISA’s Threat Landscape 2025 identifies ransomware as “the most impactful threat in the EU” and names phishing (60%) and vulnerability exploitation (21.3%) as the two leading intrusion access points. The controls below address those entry points and map well to the NIST Cybersecurity Framework functions.

Understanding the ransomware threat in cloud environments

Ransomware attacks on cloud infrastructure typically combine several vectors:

• Credential compromise via phishing, leaked access keys or exploited applications
• Lateral movement through overly permissive roles and poorly segmented networks
• Data encryption or destruction of databases, file systems, snapshots and backups
• Service disruption by modifying or deleting critical resources, often after exfiltrating data

AWS native tools for ransomware protection

1. Identity and access management: your first line of defense

• Use AWS IAM Identity Center with federation and temporary credentials instead of long-term access keys.
• Require MFA everywhere, phishing-resistant for privileged roles. AWS has enforced root user MFA across all account types since June 2025; centralized root access management can remove member-account root credentials.
• Apply least privilege, using IAM Access Analyzer to find unused and external access.
• Use service control policies (SCPs) to deny destructive actions on backup, logging and security services to all but a break-glass role (SCPs don’t apply to the management account).
• Use resource control policies (RCPs) to block outside principals from resources such as S3 buckets and KMS keys.

Example SCP protecting recovery and detection controls:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ProtectRecoveryAndDetection",
      "Effect": "Deny",
      "Action": [
        "backup:DeleteBackupVault",
        "backup:DeleteBackupVaultLockConfiguration",
        "backup:DeleteRecoveryPoint",
        "backup:PutBackupVaultAccessPolicy",
        "backup:UpdateRecoveryPointLifecycle",
        "cloudtrail:DeleteTrail",
        "cloudtrail:StopLogging",
        "guardduty:DeleteDetector",
        "logs:DeleteLogGroup"
      ],
      "Resource": "*",
      "Condition": {
        "ArnNotLike": {
          "aws:PrincipalArn": "arn:aws:iam::*:role/BreakGlassSecurityAdmin"
        }
      }
    }
  ]
}

2. AWS CloudTrail: activity monitoring

• Create an organization trail for all Regions and accounts, delivered to a log archive account.
• Enable CloudTrail Insights for unusual API activity.
• Alert with EventBridge rules or CloudWatch alarms.
• Store logs in S3 with Object Lock and log file integrity validation.

Critical events to monitor:

• Rapid deletion of many snapshots, objects or other resources
• Privilege escalation attempts
• Access from unfamiliar locations or IP addresses
• Unusual AWS KMS activity, such as key policy changes or scheduled key deletion
• Backup deletion attempts and attempts to stop CloudTrail or GuardDuty

3. Amazon GuardDuty: threat detection

GuardDuty applies threat intelligence and machine learning to CloudTrail, VPC flow log and DNS data. Ransomware-relevant capabilities:

• Extended Threat Detection for multi-stage attacks, enabled automatically at no additional cost
• S3 Protection for data exfiltration and destruction attempts
• Malware Protection for EC2 (EBS volume scans), for S3 (new uploads) and, since November 2025, for AWS Backup, which also helps find the last clean backup
• Findings for command-and-control traffic, cryptocurrency mining and compromised instances

Enable it in all Regions and accounts, use suppression rules to reduce false positives, and route findings to Lambda for automated response and to Security Hub.

4. AWS Config: configuration compliance

Managed rules worth enabling:

• encrypted-volumes: EBS volumes are encrypted
• s3-bucket-versioning-enabled and s3-bucket-default-lock-enabled: buckets keep versions and use Object Lock
• backup-recovery-point-encrypted: recovery points are encrypted
• backup-recovery-point-manual-deletion-disabled: recovery points can’t be deleted manually
• iam-policy-no-statements-with-admin-access: no overly broad customer-managed policies

5. AWS Backup: ransomware-resilient data protection

• AWS Backup Vault Lock: in compliance mode, once the grace time (at least 3 days) ends, no user and not even AWS can change or delete the vault and its lock.
• Logically air-gapped vaults: always compliance-locked, shareable through AWS RAM with a recovery account, with multi-party approval if the owning account is lost.
• Cross-Region and cross-account copies, backup policies in AWS Organizations and restore testing
• Point-in-time recovery for supported services

Example backup plan (CloudFormation) copying to a logically air-gapped vault:

RansomwareBackupPlan:
  Type: AWS::Backup::BackupPlan
  Properties:
    BackupPlan:
      BackupPlanName: RansomwareProtection
      BackupPlanRule:
        - RuleName: DailyBackups
          TargetBackupVault: SecureVault
          ScheduleExpression: "cron(0 2 ? * * *)"
          Lifecycle:
            MoveToColdStorageAfterDays: 30
            DeleteAfterDays: 365
          CopyActions:
            - DestinationBackupVaultArn: arn:aws:backup:eu-west-1:111122223333:backup-vault:AirGappedVault
              Lifecycle:
                DeleteAfterDays: 35

Then lock the primary vault. Check the retention values first, because they become permanent:

aws backup put-backup-vault-lock-configuration \
  --backup-vault-name SecureVault \
  --changeable-for-days 3 \
  --min-retention-days 7 \
  --max-retention-days 400

6. Amazon S3: secure data storage

S3 Object Lock (requires versioning):

• Compliance mode: no user, including the root user, can overwrite or delete a protected version during retention
• Governance mode: users with s3:BypassGovernanceRetention can override retention, so restrict that permission
• Legal holds for investigations, with no fixed end date

Versioning and MFA delete: enable versioning. Only the root user can enable MFA delete, so Object Lock is usually more practical.

Cross-Region replication: replicate critical data to another Region and a separate account.

7. AWS Systems Manager and Amazon Inspector: patching and response

• Amazon Inspector continuously scans EC2 instances, ECR images and Lambda functions for vulnerabilities
• Patch Manager for automated security updates
• Session Manager for shell access without inbound ports or SSH keys
• Run Command and Automation for remediation across instances
• Parameter Store for secure configuration management

8. Amazon Macie: data classification

Macie discovers sensitive data in S3 and flags bucket security and access issues, such as a bucket becoming public. It doesn’t detect anomalous access or exfiltration; that is GuardDuty S3 Protection. Use Macie’s inventory to prioritize Object Lock and backup for regulated data and to speed up breach impact assessment under the GDPR.

Building a ransomware protection architecture

Detection and alerting pipeline

1. Real-time monitoring: CloudTrail, CloudWatch and GuardDuty
2. Centralized analysis: AWS Security Hub (generally available since December 2025) correlates GuardDuty, Inspector, Macie and Security Hub CSPM findings into prioritized exposures. Security Hub CSPM, the former Security Hub, runs posture checks such as the CIS AWS Foundations Benchmark.
3. Automated response: EventBridge rules triggering Lambda or Systems Manager Automation
4. Human review: SNS notifications for critical alerts

Backup strategy

Tier 1: frequent local backups. Daily AWS Backup jobs, EBS snapshot lifecycles and RDS automated backups with point-in-time recovery.

Tier 2: cross-account and cross-Region copies. A separate backup account and a second Region.

Tier 3: immutable long-term retention. Logically air-gapped or compliance-locked vaults, and S3 Glacier with Object Lock for archives. This is the AWS-native answer to CISA’s advice to keep offline, encrypted backups and test them.

Network security controls

• Private subnets for sensitive resources, network ACLs and VPC Flow Logs
• Egress filtering with AWS Network Firewall to hinder command-and-control and exfiltration
• AWS WAF for applications and AWS Shield Advanced for DDoS protection

Incident response and recovery

Automated response playbooks

A Lambda function invoked by an EventBridge rule for GuardDuty findings can isolate an instance and preserve evidence:

import boto3

ec2 = boto3.client("ec2")
ISOLATION_SG = "sg-0123456789abcdef0"  # no inbound or outbound rules


def lambda_handler(event, context):
    finding = event["detail"]
    if finding["resource"]["resourceType"] != "Instance":
        return {"status": "skipped"}
    instance_id = finding["resource"]["instanceDetails"]["instanceId"]

    # Isolate the instance
    ec2.modify_instance_attribute(InstanceId=instance_id, Groups=[ISOLATION_SG])

    # Create forensic snapshots of attached volumes
    instance = ec2.describe_instances(InstanceIds=[instance_id])["Reservations"][0]["Instances"][0]
    for mapping in instance.get("BlockDeviceMappings", []):
        ec2.create_snapshot(
            VolumeId=mapping["Ebs"]["VolumeId"],
            Description=f"Forensic snapshot - {instance_id}",
        )
    return {"statusCode": 200, "body": "Instance isolated and snapshots created"}

Tracked connections can survive security group changes until they time out, so add a network ACL deny when sessions must be cut immediately.

Phase 1: Assessment and containment

1. Use GuardDuty, Security Hub and CloudTrail to understand the scope.
2. Isolate affected resources, deactivate compromised keys and revoke active role sessions.
3. Preserve evidence with EBS snapshots and CloudTrail logs.
4. Start regulatory reporting: a NIS2 early warning is due within 24 hours of becoming aware of a significant incident, and financial entities follow DORA major incident reporting.

Phase 2: Recovery

1. Identify the last clean backup, using GuardDuty malware scan results where available.
2. Restore from cross-account or air-gapped vaults into a clean recovery account.
3. Rebuild infrastructure from code (CloudFormation or CDK).

Phase 3: Validation and monitoring

1. Verify data integrity after restoration.
2. Add monitoring for the observed attack techniques.
3. Fix the root cause and tighten guardrails to prevent recurrence.

Cost optimization

• Move long-retention recovery points to cold storage where supported, and use S3 lifecycle policies for archives.
• Tag resources by criticality and assign backup plans by tag, so only tier-1 systems get the most expensive protection.
• Track protection spending with AWS Cost Explorer.

Monitoring and metrics

• Mean time to detect (MTTD) and finding resolution times
• Backup success and restore test results against recovery time objectives (RTO)
• Share of critical resources in locked vaults
• Compliance scores, false positive rates and backup storage costs

Conclusion

Ransomware protection in AWS comes down to three things: make stolen credentials less useful, detect attacks early, and keep recovery points that even an attacker with administrator access cannot delete, using Vault Lock, logically air-gapped vaults and Object Lock.

Start with a readiness review against the AWS Well-Architected Security Pillar, protect critical workloads first, and run restore tests and incident response exercises before you need them.

Sources

• ETL 2025: EU consistently targeted by diverse yet convergent threat groups – ENISA
• #StopRansomware Guide – CISA
• AWS Backup Vault Lock – AWS
• Logically air-gapped vault – AWS
• What is Amazon GuardDuty? – AWS
• AWS Security Hub now generally available – AWS News Blog
• Locking objects with Object Lock – AWS
• Amazon EC2 security group connection tracking – AWS

Last reviewed: October 2026.