Technical Deep Dive

Air Gap Recover

Architecture, Security & Recovery — For Pre-Sales Architects & CTOs
ARCHITECTURE

Two-Organisation Air-Gap Architecture

SOURCE ORG

Customer Production

S3RDSAuroraEBSEFSGit
S3 CRR
Snapshot Sharing
EFS Replication
Lambda Archives

VAULT ORG

Isolated Recovery

Separate AWS OrgKMS Re-EncryptedS3 Object LockSCP Protected

Separate AWS Organizations

Not accounts — distinct IAM, billing, and trust boundaries

Zero Inbound Access

No trust relationships, no VPNs, no shared credentials

One-Way Replication

Vault receives copies but cannot access source

SNAPSHOT LIFECYCLE

Automated Snapshot Pipeline

01

Tag Discovery

Lambda scans for resources tagged DisasterRecovery:Protection=true. Self-service — customers control what gets protected.

EventBridge scheduled
02

Snapshot Creation

DLM creates automated snapshots at configurable intervals. EBS supports 1-60 min schedules. RDS automated daily + transaction logs.

DLM + Automated
03

Cross-Account Share

Source shares snapshot with vault account ID. One-way operation — vault cannot access source. EBS: unlimited accounts. RDS: 20 account limit.

ModifySnapshotAttribute
04

Copy & Re-Encrypt

Vault Lambda copies shared snapshot and re-encrypts with customer-specific vault KMS key. Independent copy — no source dependency.

Customer CMK
05

Immutable Retention

SCPs prevent snapshot deletion. S3 Object Lock compliance mode for object data. Configurable retention 7-365 days. Legal hold available.

WORM Enforced
EBS 1-60 min RPO
RDS / Aurora <5 min RPO
S3 <15 min RPO
ENCRYPTION

KMS Re-Encryption

Customer-managed envelope encryption with zero shared keys

01

Source Account

Data encrypted with customer-managed CMK

Never uses default aws/ebs or aws/rds keys
02

Key Policy Grant

Source CMK grants kms:Decrypt + kms:CreateGrant to vault account

Scoped to ec2/rds via kms:ViaService condition
03

Snapshot Share

Snapshot shared with vault account ID

Remains encrypted with source CMK
04

Vault Copy

Vault copies snapshot with its own CMK

Re-encrypted — source key no longer needed

Security Guarantees

  • Source and vault maintain completely separate KMS keys
  • Source key compromise does not affect vault copies
  • Automated key rotation under customer control
  • All key usage logged via CloudTrail
  • Meets HIPAA, GDPR, PCI-DSS encryption requirements
SERVICE COVERAGE

AWS Service Matrix

Service Protection Method RPO RTO Notes
S3 Cross-Region Replication <15 min <15 min All storage classes, version replication, RTC SLA-backed
RDS Automated Snapshots + Logs <5 min <30 min MySQL, PostgreSQL, MariaDB, Oracle, SQL Server
Aurora Cluster Snapshots + PITR <5 min <30 min Continuous S3 backup, backtrack for MySQL
EBS DLM Volume Snapshots 1-60 min <15 min Incremental, cross-region, archive tier available
EFS EFS Replication 15 min <30 min Continuous replication, transparent to applications
Git Lambda Archive Backup 1 hour <1 hour GitHub & Bitbucket, all branches/tags, incremental
RECOVERY

Recovery Procedures

1
5-10 min

Identify Scope

Determine affected services and blast radius. Select recovery point from available snapshots. Initiate recovery workflow.

2
15-30 min

Restore Snapshots

Terraform-driven parallel restoration. EBS volumes, RDS instances, S3 data restored from vault copies. Infrastructure recreated from IaC.

3
5-10 min

Decrypt & Validate

Snapshots decrypted with customer vault KMS keys. Data integrity checks run automatically. Application health validation.

4
5-10 min

Promote to Production

DNS cutover to recovered environment. Automated health checks pass. Clean room option: validate in isolated sandbox first.

<15 min Single Service
<60 min Critical Systems
<4 hours Full Environment
Optional quarantined sandbox recovery — scan for malware before production promotion
ZERO TRUST

Zero-Trust Security Model

Separate AWS Organisations

Not just accounts — distinct organisations with separate IAM, billing, SCPs, and trust boundaries. Attackers would need to compromise two entirely separate AWS environments.

Lambda-Based Execution

MSP triggers Lambda functions but cannot access data. Functions execute with customer IAM permissions. 15-minute temporary credentials auto-expire.

Tag-Based Discovery

Customers control protection via resource tags. No manual inventory needed. Self-service add/remove protection. Granular per-resource control.

Immutable Audit Trail

CloudTrail logs replicated to air-gapped account. S3 Object Lock prevents log tampering. All API calls recorded. Integration with SIEM platforms.

SCP SCPs deny s3:DeleteObject, rds:DeleteDBSnapshot, ec2:DeleteSnapshot — even root users cannot override
COMPLIANCE

Compliance Framework Mapping

How Air Gap Recover helps satisfy specific controls

ISO 27001:2022

  • A.8.13 Information Backup
  • A.8.14 Redundancy
  • A.5.30 ICT Readiness

Automated quarterly DR testing, immutable audit trails

NIST CSF v2.0

  • PR.IP-4 Backups
  • PR.DS-1 Data-at-Rest
  • RC.RP-1 Recovery Plan

Continuous backup, customer-managed encryption

DORA Art. 12 & 25

  • Art.12 Backup Policies
  • Art.25 Resilience Testing
  • Art.28 Third-Party Risk

15-min RPO, automated drills, zero-trust MSP model

SOC 2

  • CC6.1 Access Controls
  • CC7.2 Detection
  • A1.2 Availability

Org-level isolation, real-time monitoring, 99.99% SLA

HIPAA

  • §164.308 Data Backup
  • §164.312 Audit Controls
  • §164.312 Encryption

Immutable ePHI backups, CloudTrail logging, AES-256

GDPR Art. 32

  • Confidentiality
  • Integrity
  • Availability
  • Resilience

Customer KMS keys, Object Lock, multi-region, sub-60 min RTO

Automated Evidence

  • CloudTrail immutable audit logs
  • Quarterly DR test reports
  • Power BI compliance dashboards
  • Encryption key usage reports
  • Backup inventory & retention policies
10,000+ DR Drills
INFRASTRUCTURE

Infrastructure as Code

Terraform + Terragrunt

Complete infrastructure defined in code. Terragrunt for DRY multi-account configuration. Automated provisioning and decommissioning.

Tag-Based Discovery

agr:protect = true on any supported resource. Lambda auto-discovers tagged resources. No manual configuration required.

Policy Enforcement

SCPs enforced at organisation level. IAM policies generated from templates. Compliance guardrails via Control Tower.

Drift Detection

Terraform plan detects configuration drift. CloudFormation drift detection for AWS resources. Automated remediation workflows.

Repeatable deployments across environments
Version-controlled infrastructure changes
Automated security policy enforcement
Full audit trail of infrastructure changes
DEPLOYMENT

Deployment & Integration

Week 1-2

Foundation

  • Vault AWS Org provisioned
  • Control Tower guardrails configured
  • KMS keys generated
  • IAM roles & SCPs deployed
Week 3-4

Integration

  • Source account Lambda deployed
  • Replication rules configured
  • Tag-based discovery enabled
  • Initial full sync begins
Week 5-6

Validation

  • DR drill executed end-to-end
  • RTO/RPO targets validated
  • Monitoring & alerting configured
  • Runbooks delivered & tested

Databarracks Manages

  • Vault org setup & management
  • Lambda function deployment
  • Replication configuration
  • 24/7 monitoring & support
  • Quarterly DR drills

Customer Provides

  • AWS org access (read-only for Lambda)
  • KMS key policy grants
  • Resource tagging
  • DNS cutover during recovery

Prerequisites

AWS Organisation (source)Customer-managed KMS keysResource tagging strategyNetwork: AWS backbone only — no VPN or agents
SPECIFICATIONS

Technical Specifications

Uptime SLA 99.99% AWS-backed availability
RPO 15 min S3 CRR with Replication Time Control
RTO <60 min Critical systems, Terraform-driven
Scale PB+ Tested with 500TB+, 100M+ objects
Network AWS Only No VPN, no agents, no appliances
Encryption AES-256 Customer-managed KMS, key rotation

Performance Benchmarks

Replication Bandwidth Up to 10 Gbps per stream
Concurrent Jobs 1,000+ parallel replications
S3 Object Replication 99.99% within 15 min (SLA)
RDS Transaction Logs <5 min replication lag

Next Steps

1

Architecture Review

60-min deep dive into your AWS estate

  • Current DR gap analysis
  • Service coverage mapping
  • Integration requirements
2

Technical POC

1PB free, 1 month evaluation

  • Full vault org provisioned
  • End-to-end DR drill
  • RTO/RPO validation
3

Production Deployment

4-6 weeks to full protection

  • Phased service rollout
  • 24/7 monitoring
  • Quarterly DR drills

THANK YOU

1 / 12