Alibaba Cloud International Distribution OSS Cross-region Replication and Automatic Backup Policy Configuration
Data security is no small matter. In the enterprise-level cloud computing infrastructure architecture, disaster recovery and backup of storage services are not only a configuration item, but also the underlying red line of business continuity.
As the core storage system for unstructured data, Object Storage Service (OSS) is used to host massive images, videos, log files, database backup files, and critical application data. In the face of regional natural disasters, optical cable outages, network failures, or incidents such as accidental deletion and malicious blackmail in daily operation and maintenance, the lack of cross-regional disaster tolerance and efficient backup mechanisms often leads to irreversible business losses.
This article will deeply disassemble how to use Aliyun OSS from four dimensions: technical principles, architecture planning, actual combat configuration and best operation and maintenance practices.
Cross-Region Replication (CRR) and automated backup policies
Build a rock-solid data security net.
Core Risks and Protection System of 1. OSS Data Security
Before the specific configuration, you need to identify two core risk scenarios for data security:
Single-zone/single-region faults: For example, the data center encounters extreme conditions such as power outages, fires, and severe network outages. This type of scenario requires cross-region disaster recovery.
Alibaba Cloud International General Distribution
(Disaster Recovery) mechanism to ensure that copies of data are maintained at the geospatial level.
Human error and malicious damage: for example, operation and maintenance personnel mistakenly delete Bucket by ossutil rm -rf, malicious blackmail virus encrypts data, or program Bug covers key files. Such scenarios require multiple versioning (Versioning) and automatic lifecycle backup (Lifecycle Rule) mechanisms.
Alibaba Cloud OSS core security defense linkage architecture
-------------------------------------------------------------------
| Source Bucket (Source Region) |
|-Turn on multiple versioning (Versioning: Enabled) |
|-Enable retention policy/anti-tamper (WORM: Locked) |
-------------------------------------------------------------------
|
Cross-Region Replication (CRR) | Real-Time Asynchronous Link (TLS Encrypted Transport)
v
-------------------------------------------------------------------
| Target Bucket (remote disaster recovery region) |
|-Separate account/same account isolated in different places |
|-Set auto-archive/low-frequency storage lifecycle policy (backup cost optimization) |
-------------------------------------------------------------------
Deep Analysis and Configuration Practice of 2. Cross-Region Replication (CRR) Technology
Cross-region replication (Cross-Region Replication) is an asynchronous cross-region data replication function provided by OSS. When enabled, new, update, and delete operations in the source bucket are asynchronously synchronized to the target bucket in seconds or minutes.
1. Core technical characteristics and application scenarios of CRR
Compliance requirements: financial, medical, government and enterprise customers require that data must be kept at least 100 kilometers of physical copies in different places.
Remote disaster recovery: When force majeure occurs in the primary region, the business system can quickly switch data reading and writing to buckets in the secondary region.
Alibaba Cloud International Reseller
Extremely low latency access: The remote distributed business team directly reads the local bucket copy without requiring cross-border or cross-provincial data retrieval.
2. Preparation before CRR configuration
Before configuring CRR, the following conditions need to be met:
The source bucket and the target bucket are in different regions (for example, Hangzhou in China and Hangzhou in China and Beijing in China).
The versioning status of the source and target buckets is consistent. We recommend that you enable multi-versioning.
the operation account has the AliyunOSSFullAccess permission or the custom policy permission to configure oss:SetBucketReplication.
3. CRR Practical Configuration Steps
Step 1: Create a target bucket and activate multiple versions
Go to the Alibaba Cloud OSS console, in the disaster recovery area (such
cn-beijing
) Create a new bucket:
Name: company-data-backup-bj
Storage Type: Standard Storage or Low Frequency Access
Version Control: On
Step 2: Configure cross-region replication rules in the source bucket.
Enter the source bucket(
company-data-main-hz
) Management page:
In the left navigation pane, select Data Management -> Cross-Region Replication.
Click Enable cross-region replication.
Set the destination bucket: Select the prepared cross-region bucket (company-data-backup-bj).
Select Copy Object: All Objects: Suitable for full disaster recovery. Specify by prefix/label: Only specific directories (such as prod-db-backups/or user-assets/) are copied.
Set replication policy and permission: replication operation type: check "write operation (add/change)" and "historical data synchronization". Synchronize Delete Operation: it is recommended to select this option. If versioning is enabled, delete operations will only create DeleteMarkers and will not physically erase the data.
Encryption configuration: If SSE-KMS is enabled for the source bucket or server-side encryption is SSE-OSS, you must authorize ciphertext conversion and transmission during replication.
Step 3: Replication Status Monitoring and RTS (Real-Time Replication)
After data replication is enabled, the console displays the synchronization progress and latency metrics. If the business has high RTO (Recovery Time Objective) and RPO (Recovery Point Objective) requirements,
Alibaba Cloud International Reseller
Openable
RTS(Real-Time Replication Speed)
Real-time transmission is accelerated, ensuring that 99.99 percent of objects are synchronized remotely within seconds.
3. Multi-version control and automated lifecycle backup policies
Cross-region replication solves the remote disaster recovery problem caused by "physical failure", but if the source end accidentally deletes a key file, the replication mechanism will synchronize the deletion operation to the remote bucket. In order to cope
Logical Deletion and Data Tampering
, the double insurance of "multi-version control and lifecycle backup" must be introduced.
1. Multi-version control (Versioning) mechanism.
When multi-version control is enabled for a bucket:
An overwrite (PutObject) to an object does not overwrite the historical data, but generates a new Version ID.
The deletion (DeleteObject) of an object does not actually erase the data, but appends a DeleteMarker.
Only delete requests that explicitly specify VersionId can completely erase a particular historical version.
Enable multiple versions through Alibaba Cloud CLI / SDK
Bash
# Use the ossutil command-line tool to enable versioning
ossutil bucket
-versioning --method set oss://company-data-main-hz enabled
2. Automatic backup and cost optimization based on Lifecycle (lifecycle)
After multi-version is enabled, historical versions of full data continue to accumulate, resulting in a rapid increase in storage costs. By configuring the OSS lifecycle
Historical version conversion/deletion rules
, can achieve automated downgrade backup and elimination.
Life Cycle Rule Design Template (Golden Rule)
Rule Target
Data status
Time node
Action Configuration
Thermal Data
Current Version (Current Version)
30 days without access
Conversion to low-frequency access (IA) storage
cold data
Current Version (Current Version)
180 days not visited
Convert to Archive Storage (Archive)
Backup Retention
Version History (Noncurrent Version)
7 days later
Conversion to low-frequency access (IA) storage
Deep Backup
Version History (Noncurrent Version)
After 30 days
Convert to Archive Storage (Archive)
Automatic cleanup
Version History (Noncurrent Version)
365 days later
Completely deleted (after compliance retention period is met)
Clean up debris
Fragment Files (Multipart Upload)
7 days later
Automatically cancel unfinished fragments.
Console Configuration Lifecycle Policy Steps
Go to the Bucket page and click Data Management-> Lifecycle Management.
Click Create Rule.
The policy applies to all buckets or a specified prefix.
Check the configuration of historical version (Noncurrent Version): set the number of days to low-frequency access: 7 days, set the number of days to archive storage: 30 days, set the number of days to delete historical version: 365 days
Save rules, OSS system will automatically run scheduling tasks every day to clean the data corresponding to the conversion policy.
4. advanced protection: anti-tamper (WORM/retention policy) and compliance lock
When dealing with malicious ransomware threats or meeting high compliance requirements (such as financial audit, GDPR, HIPAA), ordinary backup policies still have the risk of being maliciously emptied by high-privilege accounts. Alibaba Cloud OSS support
WORM(Write Once, Read Many) Retention Policy
.
1. WORM mechanism analysis
After locking the bucket retention policy, before the end of the set protection period (for example, 5 years):
No user (including the RAM root account) can delete or overwrite objects and their historical versions.
After the retention policy is locked, it cannot be passed through the API.
Or the console is unsealed in advance to prevent blackmail software and internal personnel from deleting the library in violation of regulations.
2. Example of Configuring a WORM Policy
Bash
Alibaba Cloud International Reseller
# Configure a 730-day (2-year) non-deletable retention policy for the bucket
ossutil retention --method set oss://company-data-main-hz 730
# Lock policy (warning: irreversible after locking, cannot be released!)
ossutil retention --method lock oss://company-data-main-hz
checklist on best practices of 5. enterprise OSS backup architecture
In order to ensure the absolute reliability of the enterprise storage architecture, it is recommended to check and implement item by item according to the following operation and maintenance Checklist:
1. Account and permission isolation (minimum permission principle)
Disable the global oss:* permission of the RAM account.
It is recommended to enable cross-account replication (Cross-Account Replication) for the source and destination of cross-region replication. Even if the primary account is stolen, the attacker cannot access and tamper with the remote buckets in the backup account through the source permissions.
2. Transmission and disk encryption
Enable server-side encryption (SSE-KMS or SSE-OSS) to ensure that data is encrypted when the disk is stored at rest.
The bucket policy is configured globally, and all API calls must be transmitted over HTTPS.
3. Regularly rehearse the off-site recovery process
The ultimate meaning of backup is to restore. The operation and maintenance team should establish a quarterly disaster recovery drill mechanism: simulate that the bucket in the main region is blocked or connectivity is interrupted. Start the plan and modify the OSS Endpoint domain name in the application code to point to the remote backup bucket. Verify the integrity of the business’s read and write functions.
4. Log Auditing and Anomaly Alerts
Enable the OSS real-time log query feature (SLS Log Service).
Configure CloudMonitor (cloud monitoring) alarm: set threshold alarm for a large number of DeleteObject or DeleteMultipleObjects operations that occur in a short period of time, and catch abnormal deletion behavior at the first time.
Conclusion
In modern cloud-native architectures, the value of data security is much higher than that of computing resources. Alibaba Cloud OSS’s cross-region replication (CRR) addresses
The Problem of Remote Disaster Recovery in Spatial Dimension
, multi-version control and lifecycle management solve.
Version tracing across the time dimension and the cost-benefit trade-off
, and the WORM retention policy and cross-account isolation are built.
The last line of defense against blackmail and malicious destruction
.
Fully understand and flexibly configure these underlying protection mechanisms, and transform data security from "after-the-fact remediation" to "pre-defense".
The core cornerstone of the cloud business.
Alibaba Cloud International Reseller
