Built on AWS Native Services

Air Gap Recover is a fully AWS-native disaster recovery solution that protects your critical infrastructure by replicating data to an isolated AWS organization. Unlike traditional backup solutions that rely on proprietary agents or third-party storage, we exclusively use native AWS services to ensure maximum reliability, security, and performance.

Why AWS Native?

• No additional attack surface: All data flows through AWS-managed APIs with AWS-native encryption
• Instant compatibility: Works with any AWS service that supports snapshots or replication
• Zero infrastructure overhead: No agents, gateways, or custom storage to manage
• AWS SLA guarantee: Backed by AWS's 99.99% uptime commitment

Air Gap Recover operates across two AWS Organizations: your Source Organization (production environment) and a separate Destination Organization (air-gapped vault).

Cross-Account Isolation

The destination organization is completely isolated from your production environment. Even if an attacker gains full access to your source organization, they cannot access or modify data in the vault organization without separate credentials and multi-factor authentication.

For S3 buckets, we leverage S3 Cross-Region Replication (CRR) with cross-account replication to continuously sync objects to your vault organization.

How S3 Cross-Region Replication Works

Replication Time Control (RTC)

S3 Replication Time Control provides a 15-minute SLA for object replication with a 99.99% guarantee. This feature includes:

Versioning and Delete Behavior

Encryption Handling

S3 replication supports multiple encryption methods with automatic re-encryption in the destination bucket:

Replication Rules and Filters

Fine-grained control over what gets replicated using flexible rule configurations:

• Prefix Filters: Replicate only objects matching path prefix (e.g., "production/", "backups/")
• Tag Filters: Replicate objects with specific tags (e.g., Environment=Production)
• Combined Filters: Use both prefix AND tag filters for precise selection (logical AND)
• Multiple Rules: Configure multiple replication rules per bucket with different destinations
• Two-Way Replication: Bi-directional replication supported between two buckets (requires conflict resolution)

Replication Metrics and Monitoring

Replication Workflow

Amazon EFS (Elastic File System) uses continuous replication to protect NFS file systems, providing cross-region disaster recovery for shared file storage workloads.

How EFS Replication Works

Recovery Point Objective (RPO)

The 15-minute RPO means that in a disaster scenario, you could lose up to 15 minutes of file changes. For most shared file system workloads (home directories, shared application data, media files), this is acceptable. For databases or critical transactional data, use RDS/EBS snapshots instead.

Encryption and Security

Replication Configuration

Failover and Recovery

Cost Considerations

• Destination Storage: Same per-GB pricing as source region (Standard or One Zone)
• Data Transfer: Cross-region data transfer charges apply (typically $0.02/GB)
• Replication Overhead: No additional replication service charges (only storage + transfer)
• Lifecycle Policies: Use Infrequent Access (IA) storage class on destination for cost savings

For databases and block storage, we use AWS-native snapshot capabilities to create point-in-time backups and share them cross-account to your vault organization. Unlike continuous replication, snapshots capture a consistent state at a specific moment in time.

How EBS Snapshots Work

Crash-Consistent vs Application-Consistent Snapshots

For databases running on EBS volumes, application-consistent snapshots require coordination with the database engine to flush buffers and achieve a clean state before snapshot creation. For RDS databases, AWS handles this automatically.

EBS Snapshot Storage and Cross-Region Copying

How RDS Snapshots Work

Multi-AZ Snapshot Behavior

For production databases, Multi-AZ deployment is strongly recommended not only for high availability but also to eliminate snapshot performance impact. Automated backups and manual snapshots are taken from the standby replica without affecting primary workload.

Point-in-Time Recovery (PITR)

RDS Snapshot Lifecycle and Retention

Encrypted Snapshot Handling

RDS Performance Impact Summary

Supported Database Services

Cross-Account Snapshot Workflow

EBS and RDS snapshots can be shared across AWS accounts to provide true air-gap protection. Unlike S3 replication which operates continuously, snapshots are point-in-time copies that are shared and copied to your vault organization.

EBS Snapshot Sharing

Amazon EBS snapshots support unlimited cross-account sharing with powerful features for enterprise disaster recovery.

RDS Snapshot Sharing

Amazon RDS snapshots have different constraints compared to EBS, requiring careful architecture for cross-account protection.

Customer-Managed Encryption

Both EBS and RDS snapshots support customer-managed KMS keys, providing encryption sovereignty critical for regulatory compliance.

Encrypted Snapshot Sharing Requirements

When sharing encrypted snapshots, specific KMS key permissions are required. Air Gap Recover handles this automatically.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowVaultAccountToUseKey",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::VAULT-ACCOUNT-ID:root"
      },
      "Action": [
        "kms:DescribeKey",
        "kms:CreateGrant"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "kms:ViaService": [
            "ec2.us-east-1.amazonaws.com",
            "rds.us-east-1.amazonaws.com"
          ]
        }
      }
    }
  ]
}

Example KMS key policy for encrypted snapshot sharing (source account)

Security Benefits of Snapshot Sharing

Automation with Data Lifecycle Manager

For EBS volumes, AWS Data Lifecycle Manager (DLM) provides enterprise-grade automation for snapshot creation and cross-account sharing.

• Tag-Based Selection: Automatically create snapshots for volumes tagged with DisasterRecovery:Protection=true
• Flexible Schedules: Hourly, daily, weekly, or monthly snapshot creation
• Automatic Sharing: Share snapshots with vault account automatically upon creation
• Retention Management: Automatically delete old snapshots after retention period
• Cross-Region Copy: Replicate snapshots to multiple regions simultaneously
• Fast Snapshot Restore: Pre-warm snapshots for instant volume creation

Recovery Scenarios

The vault organization is secured using AWS Control Tower, Service Control Policies (SCPs), and strict IAM policies to ensure data cannot be tampered with or deleted.

AWS Control Tower

Your vault organization is governed by AWS Control Tower, which provides:

Service Control Policies (SCPs)

SCPs enforce organization-wide restrictions that cannot be overridden, even by the account root user:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": [
        "s3:DeleteObject",
        "s3:DeleteObjectVersion",
        "s3:PutLifecycleConfiguration"
      ],
      "Resource": "arn:aws:s3:::vault-*/*",
      "Condition": {
        "StringNotEquals": {
          "aws:PrincipalOrgID": "o-vaultorgid"
        }
      }
    },
    {
      "Effect": "Deny",
      "Action": [
        "rds:DeleteDBSnapshot",
        "rds:DeleteDBClusterSnapshot",
        "ec2:DeleteSnapshot"
      ],
      "Resource": "*"
    }
  ]
}

Example SCP preventing deletion of vault objects and snapshots

Encryption Architecture

Access Controls

Access to the vault organization requires:

• Separate AWS Account: Vault organization has no trust relationship with source organization
• MFA Enforcement: All human access requires hardware MFA (U2F or TOTP)
• IP Allowlisting: API access restricted to known corporate IP ranges
• CloudTrail Monitoring: All API calls logged and monitored for anomalies

Air Gap Recover exclusively uses AWS-managed services. Here's the complete list of AWS services that power the solution: