Backup and Restore Service · View 24 of 26 · 7 · Assurance
Decisions
- Four STS roles on custody with disjoint rights. Capture: put and get, no delete, no retention change. Custody admin: lock configuration, no object read. Restore: get and extend retention. Verify: get only, and only from the enclave's proxy address.
- The enclave holds full copies of production data every day and is the least watched environment in the estate. It has no route to production networks, production credentials or the internet. It reads custody through a single read-only proxy, and its restored data is destroyed when the rehearsal ends.
- Source credentials are short-lived. OpenBao's database engine issues per-run PostgreSQL and MySQL users, and capture agents authenticate with SPIRE JWT-SVIDs. No long-lived source password exists in the platform.
Threat model
- The platform's own operators are in scope. No single person or component can shorten a lock or delete a locked copy (view 25).
- A Ceph cluster administrator can bypass Object Lock at the RADOS layer. Object Lock protects against S3 callers, not against storage root. That is why custody root access is itself two-person and why custody B and tape exist as separately administered copies.
Assumptions
- SPIRE is trusted as the issuer for capture and restore roles. A compromised SPIRE can mint a capture identity, which can write but never delete. That limit on the damage is written down, not assumed.
