Ransomware doesn't just encrypt your local files - it often targets backup destinations too. If your NAS backup to the cloud uses credentials stored on the NAS itself, ransomware that compromises your NAS can use those same credentials to delete or encrypt your cloud backup. In Compliance mode, protected object versions cannot be deleted or overwritten during retention, even by the account root user. Governance mode can be bypassed by a principal with the required permission, and Object Lock does not prevent new versions or delete markers from being created.
In short: Immutable backups use S3 Object Lock (or vendor equivalents) to prevent deletion or modification of backup data for a set retention period. They add genuine ransomware protection beyond standard cloud backup. The main cost is slightly higher storage fees (no deletion = no cleanup) and added configuration complexity. For home users with irreplaceable data and any cloud backup already running, it is worth setting up. For business users with ransomware exposure, it should be standard practice.
What Makes a Backup Immutable
Standard cloud backup is mutable: the backup application has credentials that allow it to write, overwrite, and delete objects in the cloud storage bucket. Ransomware that gains access to the NAS can use those same stored credentials to connect to the cloud provider and delete the backup, defeating the entire purpose of offsite storage.
S3 Object Lock is an AWS-originated standard that changes this relationship at the storage layer. In Compliance mode, the protected object version cannot be deleted or overwritten during retention, including by the account root user. Governance mode can be bypassed by a principal with the required permission, and new versions or delete markers may still be created. The lock is enforced by the storage provider, not by the client application.
There are two Object Lock modes:
- Compliance mode: The object cannot be deleted or modified by anyone, including the account owner, for the retention period. Compliance mode is intended for retention requirements where even privileged users must be unable to shorten or bypass the lock; applicable regulatory requirements depend on the jurisdiction and records involved.
- Governance mode: The object cannot be deleted or modified by standard users, but privileged users with a specific IAM permission can override the lock. Slightly more flexible, but still provides strong protection against ransomware.
For home users, Governance mode is sufficient and slightly easier to manage if a genuine deletion is needed.
Which Cloud Providers Support Object Lock
S3 Object Lock was introduced by AWS S3 and has since been implemented by several S3-compatible providers. Support varies by provider and pricing tier:
Object Lock Support by Cloud Provider
| Backblaze B2 | Wasabi | Cloudflare R2 | AWS S3 | |
|---|---|---|---|---|
| Object Lock supported | Yes | Yes | No S3 Object Lock API; removable R2 Bucket Locks available | Yes |
| Lock modes | Compliance + Governance | Compliance + Governance | Not applicable; R2 Bucket Locks are a separate feature | Compliance + Governance |
| Storage cost (approx) | USD $6.95/TB/mo | USD $7.99/TB/mo, with a 1TB monthly minimum on Pay-as-You-Go | USD $15/TB/mo | Region-dependent; Sydney S3 Standard is USD $0.025/GB-month for the first 50TB |
| Egress fees | Free up to 3× average monthly storage; then USD $0.01/GB unless a qualifying partner route applies | Not included | Not included | Yes; region-dependent, tiered data-transfer-out charges apply after AWS's shared monthly free allowance |
| AU infrastructure | No (US/EU) | No (US/EU) | Oceania location hint available; best effort, not an Australian residency guarantee | Sydney region |
| NAS app support | Hyper Backup, HBS3 | Hyper Backup, HBS3 | Limited | Hyper Backup, HBS3 |
For Australian NAS users, Backblaze B2 and Wasabi are the two practical choices. Both provide S3-compatible storage and both integrate as destinations with Hyper Backup and HBS3. QNAP documents HBS3-managed Object Lock for both providers. Backblaze includes egress up to three times average monthly storage, while Wasabi's no-charge egress is subject to its usage policy. AWS S3 is technically capable but costs 3-4x more per GB stored and adds significant egress fees for large restores. Cloudflare R2 does not implement the S3 Object Lock API. It offers a separate, administratively removable Bucket Locks feature, so S3 backup applications should not be assumed to support it as Object Lock.
NAS Application Support for Immutable Backups
Synology Hyper Backup
Synology Hyper Backup supports S3-compatible destinations including Backblaze B2 and Wasabi. Its documented task settings do not include a task-level S3 Object Lock retention control, so storage-side immutability must not be assumed compatible without vendor confirmation and testing. Do not assume Hyper Backup rotation is Object Lock-aware. Test backup, rotation, relinking and restoration with the chosen provider before relying on a storage-side retention configuration.
QNAP HBS3 (Hybrid Backup Sync)
QNAP HBS3 supports S3 Object Lock for compatible destinations. Configuration is similar to Hyper Backup - set the retention period in the job settings and ensure the destination bucket has Object Lock enabled. QNAP's implementation works with Backblaze B2 and Wasabi. Check the HBS3 release notes for the version that introduced Object Lock support before configuring.
Setting Up Object Lock: Configuration Steps
The requirement varies by provider: Wasabi requires Object Lock to be enabled when the bucket is created, while AWS S3 and Backblaze B2 allow it to be enabled on eligible existing buckets. Enabling it does not by itself retroactively apply retention to existing objects. The setup sequence is:
- Create a new bucket with Object Lock enabled. For Backblaze B2, toggle Object Lock during bucket creation in the web console. For Wasabi, the same option appears during bucket creation.
- Set the default retention in the bucket settings. A 30-day retention is a common starting point for home users - long enough to detect a ransomware event, short enough that storage costs from locked (undeleted) old versions are contained.
- Create a dedicated application key with write permissions to only this bucket. Do not use your master account key. The application key used by the NAS should have minimal permissions - write objects, list bucket, read objects. It should not have permission to modify Object Lock settings.
- Configure the backup application (Hyper Backup or HBS3) to use the new bucket and the restricted application key. Enable Object Lock in the task settings and confirm the retention period matches the bucket default.
- Run an initial backup and verify locked objects appear in the cloud console.
Key security insight: Use a dedicated, bucket-scoped key with only the permissions required by the backup application. Withhold bucket-administration and governance-bypass permissions; applications that set or extend per-object retention may still require a retention-write permission. Keep governance-bypass and bucket-administration credentials separate from the NAS. Use a dedicated privileged administrative identity rather than assuming Object Lock must be managed only through a web console or master key.
The Storage Cost Reality
Immutable backups cost more than standard cloud backup because locked objects cannot be deleted on schedule. Standard backup rotation deletes old backup versions to control storage costs. With Object Lock, old versions stay in storage until the lock expires. The cost impact depends on your retention period and how frequently your backup application creates new versions.
A practical example with Backblaze B2 at USD $6/TB/month:
- Retained cloud storage cannot be estimated from source dataset size, backup frequency and retention alone. It also depends on data change rate, backup format, deduplication, object versioning and rotation behavior; use the provider's current rate and measured backup growth for cost estimates.
The cost premium varies with retention, change rate, backup format, deduplication and the provider's minimum-storage and billing rules; there is no generally established 20-40% range. For most home users, this is a modest cost for meaningful additional protection.
Is It Worth It for Home Users?
Immutable backups add real protection but also real complexity. A practical assessment:
Pros
- Protects against ransomware using stolen NAS credentials to delete cloud backups
- Compliance mode provides protection even against accidental deletion by the account owner
- Standard S3 protocol - works with existing Synology and QNAP backup applications
- Cost premium varies with retention, change rate, backup behavior and provider billing rules
- Requires ongoing monitoring and periodic restore testing
Cons
- Creation-time requirement varies by provider: required by Wasabi, but AWS S3 and Backblaze B2 support enabling Object Lock on eligible existing buckets
- Slightly higher storage costs due to locked old versions accumulating
- Adds configuration complexity - two-key setup required for proper security
- Does not protect against ransomware that encrypts data before backup runs (only protects the backup copy, not the source)
- Compliance mode locks are irreversible - test carefully before using in production
For home users who already have cloud backup running and have irreplaceable data (family photos, financial records, business documents), setting up Object Lock on a new bucket is worthwhile. The ongoing cost premium is modest. The protection is genuine.
For users who do not yet have cloud backup running at all, start with standard cloud backup first and add Object Lock once the basic backup is working reliably. Complexity during initial setup can delay getting any backup in place at all.
For small business users with any ransomware exposure, immutable cloud backup should be standard practice alongside local backup and tested restore procedures. The cost is easily justified by the protection value.
Related reading: our NAS buyer's guide.
Free tools: Backup Storage Calculator and UPS Sizing Calculator. No signup required.
See also: our full Backup and Disaster Recovery guide.
Can I enable Object Lock on an existing cloud backup bucket?
It depends on the provider. AWS S3 and Backblaze B2 allow Object Lock to be enabled on eligible existing buckets, while Wasabi requires it to be enabled when the bucket is created. Existing objects are not automatically given retention merely by enabling the feature. To switch to immutable backup, create a new bucket with Object Lock enabled, run a fresh initial backup to the new bucket, then decommission the old bucket once you are satisfied the new backup is working correctly.
What retention period should I set for home backups?
30 days is a common starting point for home users. Whether 30 days is enough depends on detection time, attacker dwell time, backup frequency and the number of clean recovery points retained. Longer periods (60-90 days) provide more recovery options at higher storage cost. Shorter periods (7-14 days) reduce cost but may not provide enough window to detect slow-moving ransomware before the oldest clean backup expires.
Does Synology Hyper Backup support Object Lock?
Synology Hyper Backup supports S3-compatible destinations including Backblaze B2 and Wasabi, but the reviewed vendor documentation does not establish a Hyper Backup task-level S3 Object Lock control. Confirm compatibility with Synology and the storage provider and test rotation and restore behavior before relying on storage-side immutability.
Will immutable backup stop ransomware from encrypting my NAS data?
No. Immutable backup protects the backup copy in the cloud from being deleted or modified by ransomware using your NAS credentials. It does not protect the data on the NAS itself. If ransomware encrypts files on your NAS before the next backup runs, those encrypted files may be backed up on top of your clean versions, depending on your backup schedule and retention. The protection is that locked older versions cannot be deleted, giving you a clean restore point to return to after recovery.
How much more does immutable backup cost compared to standard cloud backup?
The additional cost varies with retention, data change rate, backup format, deduplication, versioning and provider billing rules. Estimate it using measured backup growth and the provider's current pricing rather than a general percentage. The premium is modest for meaningful additional protection.
Immutable backup is one layer of a complete backup strategy. For the full picture on 3-2-1 backup design including local, onsite, and offsite approaches for Australian NAS users, read the complete guide.