Immutable Backup with Restic
FreeAutomate ransomware-resistant backup strategies.
Free · Opens the source repo
What Immutable Backup with Restic does
This skill implements a robust backup solution using Restic, designed to create ransomware-resistant backups with cryptographic integrity verification. It leverages S3-compatible Object Lock features from storage providers like AWS S3, MinIO, and Backblaze B2 to ensure that backups cannot be deleted or altered during specified retention periods. By automating the backup creation process and scheduling integrity checks, users can maintain a reliable backup infrastructure that meets compliance requirements and protects against data loss.
The workflow begins with initializing a Restic repository on S3-compatible storage, ensuring that backups are encrypted using AES-256-CTR. The skill then configures Object Lock in Compliance mode to safeguard against any deletions, even from administrative accounts. This setup is particularly useful for organizations that need to adhere to strict data retention policies or wish to add an immutable copy to their existing backup strategies, such as the 3-2-1-1-0 model, which emphasizes redundancy and reliability.
Additionally, the skill automates verification of backup integrity by executing scheduled checks that validate the data against stored checksums. This proactive approach to backup management helps users quickly identify and address any issues that may arise, ensuring that restore capabilities are consistently tested. The skill also includes functionality for periodic restore tests, allowing users to confirm that their backups can be successfully restored when needed.
Overall, this skill is ideal for developers and IT professionals looking to enhance their backup strategies with automated, secure, and compliant solutions that protect against ransomware and ensure data integrity.
When to use it
Use this skill when establishing a ransomware-resistant backup infrastructure or automating backup verification workflows.
When not to use it
This skill should not be used as the sole backup solution without maintaining offline or air-gapped copies, as it does not protect against physical storage failures.
What you can build with it
Ransomware Protection for Enterprises
Implement this skill to ensure that enterprise data backups are secure against ransomware threats, maintaining integrity and availability.
Automated Backup Verification
Schedule regular integrity checks and restore tests to confirm that backups are valid and can be restored when necessary.
Compliance with Data Retention Policies
Use this skill to enforce data retention policies by leveraging Object Lock, ensuring that backups are kept intact for the required duration.
How to install Immutable Backup with Restic
View source1. Install with the skills CLI
npx skills add mukul975/anthropic-cybersecurity-skills/implementing-immutable-backup-with-restic --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by mukul975Implementing Immutable Backup with Restic
When to Use
- Establishing ransomware-resistant backup infrastructure with cryptographic integrity verification
- Implementing 3-2-1-1-0 backup strategy where the extra 1 is an immutable copy
- Automating backup verification workflows that test restore capability on a schedule
- Protecting backup repositories from deletion or modification by compromised admin accounts
- Meeting compliance requirements for data retention with tamper-proof storage
Do not use as the sole backup solution without also maintaining offline/air-gapped copies. Object lock protects against logical deletion but not physical storage failure.
Prerequisites
- restic binary installed (https://restic.readthedocs.io/)
- S3-compatible storage with Object Lock enabled (AWS S3, MinIO, Backblaze B2)
- Python 3.8+ with subprocess module
- AWS CLI or MinIO client (mc) configured for bucket access
- Sufficient storage for backup repository (typically 2-3x source data with deduplication)
Workflow
Step 1: Initialize Restic Repository with Encryption
Create an encrypted restic repository on S3-compatible storage with object lock enabled. Restic uses AES-256-CTR for encryption with Poly1305-AES for authentication, ensuring backup data is both confidential and tamper-evident.
Step 2: Configure Object Lock Retention
Enable S3 Object Lock in Compliance mode on the backup bucket to prevent any principal (including root) from deleting or modifying objects during the retention period. Set retention to match your backup window requirements (typically 30-90 days).
Step 3: Automate Backup and Verification
Schedule backup operations with post-backup integrity verification using restic check --read-data which downloads and verifies every data blob against its stored checksum. Log results and alert on any integrity failures.
Step 4: Test Restore Procedures
Periodically restore random files from backup snapshots to a temporary location and compare checksums against the original to validate end-to-end backup integrity. Document restore times for RTO planning.
Key Concepts
| Term | Definition |
|---|---|
| Object Lock | S3 feature that prevents object deletion or overwrite for a specified retention period |
| Compliance Mode | Object Lock mode where even the root account cannot delete objects before retention expires |
| Deduplication | Restic stores data in content-addressable chunks, deduplicating across all snapshots |
| 3-2-1-1-0 | 3 copies, 2 media types, 1 offsite, 1 immutable, 0 errors in verification |
Tools & Systems
- restic: Fast, secure, cross-platform backup tool with built-in encryption and deduplication
- resticpy: Python wrapper for restic CLI operations
- AWS S3 Object Lock: WORM storage for tamper-proof backup retention
- MinIO: Self-hosted S3-compatible storage with Object Lock support
Output Format
BACKUP VERIFICATION REPORT
===========================
Repository: s3:s3.amazonaws.com/company-backups-immutable
Snapshots: 45
Total Size: 2.3 TiB (deduplicated from 8.7 TiB)
Last Backup: 2026-03-11T02:00:00Z
Integrity Check: PASSED (all packs verified)
Object Lock: Compliance mode, 90-day retention
Restore Test: PASSED (15 files verified)
Frequently asked questions about Immutable Backup with Restic
Similar skills
Data Breach Blast Radius Analyzer
Assess potential breach impacts before they occur.
Verify Agent Action
Ensure safe execution of AI agent actions with thorough reviews.
Agent Supply Chain Integrity
Ensure the integrity of AI agent plugins and tools.
Agent OWASP ASI Compliance Check
Ensure your AI agents meet OWASP ASI security standards.
Securing S3 Buckets
Enhance your S3 bucket security with AWS best practices.
AWS Account Enumeration with ScoutSuite
Assess AWS security posture with comprehensive audits.