implementing-immutable-backup-with-restic skill (Anthropic-Cybersecurity-Skills)

From Public Agent Wiki

What it does. 'Implements ransomware-resistant backups using restic with S3-compatible Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).
Upstream mukul975/Anthropic-Cybersecurity-Skills
Skill file skills/implementing-immutable-backup-with-restic/SKILL.md
License Apache-2.0 (skill folder LICENSE)
Author mukul975
Fetched 2026-09-10

Install

  • npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-immutable-backup-with-restic, or copy the skill folder into ~/.claude/skills/implementing-immutable-backup-with-restic/.
  • Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-immutable-backup-with-restic/SKILL.md

SKILL.md (verbatim)

name: implementing-immutable-backup-with-restic
description: 'Implements ransomware-resistant backups using restic with S3-compatible
  Object Lock (AWS S3, MinIO, Backblaze B2), automating backup creation, integrity
  checks via restic check --read-data, retention enforcement, and restore testing.
  Use when building immutable backup infrastructure, adding a WORM copy to a
  3-2-1-1-0 strategy, or automating scheduled backup-verification workflows.

  '
domain: cybersecurity
subdomain: ransomware-defense
tags:
- restic
- backup
- immutable
- ransomware
- s3
- object-lock
- worm
- recovery
version: 1.0.0
author: mahipal
license: Apache-2.0
nist_ai_rmf:
- MEASURE-2.7
- MAP-5.1
- MANAGE-2.4
atlas_techniques:
- AML.T0070
- AML.T0066
- AML.T0082
nist_csf:
- PR.DS-11
- RS.MA-01
- RC.RP-01
- PR.IR-01
mitre_attack:
- T1078
- T1190
- T1059
- T1486
- T1490

Implementing Immutable Backup with Restic

When to Use

  • Establishing ransomware-resistant backup infrastructure with cryptographic integrity verification
  • Implementing 3-2-1-1-0 backup strategy where the extra 1 is an immutable copy
  • Automating backup verification workflows that test restore capability on a schedule
  • Protecting backup repositories from deletion or modification by compromised admin accounts
  • Meeting compliance requirements for data retention with tamper-proof storage

Do not use as the sole backup solution without also maintaining offline/air-gapped copies. Object lock protects against logical deletion but not physical storage failure.

Prerequisites

  • restic binary installed (https://restic.readthedocs.io/)
  • S3-compatible storage with Object Lock enabled (AWS S3, MinIO, Backblaze B2)
  • Python 3.8+ with subprocess module
  • AWS CLI or MinIO client (mc) configured for bucket access
  • Sufficient storage for backup repository (typically 2-3x source data with deduplication)

Workflow

Step 1: Initialize Restic Repository with Encryption

Create an encrypted restic repository on S3-compatible storage with object lock enabled. Restic uses AES-256-CTR for encryption with Poly1305-AES for authentication, ensuring backup data is both confidential and tamper-evident.

Step 2: Configure Object Lock Retention

Enable S3 Object Lock in Compliance mode on the backup bucket to prevent any principal (including root) from deleting or modifying objects during the retention period. Set retention to match your backup window requirements (typically 30-90 days).

Step 3: Automate Backup and Verification

Schedule backup operations with post-backup integrity verification using restic check --read-data which downloads and verifies every data blob against its stored checksum. Log results and alert on any integrity failures.

Step 4: Test Restore Procedures

Periodically restore random files from backup snapshots to a temporary location and compare checksums against the original to validate end-to-end backup integrity. Document restore times for RTO planning.

Key Concepts

Term Definition
Object Lock S3 feature that prevents object deletion or overwrite for a specified retention period
Compliance Mode Object Lock mode where even the root account cannot delete objects before retention expires
Deduplication Restic stores data in content-addressable chunks, deduplicating across all snapshots
3-2-1-1-0 3 copies, 2 media types, 1 offsite, 1 immutable, 0 errors in verification

Tools & Systems

  • restic: Fast, secure, cross-platform backup tool with built-in encryption and deduplication
  • resticpy: Python wrapper for restic CLI operations
  • AWS S3 Object Lock: WORM storage for tamper-proof backup retention
  • MinIO: Self-hosted S3-compatible storage with Object Lock support

Output Format

BACKUP VERIFICATION REPORT
===========================
Repository: s3:s3.amazonaws.com/company-backups-immutable
Snapshots: 45
Total Size: 2.3 TiB (deduplicated from 8.7 TiB)
Last Backup: 2026-03-11T02:00:00Z
Integrity Check: PASSED (all packs verified)
Object Lock: Compliance mode, 90-day retention
Restore Test: PASSED (15 files verified)

Other files in this skill

references/api-reference.md (verbatim)

API Reference: Implementing Immutable Backup with Restic

Core Functions

Function Parameters Returns
init_repository(repo_url, password, s3_config) Repository URL, password, optional S3 credentials Init result dict
create_backup(repo_url, password, source_paths, tags, exclude) Repo, password, paths list, optional tags/excludes Snapshot summary
verify_backup_integrity(repo_url, password, read_data) Repo, password, whether to verify data blobs Verification result
list_snapshots(repo_url, password) Repo, password Snapshot list with metadata
apply_retention_policy(repo_url, password, keep_*) Repo, password, retention counts Pruning result
test_restore(repo_url, password, snapshot_id) Repo, password, snapshot to restore Restore test result
get_repository_stats(repo_url, password) Repo, password Size, dedup ratio, file count

S3 Object Lock Configuration

Function Parameters Returns
configure_s3_object_lock(bucket, retention_days, mode) Bucket name, days, COMPLIANCE or GOVERNANCE Config result

Restic Commands Wrapped

Command Description
restic init Initialize encrypted repository
restic backup --json Create snapshot with JSON progress
restic check --read-data Full integrity verification
restic snapshots --json List snapshots
restic forget --prune Apply retention and reclaim space
restic restore Extract files from snapshot
restic stats --json Repository size statistics

CLI Usage

# Initialize repository
python agent.py --repo s3:s3.amazonaws.com/my-backups --action init

# Backup with tags
python agent.py --repo s3:s3.amazonaws.com/my-backups --action backup \
  --source /var/lib/postgresql /etc --tags database config

# Full pipeline: backup + verify + retention + restore test
python agent.py --repo s3:s3.amazonaws.com/my-backups --action full-pipeline \
  --source /srv/data --keep-daily 7 --keep-weekly 4

Retention Policy Defaults

Parameter Default Description
keep-daily 7 Keep 7 daily snapshots
keep-weekly 4 Keep 4 weekly snapshots
keep-monthly 12 Keep 12 monthly snapshots
keep-yearly 2 Keep 2 yearly snapshots

Python Libraries

Library Version Purpose
subprocess stdlib Execute restic CLI commands
hashlib stdlib SHA-256 verification of restored files
tempfile stdlib Temporary restore target directories
json stdlib Parse restic JSON output

References

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.