fsi-ransomware-protect

Files (24)

• SKILL.md
• SKILL_ja.md
• 01-multi-account-architecture.md · references/
• 01-multi-account-architecture_ja.md · references/
• 02-immutability.md · references/
• 02-immutability_ja.md · references/
• 03-backup-plan-design.md · references/
• 03-backup-plan-design_ja.md · references/
• 04-encryption-strategy.md · references/
• 04-encryption-strategy_ja.md · references/
• 05-malware-protection.md · references/
• 05-malware-protection_ja.md · references/
• 06-policy-and-access-control.md · references/
• 06-policy-and-access-control_ja.md · references/
• 07-log-collection-and-protection.md · references/
• 07-log-collection-and-protection_ja.md · references/
• 08-monitoring-and-audit.md · references/
• 08-monitoring-and-audit_ja.md · references/
• 09-onpremises-integration.md · references/
• 09-onpremises-integration_ja.md · references/
• design-proposal-template.html · report-templates/
• evaluation-report-template.html · report-templates/
• roadmap-detail-template.html · report-templates/
• template-spec.md · report-templates/

SKILL.md (first lines)

---
name: fsi-ransomware-protect
description: >-
  Provides architecture design and evaluation support for ransomware-resilient backup environments on AWS, for financial services industry organizations. Use when: (1) designing a backup architecture from scratch, or (2) evaluating an existing backup environment (AWS Backup, native per-service backups, third-party products) for resilience gaps. Covers multi-account role separation, AWS Backup with Logically air-gapped vault, Vault Lock, Multi-party approval, Malware Scan, cross-account/cross-Region copy, immutable backup design, encryption/key management, IAM/SCP policy design, log collection/protection, backup monitoring/auditing, and on-premises integration. Activate on mentions of ransomware-resilient backup design, immutable backups, air-gapped vaults, or AWS Backup architecture. Do NOT use for detection, response, recovery, or unclear phase -- use fsi-ransomware-overview first. Target users: FSI backup design/evaluation practitioners, incl. security/infra and risk/compliance staff.
license: MIT No Attribution
metadata:
  author: aws-jp-fsi-sa
  version: "1.0"
---

# Ransomware Resilience for Financial Institutions: Protect

## Overview

This skill supports the architecture design and existing-environment evaluation of ransomware-resilient backup environments that financial services industry organizations build on AWS. What this skill provides:

- Design support for an account-separation strategy based on a multi-account structure
- Design of a backup architecture centered on AWS Backup
- Design of backup-data immutability (Vault Lock / Object Lock) and encryption
- Policy design (preventive controls via IAM / KMS / Vault Access Policy / SCP)
- Malware scanning strategy (AWS Backup malware protection, third-party product workarounds, ECR container protection)
- Design of log collection and protection in preparation for forensic response
- Design of monitoring and audit reporting for backup operations
- Selection of means to protect on-premises backups on AWS (AWS Backup Gateway / DataSync / Storage Gateway / S3 API)

The scope this skill covers:

- Focuses on the "Protect" phase of ransomware resilience
- The Detect, Respond/Isolate, and Recover phases are handled by separate skills
- Pre-incident prevention (network perimeter defense, EDR, etc.) is out of scope (the focus is on post-intrusion resilience)

The detailed guides and report-generation templates for this skill are stored in the `references/` folder and the `report-templates/` folder located in the same hierarchy as this skill file. When a workflow's processing step instructs you to "refer to references/XX" or "refer to report-templates/XX", locate the relevant file using the following procedure and read it before composing your response.

1. Try `.kiro/skills/fsi-ransomware-protect/{references,report-templates}/` under the workspace
2. If not found, try the user-level `~/.kiro/skills/fsi-ransomware-protect/{references,report-templates}/`
3. If found in neither, ask the user for this skill's deployment path

Even if loading a reference or template fails, do not compose a response based on general knowledge alone; always inform the user of the situation before deciding how to proceed.

This skill is designed to ensure the accuracy of its answers by referring to official AWS documentation. For use, we recommend setting up the AWS Documentation MCP server in advance (see the README.md included with this skill for setup instructions).

## Reference Foundations

This skill is built on the following authoritative sources, complemented by the design considerations required in the context of financial institutions. Links are kept, in principle, at the service-top or major-category level; deeper references to individual features are made as needed within the body text and the references/ folder.

### AWS official guidance (comprehensive best practices)

- AWS Blueprint for Ransomware Defense
- AWS Well-Architected Framework — Financial Services Industry Lens
- AWS Well-Architected Framework — Reliability / Security Pillar

### Service-specific official documentation

- AWS Backup
- Amazon S3
- AWS Key Management Service (KMS)
- AWS Organizations
- Amazon GuardDuty
- AWS Backup Gateway / AWS DataSync / AWS Storage Gateway
- AWS CloudTrail / AWS Config

### Reference resources

- AWS re:Invent 2025 - Building resilience against ransomware using AWS Backup (STG412)

## Common Tasks

### 0. Classify the Request

From the user's question, tentatively select a workflow based on the following correspondence.

| User intent | Workflow |
|---|---|
| Wants to understand the overall picture of backup/data protection as ransomware resilience in an AWS environment / wants to consult on where to start / wants to newly assemble an overall ransomware-resilient architecture design | A |
| Wants to evaluate the sufficiency of an existing backup/data-protection environment in an AWS environment as ransomware resilience, identify gaps, and improve | B |
| Wants to know the overall picture of ransomware-resilience best practices at an overview level / wants to explore interactively for learning purposes (no concrete design work or evaluation right now) | C |
| Wants pinpoint, in-depth consultation on a specific topic of backup/data protection in an AWS environment (or an on-premises environment involving AWS integration) (account separation, Vault Lock, encryption, malware scanning, log collection, SCP, monitoring/audit, etc.) | D |
| Wants to take and protect on-premises backups on AWS / wants to unify on-premises and AWS backups | E |

However, since in many cases the workflow cannot be uniquely determined from the user's question alone, always confirm interactively with the user "which direction to proceed in" before moving to the appropriate workflow. Specifically, present a confirmation message such as the following. This confirmation message MUST always begin with a statement that this skill covers only Protect among the five areas (see PR-C13).

> This skill covers "Protect" among the five areas of ransomware countermeasures (Protect, Detect, Respond, Recover, Organization), supporting the design and evaluation of backup and data protection. If you have questions about other areas, please request the corresponding skill.
>
> Before I answer your question, let me confirm which direction to proceed in.
>
> **[Produces a design/evaluation report]**
> - A. Build a ransomware-resilient architecture design on AWS from scratch (including when some controls are already in place)
> - B. Evaluate the sufficiency of an existing AWS backup environment as ransomware resilience (evaluation/improvement of an existing environment)
>
> **[Interactive guidance, no report]**
> - C. First understand the overall picture of best practices at an overview level (explore interactively and, as needed, guide to workflow A / B / D / E)
> - D. Learn about a specific topic in a pinpoint manner (LAG vault, Vault Lock, encryption, log collection, etc.)
> - E. Integrate on-premises environment backups into AWS
>
> Which direction does your case mainly fall under? Please also let me know if multiple apply.

Based on the user's reply, proceed to the appropriate workflow.

### 1. Common Hearing Items

Shared across Workflows A and B. The required/recommended/optional assignment differs per workflow.

| # | Hearing item |
|---|---|
| PR-H1 | Types of resources to protect (EC2, RDS, Aurora, S3, EFS, ECR, Fargate, etc.) |
| PR-H2 | Whether to consider ransomware resilience for the on-premises environment together with the AWS-side controls. If so, the presence and scale of a VMware environment |
| PR-H3 | Backup requirements (per business-impact level, what backup frequency/cadence/retention period is required for backup acquisition. The tendency of acquisition intervals according to the tolerance for data loss. If there is a regulatory long-term retention obligation, include that retention period as well. It need not be a uniform value; a per-system tendency is fine) |
| PR-H4 | Regulatory/compliance-driven protection requirements (requirements for tamper-proofing / WORM of backups, in-country data residency requirements, preservation of audit trails, etc. The retention period itself is handled by PR-H3) |
| PR-H5 | Existing multi-account structure / organizational structure (whether Organizations / Control Tower is used, the account-separation policy (per business system / per team / per environment, etc.), the scale of the number of accounts) |
| PR-H6 | Presence of existing security products (EDR/AV) and the policy on continuing to use them |
| PR-H7 | Priority of backup acquisition targets (the difference in business impact) |
| PR-H8 | Presence of an existing log-collection platform (SIEM, Security Lake, etc.) |

The Regions are fixed on the premise of Tokyo + Osaka.

### 2. Workflow A: Overall Design of a Ransomware-Resilient Architecture

#### Activation conditions

Handles questions such as "I want to assemble the overall picture of ransomware resilience from scratch," "I want to consider it comprehensively," or "the narrowing-down is weak, but I want to consult on the direction of controls." This also applies when some controls are already partially in place. However, select Workflow A when the goal is to newly assemble an overall design from a ransomware-resilience perspective, rather than an evaluation premised on an existing environment (if the goal is evaluation/improvement of an existing environment, select Workflow B).

From aws-samples/sample-fsi-reference-architecture-jp, MIT-0.

More from aws-samples/sample-fsi-reference-architecture-jp