Built on AWS Native Services

Air Gap Recover is a fully AWS-native disaster recovery solution that protects your critical infrastructure by replicating data to an isolated AWS organization. Unlike traditional backup solutions that rely on proprietary agents or third-party storage, we exclusively use native AWS services to ensure maximum reliability, security, and performance.

Why AWS Native?

• → No additional attack surface: All data flows through AWS-managed APIs with AWS-native encryption
• → Instant compatibility: Works with any AWS service that supports snapshots or replication
• → Zero infrastructure overhead: No agents, gateways, or custom storage to manage
• → AWS SLA guarantee: Backed by AWS's 99.99% uptime commitment

Air Gap Recover operates across two AWS Organizations: your Source Organization (production environment) and a separate Destination Organization (air-gapped vault).

Cross-Account Isolation

The destination organization is completely isolated from your production environment. Even if an attacker gains full access to your source organization, they cannot access or modify data in the vault organization without separate credentials and multi-factor authentication.

For S3 buckets, we leverage S3 Cross-Region Replication (CRR) with cross-account replication to continuously sync objects to your vault organization.

Replication Features

For databases and block storage, we use AWS-native snapshot capabilities to create point-in-time backups and share them cross-account to your vault organization.

Supported Services

Cross-Account Snapshot Workflow

The vault organization is secured using AWS Control Tower, Service Control Policies (SCPs), and strict IAM policies to ensure data cannot be tampered with or deleted.

AWS Control Tower

Your vault organization is governed by AWS Control Tower, which provides:

Service Control Policies (SCPs)

SCPs enforce organization-wide restrictions that cannot be overridden, even by the account root user:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": [
        "s3:DeleteObject",
        "s3:DeleteObjectVersion",
        "s3:PutLifecycleConfiguration"
      ],
      "Resource": "arn:aws:s3:::vault-*/*",
      "Condition": {
        "StringNotEquals": {
          "aws:PrincipalOrgID": "o-vaultorgid"
        }
      }
    },
    {
      "Effect": "Deny",
      "Action": [
        "rds:DeleteDBSnapshot",
        "rds:DeleteDBClusterSnapshot",
        "ec2:DeleteSnapshot"
      ],
      "Resource": "*"
    }
  ]
}

Example SCP preventing deletion of vault objects and snapshots

Encryption Architecture

Access Controls

Access to the vault organization requires:

• → Separate AWS Account: Vault organization has no trust relationship with source organization
• → MFA Enforcement: All human access requires hardware MFA (U2F or TOTP)
• → IP Allowlisting: API access restricted to known corporate IP ranges
• → CloudTrail Monitoring: All API calls logged and monitored for anomalies

Air Gap Recover exclusively uses AWS-managed services. Here's the complete list of AWS services that power the solution: