Ransomware-Resilient Disaster Recovery ⚡♻

🔴 The Incident That Shook a Nation

On June 20, 2024, the Indonesian government faced its worst digital nightmare in history.

Brain Cipher ransomware — a new variant of LockBit 3.0 — successfully encrypted the entire infrastructure of the Temporary National Data Center (PDNS), operated by the Ministry of Communication and Information Technology.

The result?

❌ 230+ government services PARALYZED
❌ Airports forced to rely on MANUAL processes
❌ Ransom demand: USD 8,000,000
❌ Data that had a backup: < 2%
❌ Recovery time: WEEKS

And the root cause wasn't sophisticated malware — it was having no backup at all.

"The most sophisticated ransomware in the world is powerless against a well-tested backup."

This article rebuilds that scenario as a resilient reference architecture on AWS — complete with code, runbooks, and cost calculations.

🏗️ The Architecture We'll Build

📋 AWS Services Used

⚙️ Step-by-Step Implementation

• Primary Region: ap-southeast-3 (Asia Pacific – Jakarta)
• Recovery Region: ap-southeast-1 (Asia Pacific – Singapore)

STEP 1 — Create KMS Encryption Keys

1A. KMS Key for Jakarta Region (Primary)

1. Open AWS Management Console → confirm the region in the top-right corner: Asia Pacific (Jakarta) ap-southeast-3.
2. In the top search bar, type KMS → click Key Management Service.
3. Click the Create key button (orange).
4. Fill in the key configuration:

1. Click Next.
2. Set Alias: pdns-backup-key.
3. Set Description: PDNS Backup Encryption Key - Jakarta Primary.
4. Click Next → Next (leave Key Administrators & Key Permissions default) → click Finish.
5. Record the Key ARN that appears in the reference table below. Example: arn:aws:kms:ap-southeast-3:123456789012:key/xxxx-xxxx-xxxx-xxxx

1B. Enable Key Rotation

1. On the detail page of the newly created pdns-backup-key, click the Key rotation tab.
2. Check the box: Automatically rotate this KMS key every year.
3. Click Save.

1C. KMS Key for Singapore Region (Recovery)

1. Switch region on the top-right dropdown → select Asia Pacific (Singapore) ap-southeast-1.
2. Repeat steps 1A and 1B with these settings:
   • Alias: pdns-recovery-key
   • Description: PDNS Recovery Encryption Key - Singapore Recovery
   • Key rotation: Automatically enabled (Enabled)
3. Record the Key ARN for Singapore region.

KMS Key Reference Table

Record your generated Key ARNs in the following reference table:

STEP 2 — Create S3 Bucket with Object Lock (WORM)

⚠️ IMPORTANT: S3 Object Lock can only be enabled when a bucket is first created. It cannot be added after the bucket exists.

2A. Create Bucket in Jakarta

1. Confirm active region: ap-southeast-3 (Jakarta).
2. Search for S3 in the top search bar → click S3.
3. Click the Create bucket button.
4. Fill in the bucket configuration:

1. Under Advanced settings → Object Lock, check Enable and acknowledge the confirmation dialog.
2. Click Create bucket.

2B. Configure Default Retention (Compliance Mode)

1. Click the name of the newly created bucket (pdns-immutable-backup-...).
2. Go to the Properties tab.
3. Scroll down to Object Lock → click Edit.
4. Fill in the default retention settings:

1. Click Save changes.

🔴 Critical Note: In Compliance Mode, no user (not even the root account or AWS Support) can delete objects or overwrite them until the 30-day retention period has expired.

2C. Add Lifecycle Rule (Auto-transition to Glacier)

1. In the same bucket, click the Management tab.
2. Click the Create lifecycle rule button.
3. Fill in the lifecycle configuration:

1. Acknowledge the cost transition dialog if prompted → click Create rule.

STEP 3 — AWS Backup Vault + Vault Lock

3A. Create Backup Vault in Jakarta

1. Confirm active region: ap-southeast-3 (Jakarta).
2. Search for AWS Backup in the search bar → click AWS Backup.
3. In the left navigation menu, click Backup vaults.
4. Click Create backup vault.
5. Fill in the configuration:

1. Click Create backup vault.

3B. Enable Vault Lock

⚠️ There is a 72-hour grace period. During the first 3 days, Vault Lock can still be modified or deleted. After that period, it becomes PERMANENT and cannot be deleted or bypassed by anyone, including AWS.

1. On the pdns-immutable-vault page, click the Vault Lock tab.
2. Click Configure Vault Lock.
3. Fill in the parameters:

1. Type confirm in the confirmation dialog.
2. Click Apply Vault Lock.

3C. Create Recovery Vault in Singapore

1. Switch region to ap-southeast-1 (Singapore).
2. Navigate to AWS Backup → Backup vaults → Create backup vault.
3. Fill in the recovery vault settings:

1. Click Create backup vault.
2. Repeat step 3B (Vault Lock) on this Singapore vault using the same parameters (Compliance Mode, Min 7 days, Max 365 days).

STEP 4 — Backup Plan (Automated Backup Schedule)

4A. Create IAM Role for Backup

1. Search for IAM in the search bar → click IAM.
2. In the left menu, click Roles → click Create role.
3. Select Trusted entity type: AWS service.
4. Under Use case, scroll down → select Backup → click Next.
5. In the Add permissions section, search and check both policies:
   • ✅ AWSBackupServiceRolePolicyForBackup
   • ✅ AWSBackupServiceRolePolicyForRestores
6. Click Next.
7. Enter Role name: AWSBackupServiceRole-PDNS.
8. Click Create role.

4B. Create Backup Plan

1. Switch region back to ap-southeast-3 (Jakarta).
2. In AWS Backup → left menu → Backup plans → click Create backup plan.
3. Select Build a new plan.
4. Enter Backup plan name: PDNS-Ransomware-Resilient-Plan.

4C. Add Rule 1: Hourly Backup (Critical Services)

1. Click the Add backup rule button.
2. Configure the hourly backup rule:

1. Under Copy to destination:
   • Click Add copy
   • Destination region: Asia Pacific (Singapore)
   • Destination vault: pdns-recovery-vault
   • Retention period: 30 Days
2. Click Save rule.

4D. Add Rule 2: Daily Backup

1. Click Add backup rule again.
2. Configure the daily backup rule:

1. Click Save rule.

4E. Add Rule 3: Monthly Long-Term

1. Click Add backup rule again.
2. Configure the monthly long-term backup rule:

1. Click Save rule → click Create plan.

4F. Assign Resources to Backup Plan

1. After the plan is created, click Assign resources.
2. Fill in the resource assignment form:

1. Click Assign resources.

⚠️ Operational Notice: Ensure all production EC2 instances, RDS databases, and EBS volumes in Jakarta carry the tag: Environment=Production.

STEP 5 — Amazon GuardDuty (Threat Detection)

5A. Enable GuardDuty in Jakarta

1. Confirm active region: ap-southeast-3 (Jakarta).
2. Search for GuardDuty in the search bar → click Amazon GuardDuty.
3. Click the Get Started button.
4. On the welcome page, click Enable GuardDuty.

5B. Enable Protection Plans

After GuardDuty is active:

1. In the left menu, click Protection plans.
2. Enable each protection plan individually by clicking Enable:

5C. Configure Finding Frequency

1. In the left menu, click Settings.
2. Under Finding export options → Updated finding frequency.
3. Select: Update CWE every 15 minutes (accelerates finding notifications to EventBridge).
4. Click Save.

5D. Create SNS Topic for Alerts

1. Search for SNS in the search bar → click Simple Notification Service.
2. In the left menu, click Topics → click Create topic.
3. Configure the topic:

1. Click Create topic.
2. On the new topic page, click Create subscription.
3. Configure the subscription:

1. Click Create subscription.
2. Check your inbox → click Confirm subscription on the email received from AWS Notifications.

5E. Create EventBridge Rule: GuardDuty HIGH → Alert

1. Search for EventBridge in the search bar → click Amazon EventBridge.
2. In the left menu, click Rules → click Create rule.
3. Fill in the rule parameters:

1. Click Next.
2. Under Event pattern → select Custom pattern (JSON editor).
3. Paste the following JSON pattern:

{
  "source": ["aws.guardduty"],
  "detail-type": ["GuardDuty Finding"],
  "detail": {
    "severity": [{ "numeric": [">=", 7] }]
  }
}

1. Click Next.
2. Under Target 1:
   • Target type: AWS service
   • Select a target: SNS topic
   • Topic: select pdns-security-alerts
3. Click Next → Next → click Create rule.

✅ Now every GuardDuty finding with severity ≥ 7 will be automatically dispatched to your email within seconds.

STEP 6 — AWS Security Hub

6A. Enable Security Hub

1. Search for Security Hub in the search bar → click Security Hub.
2. Click Go to Security Hub / Enable Security Hub.
3. Ensure the following compliance standards are checked:
   • ✅ AWS Foundational Security Best Practices v1.0.0
   • ✅ CIS AWS Foundations Benchmark v1.4.0
   • ✅ Enable AWS Config (Security Hub requires AWS Config for resource evaluations)
4. Click Enable Security Hub.

6B. Integrate with GuardDuty

1. In Security Hub, click Integrations in the left menu.
2. Type GuardDuty in the search box.
3. Click Accept findings on the Amazon GuardDuty integration card.
4. Confirm acceptance.

6C. Setup Ransomware Insight

1. In the left menu, click Insights → click Create insight.
2. Configure the custom insight:

1. Click Create insight.

STEP 7 — AWS CloudTrail (Audit Log)

7A. Create CloudTrail Trail

1. Search for CloudTrail in the search bar → open CloudTrail.
2. In the left menu, click Trails → click Create trail.
3. Fill in the trail parameters:

1. Click Next.

7B. Select Events to Log

1. Under Events:
   • Check: ✅ Management events (Read + Write)
   • Check: ✅ Data events
2. Under Data events, click Add data event type:
   • Data event type: S3 → All current and future S3 buckets → Read + Write
3. Click Add data event type again:
   • Data event type: Lambda → All current and future functions
4. Click Next → review settings → click Create trail.

STEP 8 — AWS Elastic Disaster Recovery (DRS)

8A. Initialize DRS in Recovery Region

1. Switch region to ap-southeast-1 (Singapore).
2. Search for Elastic Disaster Recovery in the search bar → click AWS Elastic Disaster Recovery.
3. Click Set up Elastic Disaster Recovery / Get started.
4. Configure Default replication settings:

💡 Architectural Recommendation: Before initializing DRS, create a dedicated VPC in Singapore named pdns-recovery-vpc (10.10.0.0/16) with 1 Public Subnet in AZ ap-southeast-1b and an active Internet Gateway.

1. Create Security Group pdns-drs-replication-sg in Singapore with:
   • Inbound: Port TCP 1500 from 0.0.0.0/0 (incoming block-level data replication from Jakarta)
   • Outbound: All traffic (Default)
2. Click Next.

8B. Configure Point-in-Time (PIT) Recovery

1. Under Point-in-time recovery:
   • Click Add rule
   • Snapshot retention (in days): 7 days
2. Click Next → click Create.

8C. Install DRS Agent on Production Server

DRS Agent installation is conducted via AWS Systems Manager Session Manager (no SSH port 22 required).

DRS Replication Topology

[Jakarta - ap-southeast-3]              [Singapore - ap-southeast-1]
┌──────────────────────────┐            ┌──────────────────────────┐
│ PRODUCTION EC2           │            │ DRS Replication Server    │
│ ← Install DRS Agent      │─replicate─►│ (created AUTOMATICALLY    │
│   on this server         │  (Port 1500)│  by AWS DRS, not manually) │
└──────────────────────────┘            └──────────────────────────┘
       SOURCE (Origin)                          TARGET (Recovery)

Step 1 — Create Production EC2 in Jakarta (if not yet exists)

1. Confirm region: ap-southeast-3 (Jakarta).
2. Go to EC2 → Instances → Launch instances.
3. Fill in the instance configuration:

1. Click Launch instance.

Step 2 — Create IAM Role for EC2 (SSM + DRS)

1. Go to IAM → Roles → Create role.
2. Select AWS service → Use case: EC2 → click Next.
3. Check BOTH of the following policies:
   • ✅ AmazonSSMManagedInstanceCore (Session Manager access)
   • ✅ AWSElasticDisasterRecoveryAgentInstallationPolicy (DRS agent installation permissions)
4. Set role name: EC2-SSM-SessionManager-Role → click Create role.

Step 3 — Attach IAM Role to EC2 Instance

1. In Jakarta console, open EC2 → Instances.
2. Check pdns-prod-server-01 → click Actions → Security → Modify IAM role.
3. Select EC2-SSM-SessionManager-Role → click Update IAM role.

Step 4 — Configure Outbound Security Group (Ports 443 & 1500)

The DRS Agent requires 2 outbound ports from Jakarta to the internet:

1. On instance pdns-prod-server-01, go to the Security tab → click the Security Group name.
2. Open Outbound rules → click Edit outbound rules → click Add rule:
   • Type: Custom TCP
   • Port range: 1500
   • Destination: 0.0.0.0/0
   • Description: DRS Data Replication to Singapore
3. Click Save rules.

Step 5 — Add KMS Key Permission for DRS

1. Switch region to ap-southeast-1 (Singapore).
2. Open KMS → click pdns-recovery-key → Key policy tab → click Edit.
3. Add the following statement inside the Statement array before the closing ]:

{
  "Sid": "Allow DRS Service to use this key",
  "Effect": "Allow",
  "Principal": {
    "AWS": "arn:aws:iam::[YOUR-ACCOUNT-ID]:role/aws-service-role/drs.amazonaws.com/AWSServiceRoleForElasticDisasterRecovery"
  },
  "Action": [
    "kms:Encrypt",
    "kms:Decrypt",
    "kms:GenerateDataKey",
    "kms:GenerateDataKeyWithoutPlaintext",
    "kms:DescribeKey",
    "kms:CreateGrant",
    "kms:ReEncrypt*"
  ],
  "Resource": "*"
}

(Replace [YOUR-ACCOUNT-ID] with your 12-digit AWS account ID). Click Save changes.

Step 6 — Verify Instance Readiness in Fleet Manager

1. Open Systems Manager → Fleet Manager in region ap-southeast-3 (Jakarta).
2. Wait 3–5 minutes after attaching the IAM role.
3. Refresh the page until pdns-prod-server-01 appears with status: Online ✅.

Step 7 — Install DRS Agent via Session Manager

1. Open Systems Manager → Session Manager in Jakarta.
2. Click the Start session button in the top-right corner.
3. On the Specify target page, select pdns-prod-server-01 → click Start session.
4. In the web terminal that opens, run the following commands one at a time:

Command 1 — Switch to superuser (root):

sudo su -

Command 2 — Install kernel headers & build tools:

sudo dnf install -y kernel-devel kernel-headers gcc make

(Wait until output displays Complete!).

Command 3 — Download official DRS installer:

wget -O /tmp/aws-replication-installer-init.py \
https://aws-elastic-disaster-recovery-ap-southeast-1.s3.amazonaws.com/latest/linux/aws-replication-installer-init.py

Command 4 — Run installer:

sudo python3 /tmp/aws-replication-installer-init.py --region ap-southeast-1 --no-prompt

Wait until execution completes (~10–20 minutes). Installation stages:

Command 5 — Enable agent auto-start on reboot:

sudo systemctl enable aws-replication-agent

8D. Verify Replication Status

1. Switch region to ap-southeast-1 (Singapore).
2. Open Elastic Disaster Recovery → Source servers.
3. Inspect the Data replication status column:

8E. Configure Launch Template for Recovery

1. In DRS left menu, click Launch settings.
2. Select the source server → click Edit.
3. Configure the launch template:

1. Click Save template.

note : If you've achieved 100% replication or the status is green, you can proceed to 8E. In my case, it didn't reach the green status because my internet connection is slow.

💰 Estimated Monthly Architecture Cost

💡 Cost vs. Impact: In the June 2024 PDNS ransomware incident, attackers demanded an $8,000,000 ransom while disrupting 230+ public agencies for weeks. The prevention and resilience architecture documented here costs only ~$545/month.

💰 Cost vs. Benefit

🔗 Resources

• 📁 Full repository: github.com/yourusername/aws-ransomware-dr
• 📄 AWS Backup docs: docs.aws.amazon.com/aws-backup
• 🛡️ AWS DRS docs: docs.aws.amazon.com/drs
• 🔍 GuardDuty best practices: docs.aws.amazon.com/guardduty