With AWS Backup Vault Lock, you can prevent anyone, including data owners, from changing data retention period, except root and administrators

Explanation

With AWS Backup Vault Lock, no users—including root, administrators, or bad actors—can delete your backups or change their lifecycle settings such as retention periods and transition to cold storage.