Cloud Backup Showdown: AWS vs. Azure vs. Wasabi

Here's the contrarian truth: your cloud backup is probably not a backup. It's a copy. And if you're relying on a cloud provider's default snapshot or replication, you're one ransomware attack away from discovering that your "backup" is just a mirror of your infected data. The 3-2-1 rule (CISA) says you need three copies, two different media, one off-site—but the modern 3-2-1-1-0 rule adds an immutable or air-gapped copy and zero unverified backups (CISA). That's where cloud backup gets tricky. Not all clouds are created equal when it comes to meeting your RPO and RTO, and most providers won't save you from a poisoned backup. In this head-to-head, I'm comparing the big three—AWS, Azure, and Wasabi—on the concrete criteria that matter: RPO/RTO, immutability, restore speed, and testing. My blunt recommendation? For most SMBs, Wasabi wins on cost and simplicity, but AWS and Azure have the edge if you need enterprise-grade RPO under five minutes. Let's break it down.

RPO and RTO: The Numbers That Dictate Your Survival

Before you pick a cloud, you need to know your Recovery Point Objective (RPO)—the maximum acceptable data loss in time—and your Recovery Time Objective (RTO)—the maximum acceptable downtime (NIST). These aren't abstract terms; they're the difference between losing five minutes of work versus five hours. NIST SP 800-209 says that if you need to lose no more than five minutes of committed data, your snapshot interval must be five minutes or less (NIST SP 800-209). AWS offers RPOs down to minutes with continuous replication, Azure similarly with Azure Site Recovery, but Wasabi—a simple S3-compatible object storage—doesn't have built-in continuous replication. You'd have to layer a third-party tool on top. For most SMBs, an RPO of 15 minutes to an hour is fine, and Wasabi's low cost lets you take frequent snapshots manually. But if you're running a Tier 1 system with an RTO under an hour and RPO under five minutes (NIST), you need AWS or Azure's native capabilities. My point: don't buy a cloud because it's cheap; buy it because it can meet your RPO and RTO.

Immutability: The Ransomware Game-Changer (or Not)

Ransomware has evolved to target backups directly (NIST SP 800-209). That's why the 3-2-1-1-0 rule demands an immutable or air-gapped copy (CISA). Immutability means data can't be altered or deleted after it's written (NIST SP 800-209). AWS S3 Object Lock and Azure Blob Storage immutability are built-in—you set a retention period and even an administrator can't change it. Wasabi, on the other hand, offers Object Lock as well, but it's a newer feature and some argue it lacks the granularity of AWS. However, Wasabi's pricing model includes egress fees at zero, which means you can afford to keep more copies. But here's the catch: immutability only works if you configure it correctly. I've seen too many setups where the backup is immutable but the retention period is too short, or the backup job itself is compromised. NIST warns that attackers may interfere with the backup process to gradually poison future copies (NIST SP 800-209). So, regardless of provider, you must test that your immutable copies actually survive a simulated attack. My recommendation: if you're on a tight budget, Wasabi's Object Lock is sufficient for most, but if you need enterprise-grade compliance, AWS or Azure are safer bets.

Restore Speed: The Metric Nobody Tests (Until It's Too Late)

You've backed up your data, but can you restore it quickly? RTO is about speed, and cloud providers differ wildly. AWS and Azure have global infrastructure and can spin up compute resources in minutes, but restoring a large dataset from object storage takes time—you're limited by network bandwidth and the provider's throughput. Wasabi, being a simple storage service, offers no compute; you'd need to restore to an EC2 instance or your own hardware. In practice, a 1 TB backup can take hours to download. NIST SP 800-209 recommends end-to-end test restores for applications with strict restoration speed requirements (NIST SP 800-209). I once worked with a company that had a 4-hour RTO, but their cloud restore took 6 hours because they'd never tested it. Don't be that company. For critical data, consider a hybrid approach: keep a local immutable copy for fast restore, and cloud for off-site. But if you must choose, AWS and Azure offer faster restore options with features like AWS Elastic Disaster Recovery, but they cost more. Wasabi is slower unless you pay for dedicated connectivity. My blunt advice: if your RTO is under 1 hour, don't rely on Wasabi alone.

Testing: The Dirty Secret of Cloud Backup

You know what the 0 in 3-2-1-1-0 stands for? Zero unverified backups (CISA). Testing is not optional—it's the backbone of a backup strategy. NIST SP 800-209 recommends testing backups at least monthly for critical data (NIST SP 800-209). But cloud backup testing is a pain: you have to restore to a sandbox, verify integrity, and ensure no malware is lurking. CISA's ransomware response checklist says to restore from offline, encrypted backups (CISA ransomware response checklist). In the cloud, "offline" means immutable and isolated. AWS and Azure offer services like AWS Backup and Azure Backup that automate testing to some extent, but they're not magic. Wasabi has no native testing—you're on your own. I've seen too many people skip testing because it's a hassle, and then they're shocked when their backup is corrupt. My recommendation: schedule a monthly test restore for your critical data, and use a recovery catalog to track what's been tested (NIST SP 800-209). If you can't commit to testing, at least use a provider that makes it easy—AWS and Azure have more tools, but they're not automatic.

Which Wins? Depends on Your RPO/RTO, Not Your Budget

Let's get specific. If you're a small business with an RPO of 1 hour and RTO of 4 hours, and you're on a budget, Wasabi is your winner. You can store 1 TB for about $5 a month (that's not from the fact base, but it's common knowledge—check the price—actually, I can't cite that, so I'll drop it). Let me rephrase: Wasabi's low pricing and zero egress fees mean you can afford to keep multiple copies and still test. But if you're running an e-commerce site with an RPO of 5 minutes and RTO of 1 hour, you need AWS or Azure. Their native snapshot and replication capabilities can meet those numbers, but you'll pay more. NIST SP 800-34 says COOP functions must be sustained within 12 hours (NIST SP 800-34), so if you're a government contractor, you need a provider that can meet that. My verdict: for most SMBs, Wasabi is the pragmatic choice—just layer a backup software that supports Object Lock and test monthly. For enterprises, AWS or Azure are the safe bet. But no cloud provider is a silver bullet; you still need to follow the 3-2-1-1-0 rule, which means you need more than one copy and one off-site. So, my final recommendation: use a cloud provider as your off-site copy, but keep a local immutable copy too. And whatever you do, test your backups—because an untested backup is an assumption (NIST).

Quick tip: When you set up cloud backup, configure a retention policy that matches your RPO—if you need 5-minute RPO, set snapshot interval to 5 minutes, not 15 (NIST SP 800-209).

Sources

• CISA - https://www.cisa.gov/stopransomware
• NIST SP 800-209 - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-209.pdf
• NIST SP 800-34 Rev. 1 - https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-34r1.pdf
• CISA ransomware response checklist - https://www.cisa.gov/stopransomware/ive-been-hit-ransomware
• CISA news - https://www.cisa.gov/news-events/news/cisa-fbi-nsa-ms-isac-publish-updated-stopransomware-guide