Air-Gapped Backup
A backup copy stored in an isolated environment with no direct network connection to production, protecting it from being encrypted or deleted alongside the systems it's backing up.
Definition
An Air-Gapped Backup is a copy of data kept logically or physically isolated from the production network, so that a compromise of production, most commonly a ransomware attack, cannot reach and destroy the backup along with it. On AWS, this is typically achieved through separate accounts, restrictive cross-account access, and immutable storage settings, rather than a literal physical disconnection, but the security principle is the same: the backup must not be reachable using the same credentials that were just compromised.
In Practice
A ransomware attack that gains administrative access to production but cannot reach the isolated backup account still leaves a clean, unencrypted copy available to restore from.