Use case · Data and backups

Guard object storage sync and deletion across clouds

Make cross-cloud object deletion and sync-with-delete operations require a decision instead of running from a script unnoticed.

Object storage holds the copies that everything else depends on, and every major CLI has a command shape that deletes more than the author expected. The catalog documents S3, Azure Blob Storage, Google Cloud Storage, and MinIO coverage with reviewed deletion operations and cataloged defaults for reads.

Evidence grade: reviewed catalog facts · Last reviewed 2026-09-12

Every step below references coverage documented in the HOL Guard extension catalog. These workflows are derived from reviewed catalog facts, not independently run or benchmarked — verify the result in your own setup before relying on it.

When this is not the right fit

Skip this workflow if

  • The workload talks to object storage through an SDK instead of a CLI — these entries document command-line operations.
  • You are deleting whole cloud resources rather than objects inside them — the cloud-teardown workflow covers resource deletion.

Prerequisites

Before you start

  • Guard is installed on the machine that runs the storage commands.
  • The storage CLIs in use (aws, az, gcloud/gsutil, mc) are the ones your scripts actually call.

Steps

The workflow

  1. 1

    Review S3 sync and deletion

    The Amazon S3 entry reviews AWS CLI high-level S3 commands and S3 API object, bucket, access-control, and configuration operations including copy, list, sync, website, and deletion.

    Amazon S3 command protectionTry this coverage Coverage details
  2. 2

    Review Azure Blob Storage deletion

    The Azure Blob Storage entry reviews blob and container deletion including az storage blob delete, delete-batch, and az storage container delete.

    Azure Blob Storage command protectionTry this coverage Coverage details
  3. 3

    Review Google Cloud Storage deletion and rsync

    The Google Cloud Storage entry reviews gcloud storage rm, gcloud storage buckets delete, gcloud storage rsync --delete-unmatched-destination-objects, gsutil rm, and gsutil rsync -d.

    Google Cloud Storage command protectionTry this coverage Coverage details
  4. 4

    Review MinIO client deletion

    The MinIO entry reviews mc rm, mc rb, and mc mirror --remove as critical-severity deletion operations.

    MinIO command protectionTry this coverage Coverage details

Expected result

What the documented coverage should do

Cross-cloud deletion and sync-with-delete operations pause for review before executing. In these catalog entries, low-severity read operations such as blob or bucket listing carry an allow default, so routine reads keep flowing while destructive writes are decided.

Limitations

What this workflow does not claim

  • Coverage follows the reviewed operations in the catalog; SDK-level access is not covered.
  • Per the catalog’s stated limitations, coverage is limited to the reviewed operations and the surrounding Guard policy.

Coverage referenced

Extensions in this workflow