Improve SPP handling of ICOS retention Vaults

IBM SPP handling of IBM COS Retention Vaults does not guarantee protection of all objects referred in full backups.

Offloading or copying to IBM COS retention vaults is done to offer "Cyber Resiliency" for a certain amount of defined time, for example 8 or 30 days.
First copy from SPP vSnap storage to COS is a full backup, that consists of multiple smaller objects.
On first copy, all objects get a retention protect of set time, i.e. 8 days.
Daily incremental backups create new objects that are stored on vSnap storage and copied to COS. As a result, some objects can be expired from the initial Full Backup list of objects after the retention time has expired, because these objects are changed and newer versions exist.
After the retention time, all objects of the full backup, lose their protection from the COS side. However, these objects are still part of the data that needs to be restored when doing a full restore. Thus, it is possible for Mr. BadSPPAdmin who has access to the COS access keys to the retention Vault, to delete objects from the COS vault while they are still valid.

The incremental objects that are sent to the COS vault have their protection only for set retention time, but because of the nature of incremental backups, some of them may expire, some of them may not. Protection is lost, but they are not expired. For objects that are still valid within the backed up VM but are uploaded to the COS vault longer than the retention time, no protection exists anymore, unless IBM SPP uploads them again or resets protection some way. This would mean a full backup needs to be sent to the COS Vault every time retention expires. (I have witnessed in production that the latter is not the case)

I have been told IBM COS Retention vaults have an API that can reset retention for existing objects, so objects part of a full backup requiring additional protection time (extend retention) can be protected.

For more information, refer to the referenced case TS006482182