Understanding Object Lock for Amazon S3

Introduction

S3 Object Lock can help prevent Amazon S3 objects from being deleted or overwritten for a fixed amount of time or indefinitely. Object Lock uses a write-once-read-many (WORM) model to store objects. You can use Object Lock to help meet regulatory requirements that require WORM storage, or to add another layer of protection against object changes or deletion.

Object Lock provides two ways to manage object retention: retention periods and legal holds. An object version can have a retention period, a legal hold, or both.

• Retention period – A retention period specifies a fixed period of time during which an object remains locked. You can set a unique retention period for individual objects.

• Legal hold – A legal hold provides the same protection as a retention period, but it has no expiration date. Instead, a legal hold remains in place until you explicitly remove it. Legal holds are independent from retention periods and are placed on individual object versions.

Object Lock works only in buckets that have S3 Versioning enabled. When you lock an object version, Amazon S3 stores the lock information in the metadata for that object version. Placing a retention period or a legal hold on an object protects only the version that's specified in the request. Retention periods and legal holds don't prevent new versions of the object from being created, or delete markers to be added on top of the object. For information about S3 Versioning, see Using versioning in S3 buckets.

If you put an object into a bucket that already contains an existing protected object with the same object key name, Amazon S3 creates a new version of that object. The existing protected version of the object remains locked according to its retention configuration.

Steps for Object Lock in Amazon S3

1. Open the AWS Management Console and navigate to the S3 dashboard.

2. Click Create bucket.

   

3. Select General purpose bucket type.

   

4. Write a bucket name, this name must be globally unique.

   

5. Select ACLs enabledObject Ownership.

6. Uncheck Block all public access -> Check the Acknowledgement.

   

7. Enable Bucket Versioning.

   

8. Under Additional setting, enable Object Lock.

   

9. Click Create bucket.

10. Open the newly created bucket by clicking on its name.

11. Click Properties.

    

12. Scroll and click Edit on Object Lock.

    

13. Enable Default retention, set Default retention mode to Governance, and set Default retention period to 1 Days.

    Governance: Users with specific IAM permissions can overwrite or delete protected object versions during the retention period.

    Compliance: No users can overwrite or delete protected object versions during the retention period.

    

14. Click Save changes.

15. Now Click on Objects.

16. Click Upload.

    

17. Now click on Add files.

    

18. Select any file you want to upload.

19. Scroll and click Upload.

20. Select the file and permanently delete the file. You'll see the file is permanently deleted. The reason for this is that the file is in Governance lock.

    Note: Make sure Show Versions is enabled while you delete the file. If it is not, while will not be permanently deleted.

    

21. Now upload the file again.

22. Open the file by clicking on its name.

23. Under Properties, Edit Object Lock retention.

    

24. Set Retention mode to Compliance mode.

    Note: You'll not be able to delete the file before the retention period.

    

25. Click Save Changes.

26. Now select the object and try to permanently delete the file. You'll get an error when you try. Wait until the retention period is over, then you will be able to delete it.