Object Lock

What Object Lock is and how it works

According to the AWS documentation, S3 Object Lock uses a write-once-read-many (WORM) model to prevent objects from being deleted or overwritten for a fixed or variable amount of time, or indefinitely. It works only in buckets with S3 Versioning enabled, and it protects individual object versions.

There are two tools. A retention period locks a version until a retain-until date, set per object or as a bucket default in days or years, in one of two modes. In governance mode, users cannot delete or alter the lock unless they have special permissions. In compliance mode, no user can delete or overwrite the version, including the account's root user, and the mode cannot be changed or the period shortened. A legal hold gives the same protection with no expiry date until someone with the right permission removes it, and it is independent of any retention period.

A version can carry a retention period, a legal hold, or both.

How to enable and test Object Lock

Per AWS's configuration guide, you enable versioning and Object Lock on a bucket before locking anything, and after you enable Object Lock you cannot disable it or suspend versioning. Start in governance mode, which AWS suggests for testing retention settings before committing to compliance mode.

# New bucket with Object Lock (add your usual region options)
aws s3api create-bucket --bucket BUCKET --object-lock-enabled-for-bucket

# Default retention: 30 days, governance mode
aws s3api put-object-lock-configuration --bucket BUCKET --object-lock-configuration '{ "ObjectLockEnabled": "Enabled", "Rule": { "DefaultRetention": { "Mode": "GOVERNANCE", "Days": 30 }}}'

# Inspect what is configured
aws s3api get-object-lock-configuration --bucket BUCKET
aws s3api get-object-retention --bucket BUCKET --key backup.tar.gz

Then test with a throwaway object: a permanent delete that names a version ID should fail with 403 Access Denied, according to the same documentation.

Limits and common mistakes

• It locks versions, not the key. Retention and legal holds protect only the version they are placed on and do not stop new versions or delete markers. A simple DELETE returns 200 OK and adds a delete marker, while a permanent delete of a locked version is refused.
• It is hard to undo. In compliance mode the documented way to delete an object early is to delete the whole AWS account, so a wrong retain-until date becomes a storage bill.
• Governance mode has a bypass. Anyone holding s3:BypassGovernanceRetention who sends the bypass header can override it, and the console sends that header by default. Anyone with s3:PutObjectRetention can extend retention.
• Side effects. Buckets with Object Lock cannot be destinations for server access logs.
• Other providers. Some S3-compatible and non-AWS services offer similar immutability under other names. Behaviour differs, so read your provider's own documentation; this page verifies AWS only.
• Not a backup by itself. A locked bucket holds whatever you wrote, so you still need restore tests.

Where Object Lock fits in hardening

Object Lock answers a specific question: can an attacker with the server's credentials erase the backups? CISA's #StopRansomware Guide recommends enabling delete protection or object lock on storage that ransomware often targets. It also cautions that immutable storage does not meet compliance criteria for certain regulations and that misconfiguration can be costly.

In practice, send one backup copy to a locked bucket, and give the credentials the VPS uses permission to write only, without delete, bypass or retention rights. Make the retention period longer than the time you need to notice a problem, because a lock protects only what it covers. This extends the 3-2-1 rule with an immutable copy, as laid out in the VPS backup strategy guide. For the wider picture, see the ransomware protection guide, and keep the writer account on least privilege. Test restores regularly, since a lock preserves data but does not prove it can be recovered.

Related terms: Backup rule (3-2-1), Ransomware, RPO and RTO, Least privilege, Recovered vs verified.