What is compliance mode?
Compliance mode is the stricter of the two retention modes of S3 Object Lock. An object version locked in compliance mode cannot be deleted or overwritten by any account, including the most privileged administrator, until its retention date has passed. The retention period cannot be shortened and the mode cannot be changed.
How does compliance mode work?
When the backup software writes an object, it sets a retain-until date and the compliance mode on that object version. From then on the storage system itself refuses every request to delete or alter the version before that date. There is no override permission. The only change allowed is to extend the retention period. When the date passes, the lock ends and the object can be removed by normal retention processing.
Why does it matter that no one can lift the lock?
Most attacks on backups do not break the storage. They use a legitimate administrator account that has been stolen. A control that an administrator can switch off does not stop an attacker who has become that administrator. Compliance mode removes the option for everyone, so the protection does not depend on any credential staying secret.
| Scenario | Outcome in compliance mode |
|---|---|
| Backup server compromised, delete requests sent | Refused by the storage |
| Storage administrator account stolen | Locks cannot be removed |
| Administrator makes a mistake | Locked data remains |
| Retention needs to be shortened | Not possible until the date passes |
| Retention needs to be extended | Allowed |
What are the consequences for planning?
The strength of compliance mode is also its cost. Data locked by mistake, or locked for longer than intended, stays and occupies capacity until the date arrives. Retention periods should therefore be chosen carefully and tested with short values first. Capacity planning has to include the full lock period plus the extra that backup software adds when it extends locks in blocks. And since locks are measured against the storage system's clock, the time source needs protecting. What happens when retention locks expire covers the lifecycle.
How does compliance mode fit into a backup design?
Compliance mode is normally applied to the copy that must survive anything: the immutable copy in the 3-2-1-1-0 rule. Typical lock periods for backups run from a couple of weeks to a few months, long enough to cover the time an intrusion may go unnoticed. Longer periods are used where regulation requires records that cannot be altered. It limits the administrative blast radius of a stolen account to what that account can do outside the locked data.
Frequently asked questions
Can a vendor or support engineer remove a compliance-mode lock?
Not through the S3 interface. The mode is designed so that no account can do so. How a product protects against lower-level tampering is a fair question for the vendor.
What happens if storage fills with locked data?
New backups fail until locks expire or capacity is added. Locked data cannot be deleted to make room.
Can a compliance-mode lock be changed to governance mode?
No. The mode cannot be lowered and the period cannot be shortened.