What is governance mode?
Governance mode is one of the two retention modes of S3 Object Lock. Objects locked in governance mode cannot be deleted or overwritten by ordinary users until their retention date passes, but accounts holding a specific permission can shorten the retention period or remove the lock.
How does governance mode work?
When an object version is written with governance-mode retention, the storage refuses requests to delete or overwrite it before the retain-until date. An account that has been granted the dedicated override permission, and that includes the matching header in its request, can still change or remove the lock. Everyone else is blocked. The mode therefore protects against mistakes and against most compromised accounts, while leaving an escape route for administrators.
How does governance mode differ from compliance mode?
The difference is whether anyone at all can end a lock early.
| Aspect | Governance mode | Compliance mode |
|---|---|---|
| Ordinary users | Cannot delete locked objects | Cannot delete locked objects |
| Accounts with the override permission | Can shorten or remove the lock | Cannot |
| Storage administrators | Can, if granted the permission | Cannot |
| Retention can be extended | Yes | Yes |
| Mode can be changed | Can be raised to compliance | Cannot be lowered |
When is governance mode appropriate?
Governance mode suits situations where flexibility matters more than an absolute guarantee: testing retention settings before committing to them, data sets where a legitimate need to delete early may arise, and environments with tight control over who holds the override permission. It is also a sensible first step when introducing immutability, since a mistaken retention period can be corrected.
What are the limits of governance mode for backups?
For protection against ransomware, the override is the weak point. An attacker who obtains an account with the permission can remove the locks and then the data. If that permission exists in the environment, the protection is only as strong as the security of the accounts that hold it. For the copy that must survive a full administrative compromise, compliance mode removes the question. Object Lock governance versus compliance compares the operational consequences.
Frequently asked questions
Can the root or admin account delete governance-mode objects?
Only if it has the override permission and uses it explicitly. Without that, the lock applies to it as well.
Can a governance-mode lock be upgraded?
Yes. An object's retention can be changed from governance to compliance mode, after which the lock can no longer be lifted early.
Is governance mode enough for compliance regulations?
It depends on the rule. Regulations that require records no person can alter generally point to compliance mode.