What is S3 Object Lock?

S3 Object Lock is a feature of the Amazon S3 API, also offered by many S3-compatible storage systems, that stores object versions as write once, read many (WORM) so they cannot be overwritten or deleted for a set period or indefinitely. It works in governance mode, which privileged users can override, or compliance mode, which no one can override.

What are governance mode and compliance mode?

Governance mode locks object versions against deletion and overwrite, but users granted a special bypass permission can remove the lock or shorten retention. Compliance mode locks object versions so that no user, including the account root user, can remove the lock or shorten retention until it expires. Retention in compliance mode can only be extended.

The difference matters because attackers target privileged accounts. In governance mode, a stolen login with the bypass permission can remove the lock and delete the data. In compliance mode there is nothing to bypass. The trade-off is that a mistake cannot be undone either: a wrong retention date in compliance mode stays in force, and the capacity stays consumed until it ends.

What happens when something tries to overwrite or delete a locked object?

Object Lock applies to object versions, so the bucket has versioning enabled. Writing to the same object name creates a new version and leaves the locked version in place. A request to delete a locked version is refused while the lock holds. A general delete request adds a marker that hides the object from normal listings, while every locked version remains stored and restorable.

What are retention periods and legal holds?

A retention period locks a version until a set date, after which it can be deleted normally. A bucket can carry a default retention that new objects inherit, so backups are locked on arrival. A legal hold has no end date: it stays until a user with the right permission removes it, and it applies independently of retention. Retention suits scheduled backup expiry. Legal holds suit investigations and litigation, where the end date is unknown.

What does a lock not do?

A lock stops changes, not reads. A locked backup can still be read and copied by anyone with read access, so it does not prevent data exfiltration. It also protects only what was written: a backup of an already encrypted system is locked as it is. Whether stored copies are usable is a separate question answered by restore testing.

How does it relate to WORM and immutability?

Immutability is the outcome, WORM is the storage model that delivers it, and Object Lock is the S3 interface that applies it. For retention policy design, the lock date, not the backup application's setting, decides when a copy can be removed. Backup applications that support the feature request a lock as they write, so an immutable backup is locked when it lands.

Frequently asked questions

Does Object Lock work without versioning?

No. Locks apply to object versions, and enabling Object Lock on a bucket also enables versioning.

Can an administrator delete locked data in compliance mode?

Not before the retention date. No user can shorten or remove a compliance-mode lock, including the root user of the account.

Does an object lock protect the whole bucket?

It protects the versions that carry a lock. Objects written without retention or a legal hold are not protected, which is why a default bucket retention is commonly set.

Related terms

• WORM: the storage model Object Lock implements.
• Immutable backup: the outcome the lock produces.
• Retention policy design: choosing lock durations per data class.
• S3-compatible storage: the interface Object Lock belongs to.
• Backup tampering: what the lock refuses.