Object Lock

Object Lock uses the WORM (Write Once Read Many) principle and allows you to lock objects to prevent them from being overwritten or deleted.

To use Object Lock, the bucket must have versioning enabled. Object lock applies only to object versions.

Locking can be of different types and modes. Depending on the lock type, it can be set on individual objects or on a bucket by default — the lock will apply to new objects.

The ability to manage locks also depends on the user role and bucket policy rules; for details, see the Manage access to S3 manual. You can work with Object Lock in the control panel (capabilities are limited), via the S3 API, and via tools that use it, such as the AWS CLI.

To manage object locking after configuring Object Lock, use the Manage object locking manual.

If you delete a project that contains locked objects, they will not be deleted while the lock is active. However, they will not be displayed in the control panel and via the API. To restore locked objects after deleting a project, submit a ticket.

Types and retention modes

Locking can be temporary or indefinite. Temporary locking has two modes: Governance and Compliance.

If both a temporary and an indefinite lock are enabled for an object, the indefinite lock takes precedence.

	Indefinite	Temporary
		Governance mode	Compliance mode
What can it be applied to	Objects	to objects; to the default bucket — the lock will be applied to all new objects	to objects; to the default bucket — the lock will be applied to all new objects
Possible locking actions	Disabling the lock	shortening the lock retention period *; extending the lock duration; changing the locking mode to Compliance	Extending the lock duration
Ability to delete objects	No one can while the lock is enabled	Allowed *	No one can until the lock expiration date

* Available only to users:

• with the member role;
• with other roles with access to S3 if the bucket has a bucket policy that allows the action s3:BypassGovernance.

Enable Object Lock in a bucket

For your information

Object Lock can be enabled by:

• Account Owner;
• users with the roles member, s3.admin, and object_storage:admin;
• users with the roles s3.bucket.user, s3.user, and object_storage_user if the bucket policy allows them the action s3:PutBucketObjectLockConfiguration.

Once you enable Object Lock, you cannot disable it or suspend versioning.

Enabling Object Lock does not lock objects automatically. After configuring Object Lock in a bucket, you will be able to:

• manage object locking;
• upload objects with active locking right away (only via the S3 API and tools that use it);
• manage default retention in a bucket.

Control panel

If versioning is disabled or suspended in a bucket, it will be enabled automatically when Object Lock is enabled.

1. In the Control panel, in the top menu, click Products and select S3.

2. Go to Buckets.

3. Open the bucket page → Configuration tab.

4. In the Data protection block, in the Object Lock line, click Edit.

5. Select the Enable Object Lock checkbox.

6. Optional: enable default retention in the bucket:

   6.1.Select the Enable default retention checkbox.

   6.2.Select a lock mode.

   6.3.Specify the lock duration. The maximum lock duration is:

   • for Compliance mode — one year. To set a Compliance lock for more than one year, use the API or tools, such as AWS CLI;
   • for Governance mode — 100 years.

   You can manage default retention even after enabling Object Lock.

7. Click Save.

AWS CLI

1. Make sure that you have versioning enabled.

2. If you haven't used the AWS CLI, configure it.

3. Open the CLI.

4. Enable Object Lock:

   aws s3api put-object-lock-configuration \
       --bucket "<bucket_name>" \
       --object-lock-configuration '{
           "ObjectLockEnabled": "Enabled"}'

   Specify <bucket_name> — bucket name.

5. Verify that Object Lock is enabled:

   aws s3api get-object-lock-configuration --bucket "<bucket_name>"

   Specify <bucket_name> — bucket name.

   When Object Lock is enabled, the response will be:

   {
       "ObjectLockConfiguration": {
           "ObjectLockEnabled": "Enabled"
       }
   }

Managing default retention in a bucket

For your information

Default retention can be managed by:

• Account Owner;
• users with the roles member, s3.admin, and object_storage:admin;
• users with the roles s3.bucket.user, s3.user, and object_storage_user if the bucket policy allows them the corresponding actions.

Enable default retention

The temporary lock will be applied to all new objects in the bucket.

Control panel

1. In the Control panel, in the top menu, click Products and select S3.

2. Go to Buckets.

3. Open the bucket page → Configuration tab.

4. In the Data protection block, in the Object Lock line, click Edit.

5. Make sure that the Enable Object Lock checkbox is selected.

6. Select the Enable default retention checkbox.

7. Select a lock mode.

8. Specify the lock duration. The maximum lock duration is:

   • for Compliance mode — one year. To set a Compliance lock for more than one year, use the API or tools, such as AWS CLI;
   • for Governance mode — 100 years.

9. Click Save.

AWS CLI

1. Open the CLI.

2. Enable default retention in the bucket:

   aws s3api put-object-lock-configuration \
       --bucket "<bucket_name>" \
       --object-lock-configuration '{
           "ObjectLockEnabled": "Enabled",
           "Rule": { "DefaultRetention": { "Mode": "<lock_mode>", "<time_gap>": <number> } }
   }'

   Specify:

   • <bucket_name> — bucket name;
   • <lock_mode> — lock mode. Possible values are GOVERNANCE or COMPLIANCE;
   • <time_gap> — time unit used to measure the retention period. Possible values are DAYS or YEARS;
   • <number> — lock period in days or years. Cannot exceed 100 years.

3. Verify that default retention is enabled in the bucket:

   aws s3api get-object-lock-configuration --bucket "<bucket_name>"

   Specify <bucket_name> — bucket name.

   Example response when default retention is enabled:

   {
       "ObjectLockConfiguration": {
           "ObjectLockEnabled": "Enabled",
           "Rule": {
               "DefaultRetention": {
                   "Mode": "GOVERNANCE",
                   "Days": 30
               }
           }
       }
   }

Change default retention duration

If the lock mode is:

• Governance — the lock duration can be shortened or extended;
• Compliance — the lock duration can only be extended.

Control panel

1. In the Control panel, in the top menu, click Products and select S3.

2. Go to Buckets.

3. Open the bucket page → Configuration tab.

4. In the Data protection block, in the Object Lock line, click Edit.

5. Specify a new lock duration. The maximum lock duration is:

   • for Compliance mode — one year. To set a Compliance lock for more than one year, use the API or tools, such as AWS CLI;
   • for Governance mode — 100 years.

6. Click Save.

AWS CLI

To change the retention period, use the Enable default retention section and specify new values for the <time_gap> and <number> parameters.

Change default retention mode

You can only change the lock mode from Governance to Compliance.

Control panel

1. In the Control panel, in the top menu, click Products and select S3.
2. Go to Buckets.
3. Open the bucket page → Configuration tab.
4. In the Data protection block, in the Object Lock line, click Edit.
5. Select the Compliance lock mode.
6. Specify the lock duration. The maximum Compliance lock duration is one year. To set a Compliance lock for more than one year, use the API or tools, such as AWS CLI.
7. Click Save.

AWS CLI

To change the lock mode, use the Enable default retention section and in the <lock_mode> parameter, specify COMPLIANCE.

Disable default retention

You can only disable default retention in Governance mode.

When default retention is disabled, new objects will not be locked. Objects that were uploaded and automatically locked before default retention was disabled will remain locked according to the lock mode. Object Lock itself will not be disabled in the bucket.

Control panel

Only the Account Owner or a user with the member role can disable default retention in the control panel.

1. In the Control panel, in the top menu, click Products and select S3.
2. Go to Buckets.
3. Open the bucket page → Configuration tab.
4. In the Data protection block, in the Object Lock line, click Edit.
5. Clear the Enable default retention checkbox.
6. Click Save.

AWS CLI

The Account Owner, a user with the member role, or a user with another role with access to S3 can disable default retention via the AWS CLI if the bucket policy allows them the action s3:BypassGovernanceRetention.

1. Open the CLI.

2. Disable default retention in the bucket:

   aws s3api put-object-lock-configuration \
       --bucket "<bucket_name>" \
       --object-lock-configuration '{
           "ObjectLockEnabled": "Enabled"
   }'

   Specify <bucket_name> — bucket name.

3. Verify that default retention is disabled in the bucket:

   aws s3api get-object-lock-configuration --bucket "<bucket_name>"

   Specify <bucket_name> — bucket name.

   Example response when default retention is disabled:

   {
       "ObjectLockConfiguration": {
           "ObjectLockEnabled": "Enabled"
       }
   }