Object Lock

Object Lock uses the WORM (Write Once Read Many) principle and allows you to lock objects to prevent them from being overwritten or deleted.

To use Object Lock, a bucket must have versioning enabled. Object Lock applies only to object versions.

Locking can be of different types and modes. Depending on the lock type, it can be applied to individual objects or to a bucket by default — the lock will then be applied to new objects.

The ability to manage a lock also depends on the user role and bucket policy rules; more details are in the Managing access in S3 guide. You can work with Object Lock in the Control Panel (with limited capabilities), via the S3 API, and tools that use it, for example, AWS CLI.

To manage object locks after configuring Object Lock, use the Managing object locks guide.

If you delete a project that contains locked objects, they will not be deleted while the lock is active. However, they will not be displayed in the Control Panel or via the API. To restore locked objects after a project has been deleted, create a ticket.

Types and retention modes

A lock can be temporary or indefinite. A temporary lock has two modes: Governance and Compliance.

If both a temporary and an indefinite lock are enabled for an object, the indefinite lock takes precedence.

	Indefinite	Temporary
		Governance mode	Compliance mode
What can it be applied to	Objects	to objects; to the default bucket — the lock will be applied to all new objects	to objects; to the default bucket — the lock will be applied to all new objects
Possible locking actions	Disabling the lock	shortening the lock duration *; extending the lock duration; changing the locking mode to Compliance	Extending the lock duration
Ability to delete objects	No one can while the lock is enabled	You can *	No one can until the lock expiration date

* Available only to users:

• with the member role;
• with other roles with S3 access, if the bucket has a bucket policy that allows the action s3:BypassGovernance.

Enable Object Lock in a bucket

For your information

Object Lock can be enabled by:

• The account owner;
• users with the member, s3.admin and object_storage:admin; roles;
• users with the s3.bucket.user, s3.user and object_storage_user roles, if the bucket policy allows them the action s3:PutBucketObjectLockConfiguration.

If you enable Object Lock, it cannot be disabled, and versioning cannot be suspended.

Enabling Object Lock does not lock objects automatically. After configuring Object Lock in a bucket, you can:

• manage object locks;
• upload objects with an active lock (using only S3 API and tools that use it);
• manage the default retention lock in the bucket.

Control panel

If versioning is disabled or suspended in a bucket, it will be enabled automatically when Object Lock is enabled.

1. In the control panel, on the top menu, click Products and select S3.

2. Go to the Buckets section.

3. Open the bucket page → Configuration tab.

4. In the Data protection block, in the Object Lock row, click Edit.

5. Select the Enable Object Lock checkbox.

6. Optional: enable default retention in the bucket:

   6.1.Select the Enable default retention checkbox.

   6.2.Select the lock mode.

   6.3.Specify the lock duration.

   You can manage the default retention lock even after enabling Object Lock.

7. Click Save.

AWS CLI

1. Make sure you have versioning enabled.

2. If you have not used AWS CLI, configure it.

3. Open the CLI.

4. Enable Object Lock:

   aws s3api put-object-lock-configuration \
       --bucket "<bucket_name>" \
       --object-lock-configuration '{
           "ObjectLockEnabled": "Enabled"}'

   Specify <bucket_name> — the bucket name.

5. Ensure that Object Lock is enabled:

   aws s3api get-object-lock-configuration --bucket "<bucket_name>"

   Specify <bucket_name> — the bucket name.

   If Object Lock is enabled, the following response will be returned:

   {
       "ObjectLockConfiguration": {
           "ObjectLockEnabled": "Enabled"
       }
   }

Managing default retention in a bucket

For your information

Default retention can be managed by:

• The account owner;
• users with the member, s3.admin and object_storage:admin; roles;
• users with the s3.bucket.user, s3.user and object_storage_user roles, if the bucket policy allows them the appropriate actions.

Enable default retention

The retention lock will be applied to all new objects in the bucket.

Control panel

1. In the control panel, on the top menu, click Products and select S3.
2. Go to the Buckets section.
3. Open the bucket page → Configuration tab.
4. In the Data protection block, in the Object Lock row, click Edit.
5. Make sure the Enable Object Lock checkbox is selected.
6. Select the Enable default retention checkbox.
7. Select the lock mode.
8. Specify the lock duration.
9. Click Save.

AWS CLI

1. Open the CLI.

2. Enable default retention in a bucket:

   aws s3api put-object-lock-configuration \
       --bucket "<bucket_name>" \
       --object-lock-configuration '{
           "ObjectLockEnabled": "Enabled",
           "Rule": { "DefaultRetention": { "Mode": "<lock_mode>", "<time_gap>": <number> } }
   }'

   Specify:

   • <bucket_name> — the bucket name;
   • <lock_mode> — the lock mode. Possible values are GOVERNANCE or COMPLIANCE;
   • <time_gap> — the time unit for the lock duration. Possible values are DAYS or YEARS;
   • <number> — the lock duration in days or years. It cannot exceed one year or 365 days.

3. Ensure that default retention is enabled in the bucket:

   aws s3api get-object-lock-configuration --bucket "<bucket_name>"

   Specify <bucket_name> — the bucket name.

   Example response when default retention is enabled:

   {
       "ObjectLockConfiguration": {
           "ObjectLockEnabled": "Enabled",
           "Rule": {
               "DefaultRetention": {
                   "Mode": "GOVERNANCE",
                   "Days": 30
               }
           }
       }
   }

Changing the default retention duration

If the lock mode is set to:

• Governance — the lock duration can be shortened or extended;
• Compliance — the lock duration can only be extended.

Control panel

1. In the control panel, on the top menu, click Products and select S3.
2. Go to the Buckets section.
3. Open the bucket page → Configuration tab.
4. In the Data protection block, in the Object Lock row, click Edit.
5. Specify the new lock duration.
6. Click Save.

AWS CLI

To change the lock duration, use the Enable default retention subsection and specify new values for the <time_gap> and <number> parameters;.

Changing the default retention mode

You can only change the lock mode from Governance to Compliance.

Control panel

1. In the control panel, on the top menu, click Products and select S3.
2. Go to the Buckets section.
3. Open the bucket page → Configuration tab.
4. In the Data protection block, in the Object Lock row, click Edit.
5. Select the Compliance lock mode.
6. Specify the lock duration.
7. Click Save.

AWS CLI

To change the lock mode, use the Enable default retention subsection and specify COMPLIANCE in the <lock_mode> parameter.

Disabling default retention

You can only disable default retention in the Governance mode.

When you disable a temporary lock, new objects will not be locked. Objects that were uploaded and automatically locked before the temporary default lock was disabled will remain locked according to the lock mode. Object Lock itself will not be disabled in the bucket.

Control panel

Only the account owner or a user with the member role can disable default retention in the control panel.

1. In the control panel, on the top menu, click Products and select S3.
2. Go to the Buckets section.
3. Open the bucket page → Configuration tab.
4. In the Data protection block, in the Object Lock row, click Edit.
5. Clear the Enable default retention checkbox.
6. Click Save.

AWS CLI

The account owner, a user with the member role, or a user with another role with S3 access can disable default retention via AWS CLI, if the bucket policy allows them the action s3:BypassGovernanceRetention.

1. Open the CLI.

2. Disable default retention in a bucket:

   aws s3api put-object-lock-configuration \
       --bucket "<bucket_name>" \
       --object-lock-configuration '{
           "ObjectLockEnabled": "Enabled"
   }'

   Specify <bucket_name> — the bucket name.

3. Ensure that default retention is disabled in the bucket:

   aws s3api get-object-lock-configuration --bucket "<bucket_name>"

   Specify <bucket_name> — the bucket name.

   Example response when default retention is disabled:

   {
       "ObjectLockConfiguration": {
           "ObjectLockEnabled": "Enabled"
       }
   }