Manage object lock

For your information

Object locking can be managed by:

• Account Owner;
• users with the member, s3.admin, and object_storage:admin roles;
• users with the s3.bucket.user, s3.user, and object_storage_user roles if the access policy allows them the relevant actions.

If you have Object Lock enabled in the bucket, you can manage object locks. Available lock actions depend on the lock type and mode.

You can manage object locks in the control panel, via the S3 API, and via tools that use it, such as the AWS CLI.

Retention-period lock

Check for a retention-period lock

If you have segmented objects, you cannot check the lock status on individual segments — you can only check the lock on the object itself. Segments inherit the lock settings applied to the object.

Control panel

1. In the control panel, in the top menu, click Products and select S3.
2. Go to Buckets.
3. Open the bucket page → Objects tab.
4. Open the object page.
5. In the Object Lock block, check the retention status.

AWS CLI

1. Open the CLI.

2. If you want to check the lock for a specific object version:

   2.1. Get the object version ID:

   aws s3api list-object-versions --bucket <bucket_name> --prefix <path_to_object>

   Specify:

   • <bucket_name> — bucket name;
   • <path_to_object> — path to the object in the bucket.

   2.2. For the required object version, copy the identifier specified in the VersionId field.

3. Check for the lock:

   aws s3api get-object-retention \
   --bucket <bucket_name> \
   --key <path_to_object> \
   --version-id <version_id>

   Specify:

   • <bucket_name> — bucket name;
   • <path_to_object> — path to the object in the bucket;
   • optional: --version-id <version_id> — parameter that specifies a specific object version. Here, <version_id> is the version ID you copied in step 2.2. If this parameter is omitted, the lock will be checked for the current object version.

Enable retention-period lock

If both a retention-period lock and a legal hold are enabled for an object, the legal hold takes precedence.

To apply default retention to all new objects in the bucket, use the Enable default bucket retention section of the Object Lock instructions.

To upload an object with a lock already applied, use the AWS CLI; for more details, see the Upload object section of the AWS CLI instructions.

Control panel

1. In the control panel, in the top menu, click Products and select S3.

2. Go to Buckets.

3. Open the bucket page → Objects tab.

4. Open the object page.

5. In the Object Lock block, in the Retention line, click Edit.

6. Select the Lock object checkbox.

7. Select a lock mode.

8. Specify the lock duration. Maximum lock duration:

   • for Compliance mode — one year. To set a Compliance lock for more than one year, use the API or tools, such as AWS CLI;
   • for Governance mode — 100 years.

9. Click Save.

AWS CLI

1. Open the CLI.

2. If you want to lock an object version other than the current one:

   2.1. Get the object version ID:

   aws s3api list-object-versions --bucket <bucket_name> --prefix <path_to_object>

   Specify:

   • <bucket_name> — bucket name;
   • <path_to_object> — path to the object in the bucket.

   2.2. For the required object version, copy the identifier specified in the VersionId field.

3. Lock the object:

   aws s3api put-object-retention \
   --bucket <bucket_name> \
   --key <path_to_object> \
   --version-id <version_id> \
   --retention '{"Mode":"<lock_mode>","RetainUntilDate":"<date>"}'

   Specify:

   • <bucket_name> — bucket name;
   • <path_to_object> — path to the object in the bucket;
   • optional: --version-id <version_id> — parameter that specifies a specific object version. Here, <version_id> is the version ID you copied in step 2.2. If this parameter is omitted, the lock will be applied to the current object version;
   • <lock_mode> — lock mode. Possible values are GOVERNANCE or COMPLIANCE;
   • <date> — date until which the object will be locked, in ISO 8601 format, for example, 2025-09-06T00:00:00Z. The object lock retention period cannot exceed 100 years.

Change temporary lock duration

If the lock mode is set to:

• Governance — the lock duration can be shortened or extended;
• Compliance — the lock duration can only be extended.

Control panel

In the control panel, you can only increase the lock period. To decrease the period, use the S3 API or tools that use it, such as the AWS CLI.

1. In the control panel, in the top menu, click Products and select S3.

2. Go to Buckets.

3. Open the bucket page → Objects tab.

4. Open the object page.

5. In the Object Lock block, in the Retention line, click Edit.

6. Specify the new lock duration. Maximum lock duration:

   • for Compliance mode — one year. To set a Compliance lock for more than one year, use the API or tools, such as AWS CLI;
   • for Governance mode — 100 years.

7. Click Save.

AWS CLI

To change the lock period, use the Enable retention section and specify a new value in the RetainUntilDate field.

Change temporary lock mode

You can only change the lock mode from Governance to Compliance.

Control panel

You cannot change the retention mode in the control panel. Use the S3 API or tools that use it, such as the AWS CLI.

AWS CLI

To change the lock mode, use the Enable retention section and in the Mode field, specify the value COMPLIANCE.

Disable temporary lock

You can only disable a temporary lock in Governance mode.

Control panel

Only the Account Owner or a user with the member role can disable retention in the control panel.

1. In the control panel, in the top menu, click Products and select S3.
2. Go to Buckets.
3. Open the bucket page → Objects tab.
4. Open the object page.
5. In the Object Lock block, in the Retention line, click Edit.
6. Clear the Lock object checkbox.
7. Click Save.

AWS CLI

Disabling retention via the AWS CLI can be done by the Account Owner, a user with the member role, or a user with another role with access to S3 if the access policy allows them the action s3:BypassGovernanceRetention.

1. Open the CLI.

2. If you want to disable the lock for a specific object version:

   2.1. Get the object version ID:

   aws s3api list-object-versions --bucket <bucket_name> --prefix <path_to_object>

   Specify:

   • <bucket_name> — bucket name;
   • <path_to_object> — path to the object in the bucket.

   2.2. For the required object version, copy the identifier specified in the VersionId field.

3. Disable the lock:

   aws s3api put-object-retention \
       --bucket <bucket_name> \
       --key "<path_to_object>" \
       --version-id <version_id> \
       --retention '{}' \
       --bypass-governance-retention

   Specify:

   • <bucket_name> — bucket name;
   • <path_to_object> — path to the object in the bucket;
   • optional: --version-id <version_id> — parameter that specifies a specific object version. Here, <version_id> is the version ID you copied in step 2.2. If this parameter is omitted, the lock will be disabled for the current object version.

Legal hold

Check for a legal hold

If you have segmented objects, you cannot check the lock status on individual segments — you can only check the lock on the object itself. Segments inherit the lock settings applied to the object.

Control panel

1. In the control panel, in the top menu, click Products and select S3.
2. Go to Buckets.
3. Open the bucket page → Objects tab.
4. Open the object page.
5. In the Object Lock block, check the legal hold status.

AWS CLI

1. Open the CLI.

2. If you want to check the lock for a specific object version:

   2.1. Get the object version ID:

   aws s3api list-object-versions --bucket <bucket_name> --prefix <path_to_object>

   Specify:

   • <bucket_name> — bucket name;
   • <path_to_object> — path to the object in the bucket.

   2.2. For the required object version, copy the identifier specified in the VersionId field.

3. Check for the lock:

   aws s3api get-object-legal-hold \
       --bucket <bucket_name> \
       --key <path_to_object> \
       --version-id <version_id>

   Specify:

   • <bucket_name> — bucket name;
   • <path_to_object> — path to the object in the bucket;
   • optional: --version-id <version_id> — parameter that specifies a specific object version. Here, <version_id> is the version ID you copied in step 2.2. If this parameter is omitted, the lock will be checked for the current object version.

Enable legal hold

If both a temporary lock and a legal hold are enabled for an object at the same time, the legal hold has priority.

Control panel

1. In the control panel, in the top menu, click Products and select S3.
2. Go to Buckets.
3. Open the bucket page → Objects tab.
4. Open the object page.
5. In the Object Lock block, enable legal hold.

AWS CLI

1. Open the CLI.

2. If you want to lock an object version other than the current one:

   2.1. Get the object version ID:

   aws s3api list-object-versions --bucket <bucket_name> --prefix <path_to_object>

   Specify:

   • <bucket_name> — bucket name;
   • <path_to_object> — path to the object in the bucket.

   2.2. For the required object version, copy the identifier specified in the VersionId field.

3. Lock the object:

   aws s3api put-object-legal-hold \
       --bucket <bucket_name> \
       --key <path_to_object> \
       --version-id <version_id> \
       --legal-hold '{"Status": "ON"}'

   Specify:

   • <bucket_name> — bucket name;
   • <path_to_object> — path to the object in the bucket;
   • optional: --version-id <version_id> — parameter that specifies a specific object version. Here, <version_id> is the version ID you copied in step 2.2. If this parameter is omitted, the lock will be applied to the current object version.

Disable legal hold

Control panel

1. In the control panel, in the top menu, click Products and select S3.
2. Go to Buckets.
3. Open the bucket page → Objects tab.
4. Open the object page.
5. In the Object Lock block, disable legal hold.

AWS CLI

1. Open the CLI.

2. If you want to disable the lock for an object version other than the current one:

   2.1. Get the object version ID:

   aws s3api list-object-versions --bucket <bucket_name> --prefix <path_to_object>

   Specify:

   • <bucket_name> — bucket name;
   • <path_to_object> — path to the object in the bucket.

   2.2. For the required object version, copy the identifier specified in the VersionId field.

3. Disable the lock:

   aws s3api put-object-legal-hold \
       --bucket <bucket_name> \
       --key <path_to_object> \
       --version-id <version_id> \
       --legal-hold '{"Status": "OFF"}'

   Specify:

   • <bucket_name> — bucket name;
   • <path_to_object> — path to the object in the bucket;
   • optional: --version-id <version_id> — parameter that specifies a specific object version. Here, <version_id> is the version ID you copied in step 2.2. If this parameter is omitted, the lock will be removed from the current object version.