Manage object lock

For your information

Object locking can be managed by:

• Account owner;
• users with the member, s3.admin and object_storage:admin roles;
• users with the s3.bucket.user, s3.user, and object_storage_user roles, if their access policy allows them the corresponding actions.

If Object Lock is enabled in your bucket, you can manage object locks. Available lock actions depend on the lock type and mode.

Object locking can be managed in the control panel, through S3 API, and tools that use it—for example, AWS CLI.

Retention-period lock

Check for a retention-period lock

If you have objects with segments, you cannot check the lock status on individual segments; you can only check the lock on the object itself. Segments inherit the lock settings applied to the object.

Control panel

1. In the control panel, on the top menu, click Products and select S3.
2. Go to the Buckets section.
3. Open the bucket page → Objects tab.
4. Open the object page.
5. In the Object Lock block, check the retention-period lock status.

AWS CLI

1. Open the CLI.

2. If you want to check the lock for a specific object version:

   2.1. Get the object version ID:

   aws s3api list-object-versions --bucket <bucket_name> --prefix <path_to_object>

   Specify:

   • <bucket_name> — bucket name;
   • <path_to_object> — path to the object in the bucket.

   2.2. Copy the ID of the required object version from the VersionId field.

3. Check for the lock:

   aws s3api get-object-retention \
   --bucket <bucket_name> \
   --key <path_to_object> \
   --version-id <version_id>

   Specify:

   • <bucket_name> — bucket name;
   • <path_to_object> — path to the object in the bucket;
   • optional: --version-id <version_id> — parameter specifying a specific object version. Here, <version_id> is the version ID copied in step 2.2. If this parameter is not specified, the lock is checked for the current object version.

Enable retention-period lock

If both a retention-period lock and a legal hold are enabled for an object, the legal hold takes precedence.

To have the retention-period lock applied to all new objects in a bucket by default, use the Enable retention-period lock in a bucket by default section of the Object Lock guide.

To upload an object with a lock enabled immediately, use AWS CLI; for details, see the Upload object section of the AWS CLI guide.

Control panel

1. In the control panel, on the top menu, click Products and select S3.

2. Go to the Buckets section.

3. Open the bucket page → Objects tab.

4. Open the object page.

5. In the Object Lock block, in the Retention-period lock row, click Edit.

6. Select the Lock object checkbox.

7. Select a lock mode.

8. Specify the lock duration. Maximum lock duration:

   • for Compliance mode — one year. To set a Compliance lock for more than one year, use the API or tools, such as AWS CLI;
   • for Governance mode — 100 years.

9. Click Save.

AWS CLI

1. Open the CLI.

2. If you want to lock an object version other than the current one:

   2.1. Get the object version ID:

   aws s3api list-object-versions --bucket <bucket_name> --prefix <path_to_object>

   Specify:

   • <bucket_name> — bucket name;
   • <path_to_object> — path to the object in the bucket.

   2.2. For the required object version, copy the ID specified in the VersionId field.

3. Lock the object:

   aws s3api put-object-retention \
   --bucket <bucket_name> \
   --key <path_to_object> \
   --version-id <version_id> \
   --retention '{"Mode":"<lock_mode>","RetainUntilDate":"<date>"}'

   Specify:

   • <bucket_name> — bucket name;
   • <path_to_object> — path to the object in the bucket;
   • optionally: --version-id <version_id> — a parameter that points to a specific version of the object. Here <version_id> is the version ID you copied in step 2.2. If you do not specify the parameter, the lock will be applied to the current object version;
   • <lock_mode> — lock mode. Possible values are GOVERNANCE or COMPLIANCE;
   • <date> — the date until which the object will be locked, in ISO 8601 format, for example 2025-09-06T00:00:00Z. The object lock duration cannot exceed 100 years.

Change temporary lock duration

If the lock mode is set to:

• Governance — the lock duration can be shortened or extended;
• Compliance — the lock duration can only be extended.

Control panel

In the Control Panel, you can only extend the lock duration. To reduce the duration, use the S3 API or tools that use it, such as AWS CLI.

1. In the control panel, on the top menu, click Products and select S3.

2. Go to the Buckets section.

3. Open the bucket page → Objects tab.

4. Open the object page.

5. In the Object Lock block, in the Temporary lock row, click Edit.

6. Specify the new lock duration. Maximum lock duration:

   • for Compliance mode — one year. To set a Compliance lock for more than one year, use the API or tools, such as AWS CLI;
   • for Governance mode — 100 years.

7. Click Save.

AWS CLI

To change the lock duration, use the Enable temporary lock subsection and specify the new value in the RetainUntilDate field.

Change temporary lock mode

You can only change the lock mode from Governance to Compliance.

Control panel

You cannot change the retention mode in the Control Panel. Use the S3 API or tools that use it, such as AWS CLI.

AWS CLI

To change the lock mode, use the Enable temporary lock subsection and specify Mode as COMPLIANCE.

Disable temporary lock

You can only disable a temporary lock in Governance mode.

Control panel

In the control panel, a temporary lock can only be disabled by the Account Owner or a user with the member role.

1. In the control panel, on the top menu, click Products and select S3.
2. Go to the Buckets section.
3. Open the bucket page → Objects tab.
4. Open the object page.
5. In the Object Lock block, in the Temporary lock row, click Edit.
6. Uncheck the Lock object checkbox.
7. Click Save.

AWS CLI

The temporary lock can be disabled via AWS CLI by the Account Owner, a user with the member role, or a user with another role with access to S3 if their access policy allows them the action s3:BypassGovernanceRetention.

1. Open the CLI.

2. If you want to disable the lock for a specific object version:

   2.1. Get the object version ID:

   aws s3api list-object-versions --bucket <bucket_name> --prefix <path_to_object>

   Specify:

   • <bucket_name> — bucket name;
   • <path_to_object> — path to the object in the bucket.

   2.2. For the required object version, copy the ID specified in the VersionId field.

3. Disable the lock:

   aws s3api put-object-retention \
       --bucket <bucket_name> \
       --key "<path_to_object>" \
       --version-id <version_id> \
       --retention '{}' \
       --bypass-governance-retention

   Specify:

   • <bucket_name> — bucket name;
   • <path_to_object> — path to the object in the bucket;
   • optionally: --version-id <version_id> — a parameter that points to a specific version of the object. Here <version_id> is the version ID you copied in step 2.2. If you do not specify the parameter, the lock will be disabled for the current object version.

Legal hold

Check for a legal hold

If you have objects with segments, you cannot check the lock status on individual segments; you can only check the lock on the object itself. Segments inherit the lock settings applied to the object.

Control panel

1. In the control panel, on the top menu, click Products and select S3.
2. Go to the Buckets section.
3. Open the bucket page → Objects tab.
4. Open the object page.
5. In the Object Lock block, check the status of the legal hold.

AWS CLI

1. Open the CLI.

2. If you want to check the lock for a specific object version:

   2.1. Get the object version ID:

   aws s3api list-object-versions --bucket <bucket_name> --prefix <path_to_object>

   Specify:

   • <bucket_name> — bucket name;
   • <path_to_object> — path to the object in the bucket.

   2.2. For the required object version, copy the ID specified in the VersionId field.

3. Check for the lock:

   aws s3api get-object-legal-hold \
       --bucket <bucket_name> \
       --key <path_to_object> \
       --version-id <version_id>

   Specify:

   • <bucket_name> — bucket name;
   • <path_to_object> — path to the object in the bucket;
   • optionally: --version-id <version_id> — a parameter that points to a specific version of the object. Here <version_id> is the version ID you copied in step 2.2. If you do not specify the parameter, the lock will be checked for the current object version.

Enable legal hold

If both a temporary lock and a legal hold are enabled for an object at the same time, the legal hold has priority.

Control panel

1. In the control panel, on the top menu, click Products and select S3.
2. Go to the Buckets section.
3. Open the bucket page → Objects tab.
4. Open the object page.
5. In the Object Lock block, enable the legal hold.

AWS CLI

1. Open the CLI.

2. If you want to lock an object version other than the current one:

   2.1. Get the object version ID:

   aws s3api list-object-versions --bucket <bucket_name> --prefix <path_to_object>

   Specify:

   • <bucket_name> — bucket name;
   • <path_to_object> — path to the object in the bucket.

   2.2. For the required object version, copy the ID specified in the VersionId field.

3. Lock the object:

   aws s3api put-object-legal-hold \
       --bucket <bucket_name> \
       --key <path_to_object> \
       --version-id <version_id> \
       --legal-hold '{"Status": "ON"}'

   Specify:

   • <bucket_name> — bucket name;
   • <path_to_object> — path to the object in the bucket;
   • optionally: --version-id <version_id> — a parameter that points to a specific version of the object. Here <version_id> is the version ID you copied in step 2.2. If you do not specify the parameter, the lock will be applied to the current object version.

Disable legal hold

Control panel

1. In the control panel, on the top menu, click Products and select S3.
2. Go to the Buckets section.
3. Open the bucket page → Objects tab.
4. Open the object page.
5. In the Object Lock block, disable the legal hold.

AWS CLI

1. Open the CLI.

2. If you want to disable the lock for an object version other than the current one:

   2.1. Get the object version ID:

   aws s3api list-object-versions --bucket <bucket_name> --prefix <path_to_object>

   Specify:

   • <bucket_name> — bucket name;
   • <path_to_object> — path to the object in the bucket.

   2.2. For the required object version, copy the ID specified in the VersionId field.

3. Disable the lock:

   aws s3api put-object-legal-hold \
       --bucket <bucket_name> \
       --key <path_to_object> \
       --version-id <version_id> \
       --legal-hold '{"Status": "OFF"}'

   Specify:

   • <bucket_name> — bucket name;
   • <path_to_object> — path to the object in the bucket;
   • optionally: --version-id <version_id> — a parameter that points to a specific version of the object. Here <version_id> is the version ID you copied in step 2.2. If you do not specify the parameter, the lock will be removed from the current object version.