What is S3 Object Lock?
S3 Object Lock is a bucket setting in the S3 API that stores object versions as write-once-read-many (WORM). While a version is locked by a retention period or a legal hold, nobody can overwrite or delete it, even with valid credentials. Many S3-compatible services implement the same calls.
Think of a bound ledger written in pen. You can always add a new page, but you can’t tear out or rewrite a filled page until its lock date has passed.
Teams use it for backups that ransomware should not be able to erase, for audit logs, and for records that must stay in WORM storage. It only works in buckets with versioning enabled, because it protects a specific version, not an object name.
How does Object Lock work?
S3 stores the lock in each object version’s metadata and refuses to delete or overwrite that version while the lock is in force. Uploading to the same key still works: it creates a new version and leaves the locked one as it was.
You enable Object Lock on the bucket, and once it is on you can’t turn it off. Some S3 services allow it on existing buckets, others only when you create the bucket. Each version can then have a retention period, a legal hold, or both.
A retention period has a retain-until date. You set it on one version, or as a bucket default in days or years that S3 adds to each new version’s creation time. You can always extend it later, and the mode decides whether you can shorten it.
Governance mode
In governance mode, users with a special bypass permission can delete a locked version, shorten its retention or change its mode. They must also send an explicit bypass header with the request.
That makes governance mode a good fit for guarding against mistakes and for testing retention settings. Treat the bypass permission like an admin credential.
Compliance mode
In compliance mode, nobody can delete a locked version or shorten its retention until the period ends, the account’s root user included.
Use it for backups and records that have to survive a compromised account. A bucket policy can cap how long retention may be. Set a cap: a 10-year typo instead of 10 days is storage you pay for and can’t delete.
Legal hold
A legal hold is a lock without an end date. It stays on a version until a user with the right permission removes it, and it runs independently of any retention period.
Use a legal hold when you don’t know yet how long data must stay unchanged, for example until an audit is finished.
What does Object Lock not protect against?
Object Lock stops deletes and overwrites of locked versions. It does not stop these:
- New versions and delete markers. A plain delete adds a marker that hides the object, and markers aren’t locked. Your restore tooling has to read versions.
- Unprotected data. Only versions written with a lock or under a bucket default are protected, and only until the period expires.
- Lost encryption keys. A locked object you can’t decrypt is not a backup.
- Bad data. If backups are corrupt or encrypted by an attacker before upload, Object Lock keeps those too.
How enum handles Object Lock
enum Object Storage supports Object Lock, versioning, default retention, compliance mode and legal hold on its S3-compatible API. You enable Object Lock when you create the bucket, not afterwards. If you need governance mode or variable retention, ask us; the Object Storage page has pricing and this guide covers backup setup.
FAQ
Does S3 Object Lock require versioning? Yes, because Object Lock protects individual object versions, it only works in buckets with versioning enabled. Once it is on, you can’t turn it off or suspend versioning for that bucket.
Can I enable Object Lock on an existing bucket? It depends on the service. Some allow it, others, enum included, only allow it when you create the bucket, so moving existing data means copying it into a new bucket.
Does deleting an object in a locked bucket fail? A delete without a version ID succeeds and adds a delete marker, while the locked version stays in place. A delete that names a locked version ID is refused with 403 Forbidden.