Object Lock

Object Lock 

Introduction to Object Lock

Amazon S3 Object Lock is a powerful AWS feature designed to store objects using a Write Once Read Many (WORM) model. This ensures data immutability by preventing object deletion or modification for a specified period or indefinitely. Organizations that handle sensitive, regulated, or mission-critical data depend on Object Lock to meet compliance requirements, regulatory standards, and cybersecurity protection against threats such as ransomware or accidental deletion.

This feature is widely used in enterprise-level security, backup solutions, data retention strategies, and environments requiring tamper-proof data storage. With increasing cybersecurity incidents and strict data protection laws, learning Object Lock has become critical for cloud architects, AWS learners, security engineers, and DevOps professionals.

Purpose of Object Lock

Object Lock enables long-term data integrity by ensuring stored objects cannot be deleted, overwritten, or altered once locked. It helps meet regulatory requirements like SEC 17a-4(f), FINRA, HIPAA, and GDPR (when configured properly with compliance modes). This feature is especially beneficial when storing financial records, audit logs, compliance documents, database backups, legal archives, and immutable evidence.

Object Lock integrates with S3 Versioning to enhance protection because each version of an object can have its own retention period and lock configuration.

Benefits of S3 Object Lock

• Immutability – Data cannot be deleted or overwritten during the lock period.
• Compliance Support – Meets strict regulations for storing tamper-proof records.
• Ransomware Protection – Prevents compromised users or systems from deleting backups.
• Accidental Deletion Prevention – Ensures mission-critical objects remain safe.
• Version-Level Protection – Each version of an object can have independent retention rules.

Prerequisites for Using Object Lock

Before using Object Lock, the S3 bucket must be created with Object Lock enabled. You cannot enable Object Lock on an existing bucket — it must be configured at creation time.

Steps to Create an Object Lock-Enabled Bucket

Here is an example of creating the bucket using the AWS CLI:

aws s3api create-bucket \
  --bucket example-object-lock-bucket \
  --object-lock-enabled-for-bucket \
  --region ap-south-1

After creating the bucket with Object Lock support, versioning is automatically enabled, and you can apply retention policies either at the bucket level or for individual objects.

Modes of S3 Object Lock

S3 Object Lock operates in two primary modes — Governance Mode and Compliance Mode. These modes decide how strictly immutability is enforced.

1. Governance Mode

Governance mode prevents users without special IAM permissions from editing or deleting objects during the retention period. However, users with elevated permissions (like s3:BypassGovernanceRetention) can override settings.

2. Compliance Mode

Compliance mode is the strictest setting where no one—including the root user—can delete, overwrite, or alter the object until the retention period expires. This is used for meeting strict regulatory compliance.

Examples of Enabling Compliance Mode

aws s3api put-object-retention \
  --bucket example-object-lock-bucket \
  --key financial-report.pdf \
  --retention "Mode=COMPLIANCE,RetainUntilDate=2030-01-01T00:00:00"

Retention Periods in Object Lock

Retention periods define how long an object remains protected. During this time, the object cannot be deleted or overwritten.

How Retention Works

• Retention is applied per version.
• Retention can be applied while uploading the object or after uploading.
• Compliance retention cannot be reduced or removed.
• Governance retention can be altered by privileged users.

Set Retention on Upload (CLI Example)

aws s3api put-object \
  --bucket example-object-lock-bucket \
  --key backup-2025.zip \
  --object-lock-mode GOVERNANCE \
  --object-lock-retain-until-date "2028-12-30T12:00:00Z" \
  --body backup-2025.zip

Legal Holds in Object Lock

A legal hold prevents deletion or alteration indefinitely, regardless of retention settings. It must be removed manually when no longer required.

Features of Legal Holds

• Acts like a manual lock.
• Does not require a retention date.
• Cannot be overridden by expiration or lifecycle rules.

Apply a Legal Hold

aws s3api put-object-legal-hold \
  --bucket example-object-lock-bucket \
  --key audit-log-2024.json \
  --legal-hold Status=ON

Remove a Legal Hold

aws s3api put-object-legal-hold \
  --bucket example-object-lock-bucket \
  --key audit-log-2024.json \
  --legal-hold Status=OFF

Bucket-Level Default Retention

Administrators can configure a default retention mode and duration for all objects uploaded to the bucket, which is especially useful in backup environments or compliance-heavy workloads.

Set Default Retention

aws s3api put-object-lock-configuration \
  --bucket example-object-lock-bucket \
  --object-lock-configuration \
  "ObjectLockEnabled=Enabled,Rule={DefaultRetention={Mode=GOVERNANCE,Days=365}}"

Compliance Use Cases for S3 Object Lock

Object Lock is used across industries where data immutability and integrity are crucial.

1. Financial Institution Compliance

Banks and investment companies use Object Lock to store trade records, transaction logs, and regulatory documents such as SEC 17a-4(f) compliant records.

2. Healthcare Data Protection

Hospitals and healthcare providers use Object Lock to store electronic health records (EHR), audit logs, and sensitive patient data to meet HIPAA regulations.

3. Ransomware Protection

Object Lock ensures backup files remain unchanged even if ransomware attempts deletion or corruption. This serves as a critical disaster recovery mechanism.

4. Legal Document Archiving

Organizations involved in litigation store evidence, legal documents, and submitted filings securely for future reference.

5. Government and Public Sector Data Preservation

Government agencies use it to maintain logs, reports, datasets, and sensitive archival files in an immutable format.

Lifecycle Rules vs. Object Lock

AWS S3 lifecycle rules allow automatic archival or deletion of objects, whereas Object Lock ensures objects cannot be deleted during their retention period. Lifecycle policies are ignored while Object Lock is active.

Differences

• Lifecycle policies automate transitions and cleanup.
• Object Lock prevents deletion or editing.
• Retention overrides lifecycle expiration settings.

Object Lock and Versioning

Versioning is mandatory when using Object Lock. Each version can have unique retention properties. Even if a new version is uploaded, locked versions remain protected.

Example: Viewing Object Version Retention

aws s3api get-object-retention \
  --bucket example-object-lock-bucket \
  --key logs/app-log.txt \
  --version-id "123abc456def"

Monitoring Object Lock

Monitoring is essential to ensure compliance and audit readiness. AWS provides multiple tools for tracking object lock configurations.

Monitoring Tools

• AWS CloudTrail – Tracks API calls for retention changes.
• AWS Config – Monitors compliance with retention policies.
• AWS S3 Inventory – Generates reports of objects with lock settings.

1: Forgetting to Enable Object Lock at Bucket Creation

You cannot enable Object Lock after the bucket is created. Always plan ahead.

 2: Confusing Legal Holds with Retention

Legal holds do not expire automatically; retention does. Use the correct feature based on your requirement.

 3: Lack of Monitoring

Enable AWS Config and CloudTrail to track changes to retention settings.

• Use compliance mode for regulated data.
• Set default bucket-level retention for backup use cases.
• Regularly audit retention settings using S3 Inventory.
• Use IAM custom policies to restrict governance bypass permissions.

IAM Permissions for Object Lock

Only IAM users or roles with certain permissions can override or configure Object Lock settings.

Example IAM Policy for Retention Management

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:PutObjectRetention",
        "s3:PutObjectLegalHold",
        "s3:GetObjectRetention",
        "s3:GetObjectLegalHold"
      ],
      "Resource": "arn:aws:s3:::example-object-lock-bucket/*"
    }
  ]
}

Object Lock in Backup and Disaster Recovery

Modern backup solutions integrate Object Lock for ransomware-resistant storage. Tools like AWS Backup, Veeam, Commvault, Druva, and others support creating immutable S3 backups.

Workflow

1. Backup application uploads data to S3.
2. Retention policies automatically apply.
3. Object versions remain protected even if new backups are uploaded.
4. Ransomware-affected systems cannot delete locked versions.

Implementing Object Lock

Step 1: Create S3 Bucket

aws s3api create-bucket \
  --bucket enterprise-immutable-data \
  --object-lock-enabled-for-bucket

Step 2: Upload Object with Governance Retention

aws s3api put-object \
  --bucket enterprise-immutable-data \
  --key reports/annual-report-2025.pdf \
  --object-lock-mode GOVERNANCE \
  --object-lock-retain-until-date "2030-01-01T00:00:00Z" \
  --body annual-report-2025.pdf

Step 3: Verify Retention Settings

aws s3api get-object-retention \
  --bucket enterprise-immutable-data \
  --key reports/annual-report-2025.pdf

Example 1: Accounting Firms

Accounting firms secure tax records, audits, payroll data, and financial statements using Object Lock to satisfy compliance.

Example 2: Security Logs Preservation

Log analytics companies store server logs, incident logs, and SIEM logs immutably to support forensic investigation.

Example 3: Video Surveillance Companies

Video footage stored for legal, compliance, and audit use cases cannot be deleted during retention periods.

Limitations of  Object Lock

• Cannot enable Object Lock on an existing bucket.
• Retention periods in compliance mode cannot be shortened.
• Complexity increases with versioning.
• Storage cost may increase due to retained versions.

Amazon S3 Object Lock is essential for organizations that need to store tamper-proof, immutable data for compliance, security, and data protection. By understanding the different modes, retention periods, legal holds, IAM permissions, and real-world use cases, users can effectively implement Object Lock for enterprise-grade data integrity. As ransomware attacks and regulatory requirements increase, Object Lock serves as a critical solution in modern cloud storage architectures.

Whether you're preparing for AWS Certification, designing enterprise architectures, or strengthening data protection strategies, Object Lock is one of the most important topics to master within Amazon S3 and overall cloud security.