Amazon S3 Object Lock

Amazon S3 Object Lock Overview

Amazon S3 Object Lock is a feature for securing data in Amazon S3. It helps you enforce a Write Once, Read Many (WORM) model to prevent accidental or malicious deletion or modification of file versions in Amazon S3.

Object Lock protects a specific version of a file. It does not prevent you from uploading a new version of the file, or Amazon S3 from creating a delete marker for the current version.

This is particularly useful for industries with strict data retention requirements, such as financial services, healthcare, and compliance-focused organizations.

Here are some key points about Amazon S3 Object Lock:

• WORM Model: once a file version is locked, it cannot be deleted or modified for the specified retention period.
• Retention Period: You can set a retention period for a file version, which specifies how long that version should be locked. There are two modes for retention periods: Governance mode and Compliance mode.
• Governance Mode: Users with the required permission can change retention settings or delete a protected file version by explicitly bypassing Governance mode.
• Compliance Mode: In compliance mode, the retention period is strictly enforced, and it cannot be shortened or removed by any user, including the root AWS account. This mode ensures that data remains immutable for the entire retention period.
• Legal Hold: A legal hold prevents a file version from being deleted or modified until the hold is removed.

Object Lock is commonly used for scenarios where data integrity and retention are critical, such as maintaining financial records, preserving medical records, or adhering to regulatory requirements.

How to enable Object Lock for a bucket

Before you can lock any objects, you need to configure a bucket to use Amazon S3 Object Lock. You can enable Object Lock when creating a new bucket or for an existing bucket. Once Object Lock is enabled, you can lock objects in that bucket using retention periods, legal holds, or both.

Please note:

• Object Lock requires bucket versioning. CS Browser automatically enables versioning when necessary.
• After you enable Object Lock, you can't disable Object Lock or suspend versioning for the bucket.

To enable Object Lock for an existing bucket:

1. Select Buckets -> Object Lock -> Default retention settings.., check Enable Object Lock, optionally configure default retention settings, and click OK. CS Browser enables versioning automatically if necessary.

To create a bucket with Object Lock enabled:

1. Start CS Browser and click Buckets -> Create new bucket..:

   

   The Create New Bucket dialog will open:

   

2. Click show more settings. The additional settings will open:

   

3. Check the Enable S3 Object Lock checkbox and click Create new bucket.

   If you wish to configure default retention settings for the bucket, click the configure default retention settings link. Please refer to the retention settings description below for more details.

How to configure default retention settings

Enabling Object Lock allows the bucket to store protected file versions. This setting alone does not automatically apply retention to files that you add to the bucket.

If you wish to automatically protect new file versions added to the bucket, you can set up a default retention period.

The default settings apply to every new file version unless you explicitly specify a different retention mode and period when uploading the file.

To configure default retention settings:

1. Select the bucket for which you want to configure default retention settings, then click:

   Buckets -> Object Lock -> Default retention settings..

   

   The Object Lock Configuration dialog will open:

   

2. Configure the Retention mode and Retention period, then click OK.

   Governance mode: Users can't delete a protected file version or shorten its retention period unless they have the s3:BypassGovernanceRetention permission and explicitly bypass Governance mode. This does not bypass a legal hold, which must be removed separately.

   Compliance mode: A protected file version can't be deleted by any user, including the root user in your AWS account. When an object is locked in compliance mode, its retention mode can't be changed, and its retention period can't be shortened.

   Retention period: A retention period protects a file version for a fixed amount of time. When you place a retention period on a file version, Amazon S3 stores a timestamp in that version's metadata to indicate when the retention period expires. After the retention period expires, the version can be deleted unless you also placed a legal hold on it.

   An alternative method to automatically apply retention settings is by configuring Object Lock Retention Rules.

Viewing the lock information for an object

You can check the object lock status for individual files by following the instructions provided below. The Properties tab displays the retention mode, retain-until date, and legal-hold status for the selected file version.

1. Select the file for which you would like to check the object lock status and click:

   Files -> Properties:

   

   The Properties tab will open:

   

   The Retention row displays the Object Lock status (Active or Expired), retention mode, and retain-until date.

   Another way to check the object lock status is to select the file and then click:

   Files -> Object Lock -> Retention..:

   

   The Object Lock Retention dialog will open:

   

   The dialog displays retention information and lets you update retention settings.

How to apply retention settings for one or multiple files

With CS Browser, you can conveniently update the retention settings for one or multiple files.

Retention can be disabled for files protected by Governance mode when your AWS identity has the s3:BypassGovernanceRetention permission. CS Browser includes the x-amz-bypass-governance-retention: true header in the request. A legal hold is not bypassed and must be removed separately.

For files protected by the Compliance mode, the retention period can only be extended.

To apply or update retention settings for one or multiple files:

1. Select one or more files and/or folders and click:

   Files -> Object Lock -> Retention..:

   

   The Object Lock Retention dialog will open:

   

2. Adjust the retention settings as needed, then click OK.

How to apply retention settings for all files in a bucket

With CS Browser, you can also update the retention settings for all files in a bucket.

This can be particularly useful if you need to change the retention mode or update the retention period for every file in a bucket. CS Browser provides a convenient and efficient way to do this due to its support for multi-threading, allowing you to process multiple files in parallel. This can greatly speed up the process, especially for large buckets.

To adjust the retention settings for all files in a bucket:

1. Select the bucket you want to work with and click:

   Buckets -> Object Lock -> Update retention for all objects..:

   

   The Object Lock Retention dialog will open:

   

2. Adjust the retention settings as needed, then click OK.

   CS Browser will enumerate all files in a bucket and create a PutObjectRetention task for each file. You can monitor the progress on the Tasks tab.

Bypass governance retention for file deletion

To delete file versions protected by Governance mode before their retain-until date, your AWS identity must have the s3:BypassGovernanceRetention permission, and the request must include the x-amz-bypass-governance-retention header. This header does not bypass a legal hold.

CS Browser automatically includes the x-amz-bypass-governance-retention header when you edit retention settings for file(s).

To delete file versions without disabling retention first, you need to include the x-amz-bypass-governance-retention header with your delete request.

Below are the steps required to configure CS Browser to include the x-amz-bypass-governance-retention header with delete requests.

1. Click Tools -> Default HTTP Headers.

   

   The Default HTTP Headers dialog will open:

   

2. Click Add. The Add New Default HTTP Header dialog will open:

   

3. Add the following header

   • Remote file name or mask: enter your bucket name here
   • File name: *
   • Header name: x-amz-bypass-governance-retention
   • Header value: true

4. Click Add and Save changes

Related materials