Control access and protect data
S3 protections operate at several levels. ACLs and Object Ownership control some access and ownership. Encryption protects data at rest. Object Lock prevents permanent version deletion during a retention period or legal hold.
| Guide | Questions covered |
|---|---|
| ACLs and ownership | Which grantees and permissions should you assign? When are ACLs disabled? |
| Encryption | Which parameters apply to the bucket, a write, an update or SSE-C reading? |
| Object Lock | How do you enable Object Lock on a bucket and manage retention or legal holds? |
Check the target and Show versions before making a change. Account capabilities describe what S3Client can request; they grant no permissions to credentials.
Removing a legal hold does not remove retention, and changing bucket encryption does not rewrite stored objects. Each guide explains the consequences before saving.