Protect versions with Object Lock

Object Lock protects versions against permanent deletion. Retention protects them until a date; a legal hold protects them without an expiration date. These protections are independent: removing one does not remove the other.

A new version or delete marker can be created under the same key without deleting the protected version. Object Lock does not remove the need to retain encryption keys required to read it.

Capabilities and permissions#

Open File > Accounts…, select the account, click Edit…, then open Capabilities > Data protection. Configure bucket reading, activation, default retention, reading and changing each protection, protection sent with transfers, and Governance bypass separately. See account capabilities. These capabilities require Object versions and grant no permissions to your credentials.

If S3Client cannot read retention or legal hold, it blocks changes to that protection, even if your credentials allow writing it. Service policies may impose further restrictions.

Choose protection before enabling it#

Enabling Object Lock on a bucket is permanent, enables versioning and prevents its suspension. Compliance retention commits the affected versions to their retention period. See the AWS Object Lock documentation.

Enable Object Lock when creating a bucket#

In the S3 pane, open Create bucket from the bucket list. If the account supports Create buckets with Object Lock, select Enable Object Lock before creating the bucket. This option is unchecked by default and permanently enables Object Lock and versioning. It does not set default retention. Configure that rule in the bucket properties afterwards if the corresponding capability is available.

Enable Object Lock and set the bucket rule#

This tab applies to one non-external General purpose bucket. Enable Object Lock on existing buckets allows activation; Change default retention allows setting or removing the rule. Enabling Object Lock on the service also enables versioning, without a separate versioning update request from S3Client.

1. In the S3 pane, select a single bucket and open Properties.
2. Open Versioning / Object Lock and wait for loading.
3. Select Enable Object Lock if it is not already enabled.
4. To protect future versions, select Apply a default retention period to new object versions.
5. Choose Default mode:, Governance or Compliance.
6. Enter Default duration: as a positive integer, with days or years.
7. Click OK and confirm Enable Object Lock permanently on first activation.
8. Reopen the tab after the operation and check the state and rule.

Enable versioning reflects versioning and remains enabled with Object Lock. Enable Object Lock cannot be changed after activation. If configuration cannot be read, changing it and possibly suspending versioning are blocked until a successful read.

The default rule affects only versions created after saving. Clearing it removes the future rule without removing existing protections. It does not configure a legal hold.

Without an existing rule, default retention is unchecked and the proposed values are Governance, 1 and days. Mode and duration fields become available when both Enable Object Lock and Apply a default retention period to new object versions are selected. Default duration: accepts 1 to 2,147,483,647; the service may impose a lower limit.

S3Client rereads configuration before writing. Object Lock configuration changed offers Yes to replace remote settings with your choices, or No to reload them and discard local changes. Unable to verify Object Lock blocks saving and retains your input; correct access and reread the configuration.

Protect a version#

Delete markers cannot receive these protections. For a stable target, select an identified version with Show versions. With this option off, properties start from the current object and observe its version.

If you also change metadata or storage class on the latest version, S3Client performs a copy. Object Lock changes prepared in the same window then apply to the object produced by that copy. To change only the selected version’s protections, leave metadata and storage class unchanged.

1. In the S3 pane, enable Show versions on the bucket, then open the required folder. Its folders inherit the bucket’s mode.
2. Select the content version and open Properties.
3. Check General > Version ID:, then open Object Lock.
4. Select Retain this object version to set retention.
5. Choose Mode: and a future Retain until: date, respecting (UTC) or (local time).
6. Select Apply a legal hold to this object version if needed.
7. Click OK and wait for completion.
8. Reopen the same version and check both protections. If you also requested a copy by changing metadata or storage class, check the object produced by that copy.

Without existing protections, retention and legal hold are unchecked, the proposed mode is Governance, the date is the current time plus one day, and bypass is unchecked. Existing values are reused when available. Active Compliance retention can only be extended: the checkbox and mode are locked, and the date must be at least the current expiration.

Clear Apply a legal hold to this object version, then click OK, to remove it; this does not remove retention. Retention expiration does not automatically delete the version.

Retention and legal hold are saved through separate requests. If one step fails, another may already have succeeded; reread both protections on the same version before retrying.

Bypass Governance#

To shorten or remove active Governance retention, select Use Governance bypass permission to shorten or remove the current retention before clicking OK. This checkbox appears when the version has active Governance retention whose settings can be edited in this dialog. Selecting it does not grant s3:BypassGovernanceRetention: your credentials must already have this permission.

Without this choice, To shorten or remove active Governance retention, explicitly enable Governance bypass. blocks the change. Bypass removes neither Compliance protection nor a legal hold.

Bulk deletion may offer Bypass Governance-mode retention, or a similar option when confirming multiple versions. See deletion with options. A rejected version remains protected, but other deletions may succeed.

Rewriting and unreadable protections#

Changing metadata or storage class can create a new version. S3Client must read retention and legal hold to preserve them during this copy. If reading is not authorized, it blocks rewriting and requests the required permissions. The old version keeps its protections.

A protected version cannot have its encryption updated in place through UpdateObjectEncryption. For a current object, a copy may be required and then produces another version. See encryption.

After reloading, an account or permission change may preserve entered values while blocking their application. Correct access, reopen properties and check the target before trying again.

Object Lock requires Object versions and its dedicated capabilities. Enabling it does not require the local Read bucket versioning or Change bucket versioning capabilities.

Controls remain read-only when only reading is supported. Bypass Governance retention must be available in the account capabilities before bypass is offered; an explicit request and remote permissions are still required. A rewrite that preserves protection also requires Protect server-side copies, Protect multipart uploads, or Protect simple uploads, depending on the selected transfer method.