Skip to navigation
Buckets and filesObject Lock

Governance mode

Locked for everyone except the account owner, who can still delete it.

A version locked in Governance mode cannot be overwritten or deleted until its retain-until date, with one exception: the account owner can still delete it on purpose. This makes Governance the safe choice for backups and for trying out Object Lock.

To set a Governance lock, choose Governance as the mode in a default retention, when you lock existing versions or when you lock one version.

What you can and cannot do

ActionAllowed?
Download the versionYes
Overwrite the fileYes, but it creates a new version. The locked version stays.
Make the lock longerYes
Change the version to ComplianceYes. This cannot be undone.
Make the lock shorter or remove it in the consoleNo
Delete the version before the dateOnly the account owner, after confirming. Sub-users cannot.

Delete a Governance-locked version

Signed in as the account owner:

1

Find the version

Open the bucket and turn on Show Versions.

2

Delete it

Open the version’s ⋮ menu and select Delete. The window Governance Lock Active shows when the lock would end.

3

Confirm

Type CONFIRM and select Delete Version. The version is deleted for good.

The Governance Lock Active window with the retention end date, the CONFIRM field and the Delete Version button

Change a version to Compliance

In the version’s Lock Settings, select Edit under Retention, choose Compliance and enter at least as many days as are left. Select Save Retention and confirm. After this, nobody can delete the version or shorten its lock until the date passes: see Compliance mode.

Editing a version's retention with the mode changed to Compliance and the Save Retention button

Lock a file with the AWS CLI

aws s3api put-object-retention --bucket my-locked-bucket --key myfile.txt \
  --retention "Mode=GOVERNANCE,RetainUntilDate=2026-12-31T00:00:00Z" --profile zata

This locks the newest version of myfile.txt until the date you give. Use a sub-user key only if the owner has given it the Object Lock permissions; otherwise Zata answers AccessDenied.