Object Lock (WORM)

Object Lock keeps file versions in WORM mode (write once, read many): a locked version cannot be deleted or overwritten until its lock ends. Use it for backups that a mistake or ransomware must not wipe out, and for records you must keep for a set time.

You can only turn on Object Lock when you create a bucket. It can never be turned off, and versioning stays on for the life of the bucket. To protect files in an existing bucket, create a new bucket with Object Lock and copy the files into it.

Turn on Object Lock

When you create a bucket, on the Versioning step turn on Enable Versioning, then Enable Object Lock. You can set a default retention there too, or later in the bucket settings.

With the AWS CLI and the account owner’s key:

aws s3api create-bucket --bucket my-locked-bucket --object-lock-enabled-for-bucket --profile zata

Choose a protection

Each file version can have a retention (in Governance or Compliance mode) and a legal hold, alone or together.

	Governance	Compliance	Legal hold
Ends	On the retain-until date	On the retain-until date	When you turn it off
Delete the version early	The account owner can, after typing `CONFIRM`. Sub-users cannot.	Nobody: not you, not Zata support	Turn off the hold first
Make the lock longer	Yes	Yes	Not needed
Shorten or remove the lock	Not in the console	Never	Turn it off at any time
Good for	Backups, and testing Object Lock	Records you must keep by law or contract	Keeping files during a dispute or investigation

Start with Governance. You can change a version from Governance to Compliance later, but never back.

How long you can lock files

The console will not lock files past the date your data is guaranteed to be kept. That date depends on your account:

Account	Latest date the console accepts
Paid plan	The end of your current billing period, plus the 90 days that data is kept after a plan expires (see Billing)
Trial	The end of the trial, plus 30 days

The console shows the limit next to the field, for example Retention is limited to 136 days by your billing lifecycle. A Compliance default retention can be at most 90 days (30 days on a trial), because it locks every future upload. Renewing your plan moves the limit forward. If your plan or trial has already ended, the console cannot set new locks.

Set a default retention

A default retention locks every new upload automatically, in the mode and for the number of days you choose. Files uploaded by any S3 tool are locked too. Without a default retention, new files are not locked.

Open the Object Lock settings

Open the bucket’s settings and expand Object Lock.

Choose a mode and days

Under Default Retention, choose Governance or Compliance, enter the number of days and select Apply Changes.

Default Retention set to Governance and 15 days, with the retention limit note and the Apply Changes button

Confirm

Type CONFIRM and select Apply Retention. The section now shows the active rule, for example Active · Governance · 15 days.

The default retention only applies to files uploaded after you set it. To lock files that are already in the bucket, see the next section.

To stop locking new uploads, select Remove Rule and confirm with Remove Rule. Versions that are already locked stay locked.

The Remove Default Retention window explaining that existing locked versions stay protected

Lock existing versions

You can lock every version in the bucket that has no active lock in one go. Versions that are already locked are not changed.

Start from the settings or the file list

In the bucket’s settings, under Object Lock, select Apply Retention… next to Protect Existing Versions.

The Object Lock section with the Apply Retention button next to Protect Existing Versions

Or open the bucket, turn on Show Versions and select Protect All.

The bucket's version list with Show Versions on and the Protect All button

Choose the mode and period

In Protect Unprotected Versions, choose the Retention Mode and enter the Retention Period (Days), counted from today. Select Continue.

The Protect Unprotected Versions window with Governance mode and 15 days

Confirm

Check the summary, type CONFIRM and select Apply Retention. The console locks the versions in the background, so you can close the window.

Lock or change one version

Open Lock Settings

Open the bucket and turn on Show Versions. Open the ⋮ menu of the version and select Lock Settings.

A version's menu in the version list with Lock Settings pointed out

Edit the retention

The Version Details panel shows the version’s Retention and Legal Hold. Under Retention, select Apply (no lock yet) or Edit (already locked).

The Version Details panel with a Governance retention, its expiration date, the Edit button and the Legal Hold switch

Set the mode and days

Choose the Mode and enter Retain Until (Days from now), then select Save Retention. You can make a lock longer, or change Governance to Compliance. You cannot make a lock shorter.

Editing the retention with Mode set to Governance, 14 days and the Save Retention button

Confirm

In Confirm Retention Settings, select Confirm.

To put a legal hold on a version, see Legal hold.

What Object Lock changes in the bucket

Deleting a file in the normal file list only adds a delete marker. The locked versions stay, and you can restore the file.
Overwriting a file creates a new version. The locked version stays.
Versioning cannot be turned off.
Lifecycle rules skip locked versions until their lock ends.
Delete All Contents is not available when you delete the bucket. Delete the files once their locks have ended, then delete the empty bucket.
Sub-users cannot change Object Lock settings unless the owner has given them those permissions.

Check locks with the AWS CLI

# The bucket's default retention rule
aws s3api get-object-lock-configuration --bucket my-locked-bucket --profile zata
# The lock on one file
aws s3api get-object-retention --bucket my-locked-bucket --key myfile.txt --profile zata

ObjectLockConfigurationNotFoundError from get-object-retention means the file has no lock, or the bucket was created without Object Lock.

To check that a backup tool works with Object Lock, use a new test bucket, never one with real data. Lock a test file for a short time in Governance mode, then try to delete that version with the tool: it must be refused.