> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.zata.prathamchopde.site/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.zata.prathamchopde.site/_mcp/server.

# Object Lock (WORM)

Object Lock keeps file versions in WORM mode (write once, read many): a locked version cannot be deleted or overwritten until its lock ends. Use it for backups that a mistake or ransomware must not wipe out, and for records you must keep for a set time.

> **Warning**
>
> You can only turn on Object Lock when you create a bucket. It can never be turned off, and versioning stays on for the life of the bucket. To protect files in an existing bucket, create a new bucket with Object Lock and copy the files into it.

## Turn on Object Lock

When you [create a bucket](/buckets/create-a-bucket), on the **Versioning** step turn on **Enable Versioning**, then **Enable Object Lock**. You can set a default retention there too, or later in the bucket settings.

With the AWS CLI and the account owner's key:

```bash
aws s3api create-bucket --bucket my-locked-bucket --object-lock-enabled-for-bucket --profile zata
```

## Choose a protection

Each file version can have a retention (in **Governance** or **Compliance** mode) and a legal hold, alone or together.

|                            | [Governance](/buckets/object-lock/governance-mode)               | [Compliance](/buckets/object-lock/compliance-mode) | [Legal hold](/buckets/object-lock/legal-hold)   |
| -------------------------- | ---------------------------------------------------------------- | -------------------------------------------------- | ----------------------------------------------- |
| Ends                       | On the retain-until date                                         | On the retain-until date                           | When you turn it off                            |
| Delete the version early   | The account owner can, after typing `CONFIRM`. Sub-users cannot. | Nobody: not you, not Zata support                  | Turn off the hold first                         |
| Make the lock longer       | Yes                                                              | Yes                                                | Not needed                                      |
| Shorten or remove the lock | Not in the console                                               | Never                                              | Turn it off at any time                         |
| Good for                   | Backups, and testing Object Lock                                 | Records you must keep by law or contract           | Keeping files during a dispute or investigation |

> **Tip**
>
> Start with **Governance**. You can change a version from Governance to Compliance later, but never back.

## How long you can lock files

The console will not lock files past the date your data is guaranteed to be kept. That date depends on your account:

| Account   | Latest date the console accepts                                                                                                   |
| --------- | --------------------------------------------------------------------------------------------------------------------------------- |
| Paid plan | The end of your current billing period, plus the 90 days that data is kept after a plan expires (see [Billing](/account/billing)) |
| Trial     | The end of the trial, plus 30 days                                                                                                |

The console shows the limit next to the field, for example **Retention is limited to 136 days by your billing lifecycle**. A **Compliance** default retention can be at most 90 days (30 days on a trial), because it locks every future upload. Renewing your plan moves the limit forward. If your plan or trial has already ended, the console cannot set new locks.

## Set a default retention

A default retention locks every new upload automatically, in the mode and for the number of days you choose. Files uploaded by any S3 tool are locked too. Without a default retention, new files are not locked.

#### Open the Object Lock settings

Open the bucket's [settings](/buckets/bucket-settings) and expand **Object Lock**.

#### Choose a mode and days

Under **Default Retention**, choose **Governance** or **Compliance**, enter the number of days and select **Apply Changes**.

![Default Retention set to Governance and 15 days, with the retention limit note and the Apply Changes button](/_fern-img/002bdc3608fd3db3d422b40712e1c188e2998f6f7fc4a9cf9f59d7eb5dff0a12.webp)

#### Confirm

Type `CONFIRM` and select **Apply Retention**. The section now shows the active rule, for example **Active · Governance · 15 days**.

![The Confirm Default Retention window with the CONFIRM field and Apply Retention button](/_fern-img/ac8427938d712227525eab1e20c085e3442e6e3adad8ad8b6abff23025f7f1eb.webp)

The default retention only applies to files uploaded after you set it. To lock files that are already in the bucket, see [the next section](#lock-existing-versions).

To stop locking new uploads, select **Remove Rule** and confirm with **Remove Rule**. Versions that are already locked stay locked.

![The Remove Default Retention window explaining that existing locked versions stay protected](/_fern-img/f8e5b5480dd1adeb0ceb1b270326294526509b60fce7e063a04ab6b207feeae7.webp)

## Lock existing versions

You can lock every version in the bucket that has no active lock in one go. Versions that are already locked are not changed.

#### Start from the settings or the file list

In the bucket's settings, under **Object Lock**, select **Apply Retention...** next to **Protect Existing Versions**.

![The Object Lock section with the Apply Retention button next to Protect Existing Versions](/_fern-img/9a291b9be6b119c719825278cc0399de893cbb8c0e719218584955003e34cf45.webp)

Or open the bucket, turn on **Show Versions** and select **Protect All**.

![The bucket's version list with Show Versions on and the Protect All button](/_fern-img/d767c7c7c7d0f353e22ae23872e3228719608802b3859fa0270fc94eb93eda5e.webp)

#### Choose the mode and period

In **Protect Unprotected Versions**, choose the **Retention Mode** and enter the **Retention Period (Days)**, counted from today. Select **Continue**.

![The Protect Unprotected Versions window with Governance mode and 15 days](/_fern-img/66d833d7bff877fed67fb76cb2270823518b64f14aec1670d1f480ce437713de.webp)

#### Confirm

Check the summary, type `CONFIRM` and select **Apply Retention**. The console locks the versions in the background, so you can close the window.

![The Confirm Bulk Retention window showing mode, locked-until date and the CONFIRM field](/_fern-img/fce606875d23a16c3c09fa83b5396c588c44035bab06a088cd936efdc1c50b86.webp)

## Lock or change one version

#### Open Lock Settings

Open the bucket and turn on **Show Versions**. Open the **⋮** menu of the version and select **Lock Settings**.

![A version's menu in the version list with Lock Settings pointed out](/_fern-img/eb0ce858afc8ab80c15344af57e760c41ad8becc037108edb55a9a3745fbc142.webp)

#### Edit the retention

The **Version Details** panel shows the version's **Retention** and **Legal Hold**. Under **Retention**, select **Apply** (no lock yet) or **Edit** (already locked).

![The Version Details panel with a Governance retention, its expiration date, the Edit button and the Legal Hold switch](/_fern-img/e922b13af42b33fafb8829d8493666c3f9b566e45eb3553cb9fa6b933e549eac.webp)

#### Set the mode and days

Choose the **Mode** and enter **Retain Until (Days from now)**, then select **Save Retention**. You can make a lock longer, or change Governance to Compliance. You cannot make a lock shorter.

![Editing the retention with Mode set to Governance, 14 days and the Save Retention button](/_fern-img/ca002ad859f37420bc90b46c5a66081b32f32007ad676102c7b9f79ae9fef054.webp)

#### Confirm

In **Confirm Retention Settings**, select **Confirm**.

![The Confirm Retention Settings window for a Compliance retention of 16 days](/_fern-img/633b11a01f40e23515cead9ad4005e06d5dc0e78c616ae17d1278aeb61d50a7e.webp)

To put a legal hold on a version, see [Legal hold](/buckets/object-lock/legal-hold).

## What Object Lock changes in the bucket

* **Deleting a file** in the normal file list only adds a delete marker. The locked versions stay, and you can [restore the file](/buckets/delete-and-restore-files).
* **Overwriting a file** creates a new version. The locked version stays.
* **Versioning** cannot be turned off.
* [Lifecycle rules](/buckets/lifecycle-rules) skip locked versions until their lock ends.
* **Delete All Contents** is not available when you [delete the bucket](/buckets/delete-a-bucket). Delete the files once their locks have ended, then delete the empty bucket.
* Sub-users cannot change Object Lock settings unless the owner has given them those permissions.

## Check locks with the AWS CLI

```bash
# The bucket's default retention rule
aws s3api get-object-lock-configuration --bucket my-locked-bucket --profile zata

# The lock on one file
aws s3api get-object-retention --bucket my-locked-bucket --key myfile.txt --profile zata
```

`ObjectLockConfigurationNotFoundError` from `get-object-retention` means the file has no lock, or the bucket was created without Object Lock.

> **Tip**
>
> To check that a backup tool works with Object Lock, use a new test bucket, never one with real data. Lock a test file for a short time in **Governance** mode, then try to delete that version with the tool: it must be refused.