S3 Object Lock

S3 Object Lock is a feature of Amazon S3 that enforces write-once-read-many (WORM) protection on stored objects, preventing them from being deleted or overwritten for a specified retention period — or indefinitely — even by an account’s own administrators, making it a common tool for meeting regulatory data retention requirements.

The Two Retention Modes

Governance mode allows the retention settings on an object to be overridden by users with a specific elevated permission (s3:BypassGovernanceRetention), which is useful for protecting against accidental deletion in normal operations while still allowing an authorized administrator to make a legitimate correction if genuinely needed. Compliance mode is stricter — once set, the retention period cannot be shortened or the object deleted by anyone, including the AWS account’s root user, until the retention period expires, which is the mode typically required to satisfy regulatory frameworks like SEC Rule 17a-4 or FINRA requirements for immutable financial records retention.

Legal Hold

Separately from time-based retention, Object Lock also supports a legal hold flag, which prevents an object from being deleted or overwritten indefinitely, with no expiration date, until the hold is explicitly removed by someone with the appropriate permission — useful for preserving evidence relevant to litigation or an investigation, independent of any retention period that may also apply to the same object.

Practical Requirements

Object Lock must be enabled on a bucket at creation time (or via a support request for buckets created without it), and it requires S3 versioning to be enabled, since retention settings apply to specific object versions — this combination of requirements is worth planning for early in an architecture, since Object Lock can’t be retroactively enabled on an existing bucket that wasn’t created with it turned on.

Object Lock’s Interaction With Lifecycle Policies

Because Object Lock prevents deletion of protected object versions, it’s worth understanding how it interacts with S3 lifecycle policies that automatically transition or expire objects over time: a lifecycle rule attempting to delete an object still under an active retention period or legal hold will simply fail to delete it rather than causing an error that halts the entire lifecycle process, with S3 automatically retrying the deletion after the retention period expires or the hold is removed. This graceful interaction means Object Lock and lifecycle management can be used together safely — objects will still eventually transition through their configured storage tiers, but genuine deletion respects whatever retention protection is in place, exactly as the compliance use case Object Lock is designed for requires.