Protecting S3 Data with Object Lock

Introduction to Amazon S3

Amazon S3 is a highly available, durable and secure service where organizations can store there any amount of data. Some businesses have requirement to protect data from deletion and overwritten for a fixed amount of time or indefinitely.

Object Lock feature of Amazon S3 allows organization to easily protect their data from deletion and overwritten. This feature allows organization to store their object using a Write Once Read Many (WORM) models.

Ways To Manage Retention

There are two ways to manage object retention in Amazon S3 with object lock:

• Retention Period: It is a set period of time during which an object remains locked. On S3 bucket you can set default retention period and also set retention period for any individual S3 object. During the retention period you cannot delete or overwritten an object. You can set retention period in days or years. You can retain an object for minimum 1 day and there is no limit for maximum days.
• Legal hold: It is also providing same level of protection as retention period but without an expiration date. Instead, legal hold exists in place until you explicitly remove it.

S3 object Lock only works on the buckets that have S3 versioning enabled.

Retention Modes

There are two types of retention mode to manage objects.

• Governance mode: In governance mode, the users are unable to overwrite, delete an object version, or modify its object lock settings unless they have specific permissions.

You can use this mode, if you want to prevent most of the users from deleting an S3 objects, but at the same time you want to allow certain users to modify retention settings or remove the objects if needed.

• Compliance mode: In compliance mode, no user, including the root user of your AWS account, can overwrite or delete a protected object version. Once an object is locked in compliance mode, its retention mode cannot be altered.

Steps to Configure S3 Object Lock Using Retention Period in Governance Mode

• Create a S3 bucket with unique name (demo-object-lock-2024).

• In bucket properties find Bucket Versioning, edit and enable versioning by following below steps

• In bucket properties find Object Lock then edit & enable it, enable default retention, select preferred default retention mode governance or compliance, write default retention period in textbox and select either days or year by following below steps

• Let’s upload some objects in S3 bucket and confirm that everything is functioning correctly.

• Let’s review the Object Lock properties under the Properties tab for one of the objects, ‘nature.jpg’ that we uploaded on date of September 13, 2024.

• The object has been locked with a “Retain until” date of September 14, 2024, which is 1 day from the upload date.

About CloudThat