# Understanding Object Lock for Amazon S3 ### **Introduction** S3 Object Lock can help prevent Amazon S3 objects from being deleted or overwritten for a fixed amount of time or indefinitely. Object Lock uses a write-once-read-many (WORM) model to store objects. You can use Object Lock to help meet regulatory requirements that require WORM storage, or to add another layer of protection against object changes or deletion. Object Lock provides two ways to manage object retention: retention periods and legal holds. An object version can have a retention period, a legal hold, or both. * **Retention period** – A retention period specifies a fixed period of time during which an object remains locked. You can set a unique retention period for individual objects. * **Legal hold** – A legal hold provides the same protection as a retention period, but it has no expiration date. Instead, a legal hold remains in place until you explicitly remove it. Legal holds are independent from retention periods and are placed on individual object versions. Object Lock works only in buckets that have S3 Versioning enabled. When you lock an object version, Amazon S3 stores the lock information in the metadata for that object version. Placing a retention period or a legal hold on an object protects only the version that's specified in the request. Retention periods and legal holds don't prevent new versions of the object from being created, or delete markers to be added on top of the object. For information about S3 Versioning, see [Using versioning in S3 buckets](https://docs.aws.amazon.com/AmazonS3/latest/userguide/Versioning.html). If you put an object into a bucket that already contains an existing protected object with the same object key name, Amazon S3 creates a new version of that object. The existing protected version of the object remains locked according to its retention configuration. ### **Steps for Object Lock in Amazon S3** 1. Open the **AWS Management Console** and navigate to the **S3 dashboard**. 2. Click **Create bucket**. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722299964480/fb19aa61-1dc5-4b42-86eb-23f7ce1980f4.png?auto=compress,format&format=webp&auto=compress,format&format=webp align="left") 3. Select **General purpose** bucket type. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722300008769/9a6f2b7a-ae48-4fe0-8d71-6bec71d585e1.png?auto=compress,format&format=webp&auto=compress,format&format=webp align="left") 4. Write a bucket name, this name must be globally unique. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722297511455/5a02b511-e7c3-4a42-b05b-34d15614f746.png?auto=compress,format&format=webp&auto=compress,format&format=webp align="left") 5. Select **ACLs enabledObject Ownership.** 6. Uncheck **Block all public access -> Check the Acknowledgement.** ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722302267197/d2338c6a-6027-482e-b590-291584bfe4c2.png?auto=compress,format&format=webp align="left") 7. Enable **Bucket Versioning.** ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722302343722/a08e7765-cdae-4a06-8010-486562292af1.png?auto=compress,format&format=webp align="left") 8. Under **Additional setting**, enable **Object Lock**. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722543970053/18612ef8-ee13-4420-b0e4-4ec0f1f7eb55.png align="center") 9. Click **Create bucket**. 10. Open the newly created bucket by clicking on its name. 11. Click **Properties**. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722544761229/c3bf5766-e861-48b8-9ab4-2c73e1913acc.png align="center") 12. Scroll and click **Edit** on **Object Lock**. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722544051307/277bd9c7-8aea-4327-97ba-8eb6c29fd1ef.png align="center") 13. Enable **Default retention**, set **Default retention mode** to **Governance, and set Default retention period** to 1 Days. **Governance**: Users with specific IAM permissions can overwrite or delete protected object versions during the retention period. **Compliance**: No users can overwrite or delete protected object versions during the retention period. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722544822675/250d20df-50ad-4b70-a2e0-dd98a0dc1191.png align="center") 14. Click **Save changes**. 15. Now Click on **Objects**. 16. Click **Upload**. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722297830670/adb55fb1-0c38-438d-a8b1-3aa3374511f0.png?auto=compress,format&format=webp&auto=compress,format&format=webp align="left") 17. Now click on **Add files**. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722297908287/836cfbcf-e114-4e23-86f5-c4bd71555c9e.png?auto=compress,format&format=webp&auto=compress,format&format=webp align="left") 18. Select any file you want to upload. 19. Scroll and click **Upload**. 20. Select the file and permanently delete the file. You'll see the file is permanently deleted. The reason for this is that the file is in **Governance** lock. **Note**: Make sure Show Versions is enabled while you delete the file. If it is not, while will not be permanently deleted. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722549943585/759909d9-98d0-4c97-bc97-2ae49ebaac4a.png align="center") 21. Now upload the file again. 22. Open the file by clicking on its name. 23. Under Properties, Edit **Object Lock retention.** ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722545056265/737f7168-2c89-45b3-9e87-cf730bac4229.png align="center") 24. Set Retention mode to Compliance mode. **Note**: You'll not be able to delete the file before the retention period. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722545064310/fd87f3e8-a52f-4d17-af36-abda98e170be.png align="center") 25. Click **Save Changes**. 26. Now select the object and try to permanently delete the file. You'll get an error when you try. Wait until the retention period is over, then you will be able to delete it.