---
title: "Object Lock"
sidebar_label: "Object Lock"
description: "How Object Lock works, types and retention modes, and how to configure Object Lock"
sidebar_position: 6
---

import {CustomTable} from '@selectel/docux/components'
import Tabs from '@theme/Tabs'
import TabItem from '@theme/TabItem'
import {TabItemLabel} from '@selectel/docux/components'
import Formbricks from '@theme/MDXComponents/Formbricks'

# Object Lock

Object Lock uses the WORM (Write Once Read Many) principle and allows you to lock objects to prevent them from being overwritten or deleted.

To use Object Lock, [versioning](/s3/buckets/versioning.mdx) must be enabled in the bucket. Object Lock applies only to object versions.

Locking can have different [types and modes](#lock-types-and-modes). Depending on the lock type, you can set it on individual objects or on the bucket by default — the lock will apply to new objects.

The ability to manage locking also depends on the user's [role](/s3/about/manage-access.mdx#access-within-roles) and [bucket policy](/s3/buckets/bucket-policy/about-bucket-policy.mdx) rules, for more details, see the [Managing S3 access](/s3/about/manage-access.mdx) guide. You can work with Object Lock in the Control Panel (capabilities are limited), via [S3 API](/api/object-storage-s3/) and [tools](/s3/tools/) that use it — for example, [AWS CLI](/s3/tools/aws-cli.mdx).

To manage object locks after configuring Object Lock, use the [Managing object locks](/s3/objects/manage-object-lock.mdx) guide.

If you [delete a project](/access-control/projects/manage/delete-project.mdx) that contains locked objects, they will not be deleted as long as the lock is active. At the same time, they will not be displayed in the Control Panel or via the API. To restore locked objects after deleting a project, [create a ticket](https://my.selectel.ru/tickets/create/).

## Types and retention modes \{#lock-types-and-modes}

Locking can be temporary or indefinite. Temporary locking has two modes: Governance and Compliance.

If both a temporary and an indefinite lock are enabled for an object, the indefinite lock takes precedence.

<CustomTable>
  <table>
    <thead>
      <tr>
        <th rowspan="2" />

        <th rowspan="2">Indefinite</th><th colspan="2">Temporary</th>
      </tr>

      <tr>
        <th>Governance mode</th><th>Compliance mode</th>
      </tr>
    </thead>

    <tbody>
      <tr>
        <th>What can it be applied to</th><td>Objects</td>

        <td>
          * to objects;
          * to the default bucket — the lock will be applied to all new objects
        </td>

        <td>
          * to objects;
          * to the default bucket — the lock will be applied to all new objects
        </td>
      </tr>

      <tr>
        <th>Possible locking actions</th><td>Disabling the lock</td>

        <td>
          * shortening the lock duration `*`;
          * extending the lock duration;
          * changing the locking mode to Compliance
        </td>

        <td>Extending the lock duration</td>
      </tr>

      <tr>
        <th>Ability to delete objects</th><td>No one can while the lock is enabled</td><td>You can `*`</td><td>No one can until the lock expiration date</td>
      </tr>
    </tbody>
  </table>
</CustomTable>

`*` Available only to users:

* with the [`member;`](/s3/about/manage-access.mdx#member) role;
* with [other roles with S3 access](/s3/about/manage-access.mdx#access-within-roles), if the bucket has an access policy that allows the [action](/s3/buckets/bucket-policy/about-bucket-policy.mdx#actions) `s3:BypassGovernance`.

## Enable Object Lock in a bucket \{#enable-object-lock}

:::info

Object Lock can be enabled by:

* [The account owner](/access-control/user-types.mdx#account-owner);
* users with the [`member`](/s3/about/manage-access.mdx#member), [`s3.admin`](/s3/about/manage-access.mdx#s3-admin), and [`object_storage:admin;`](/s3/about/manage-access.mdx#object-storage-admin) roles;
* users with the [`s3.bucket.user`](/s3/about/manage-access.mdx#s3-bucket-user), [`s3.user`](/s3/about/manage-access.mdx#s3-user), and [`object_storage_user`](/s3/about/manage-access.mdx#object-storage-user) roles if the access policy allows them the [action](/s3/buckets/bucket-policy/about-bucket-policy.mdx#actions) `s3:PutBucketObjectLockConfiguration`.

:::

If you enable Object Lock, it cannot be disabled, and [versioning](/s3/buckets/versioning.mdx) cannot be suspended.

Enabling Object Lock does not lock objects automatically. After configuring Object Lock in a bucket, you will be able to:

* [manage object locks](/s3/objects/manage-object-lock.mdx);
* [upload objects with an active lock](/s3/tools/aws-cli.mdx?upload-object=with-object-lock) (using only [S3 API](/api/object-storage-s3/) and [tools](/s3/tools/) that use it);
* [manage the default retention lock in the bucket](#manage-default-retention).

<Tabs queryString="enable-object-lock">
  <TabItem value="control-panel" default>
    <TabItemLabel>
      Control panel
    </TabItemLabel>

    If versioning is disabled or suspended in a bucket, it will be enabled automatically when Object Lock is enabled.

    1. In the [control panel](https://my.selectel.ru/storage/), on the top menu, click **Products** and select **S3**.

    2. Go to the **Buckets** section.

    3. Open the bucket page → **Configuration** tab.

    4. In the **Data protection** block, in the **Object Lock** row, click **Edit**.

    5. Select the **Enable Object Lock** checkbox.

    6. Optional: enable default retention in the bucket:

       6.1.Select the **Enable default retention** checkbox.

       6.2.Select the [lock mode](#lock-types-and-modes).

       6.3.Specify the lock duration. The maximum lock duration is:

       * for Compliance mode — one year. To set a Compliance lock for more than one year, use the API or tools, such as AWS CLI;
       * for Governance mode — 100 years.

       You will be able to [manage the default retention](#manage-default-retention) even after Object Lock is enabled.

    7. Click **Save**.
  </TabItem>

  <TabItem value="aws-cli">
    <TabItemLabel>
      AWS CLI
    </TabItemLabel>

    1. Make sure that [versioning is enabled](/s3/buckets/versioning.mdx#enable-versioning).

    2. If you have not used AWS CLI, [configure it](/s3/tools/aws-cli.mdx#configure-aws-cli).

    3. Open the CLI.

    4. Enable Object Lock:

       ```bash
       aws s3api put-object-lock-configuration \
           --bucket "<bucket_name>" \
           --object-lock-configuration '{
               "ObjectLockEnabled": "Enabled"}'
       ```

       Specify `<bucket_name>` as the bucket name.

    5. Verify that Object Lock is enabled:

       ```bash
       aws s3api get-object-lock-configuration --bucket "<bucket_name>"
       ```

       Specify `<bucket_name>` as the bucket name.

       When Object Lock is enabled, the response will be:

       ```bash
       {
           "ObjectLockConfiguration": {
               "ObjectLockEnabled": "Enabled"
           }
       }
       ```
  </TabItem>
</Tabs>

## Managing default retention in a bucket \{#manage-default-retention}

:::info

Default retention can be managed by:

* [Account Owner](/access-control/user-types.mdx#account-owner);
* users with the [`member`](/s3/about/manage-access.mdx#member), [`s3.admin`](/s3/about/manage-access.mdx#s3-admin), and [`object_storage:admin;`](/s3/about/manage-access.mdx#object-storage-admin) roles;
* users with the [`s3.bucket.user`](/s3/about/manage-access.mdx#s3-bucket-user), [`s3.user`](/s3/about/manage-access.mdx#s3-user), and [`object_storage_user`](/s3/about/manage-access.mdx#object-storage-user) roles, if the access policy allows them the relevant [actions](/s3/buckets/bucket-policy/about-bucket-policy.mdx#actions).

:::

### Enable default retention \{#enable-default-retention}

The temporary lock will be applied to all new objects in the bucket.

<Tabs queryString="enable-default-retention">
  <TabItem value="control-panel" default>
    <TabItemLabel>
      Control panel
    </TabItemLabel>

    1. In the [control panel](https://my.selectel.ru/storage/), on the top menu, click **Products** and select **S3**.

    2. Go to the **Buckets** section.

    3. Open the bucket page → **Configuration** tab.

    4. In the **Data protection** block, in the **Object Lock** row, click **Edit**.

    5. Make sure the **Enable Object Lock** checkbox is selected.

    6. Select the **Enable default retention** checkbox.

    7. Select a [lock mode](#lock-types-and-modes).

    8. Specify the lock duration. The maximum lock duration is:

       * for Compliance mode — one year. To set a Compliance lock for more than one year, use the API or tools, such as AWS CLI;
       * for Governance mode — 100 years.

    9. Click **Save**.
  </TabItem>

  <TabItem value="aws-cli">
    <TabItemLabel>
      AWS CLI
    </TabItemLabel>

    1. Open the CLI.

    2. Enable default retention in the bucket:

       ```bash
       aws s3api put-object-lock-configuration \
           --bucket "<bucket_name>" \
           --object-lock-configuration '{
               "ObjectLockEnabled": "Enabled",
               "Rule": { "DefaultRetention": { "Mode": "<lock_mode>", "<time_gap>": <number> } }
       }'
       ```

       Specify:

       * `<bucket_name>` — bucket name;
       * `<lock_mode>` — [lock mode](#lock-types-and-modes). Possible values are `GOVERNANCE` or `COMPLIANCE`;
       * `<time_gap>` — the time unit for the lock duration. Possible values are `DAYS` or `YEARS`;
       * `<number>` — lock duration in days or years. Cannot exceed 100 years.

    3. Verify that default retention is enabled in the bucket:

       ```bash
       aws s3api get-object-lock-configuration --bucket "<bucket_name>"
       ```

       Specify `<bucket_name>` as the bucket name.

       Example response when default retention is enabled:

       ```bash
       {
           "ObjectLockConfiguration": {
               "ObjectLockEnabled": "Enabled",
               "Rule": {
                   "DefaultRetention": {
                       "Mode": "GOVERNANCE",
                       "Days": 30
                   }
               }
           }
       }
       ```
  </TabItem>
</Tabs>

### Change default retention duration \{#change-default-retention-period-time}

If the lock mode is:

* Governance — the lock duration can be shortened or extended;
* Compliance — the lock duration can only be extended.

<Tabs queryString="change-default-retention-period-time">
  <TabItem value="control-panel" default>
    <TabItemLabel>
      Control panel
    </TabItemLabel>

    1. In the [control panel](https://my.selectel.ru/storage/), on the top menu, click **Products** and select **S3**.

    2. Go to the **Buckets** section.

    3. Open the bucket page → **Configuration** tab.

    4. In the **Data protection** block, in the **Object Lock** row, click **Edit**.

    5. Specify a new lock duration. The maximum lock duration is:

       * for Compliance mode — one year. To set a Compliance lock for more than one year, use the API or tools, such as AWS CLI;
       * for Governance mode — 100 years.

    6. Click **Save**.
  </TabItem>

  <TabItem value="aws-cli">
    <TabItemLabel>
      AWS CLI
    </TabItemLabel>

    To change the lock duration, use the [Enable default retention](#enable-default-retention) subsection and specify new values for the `<time_gap>` and `<number>` parameters;.
  </TabItem>
</Tabs>

### Change default retention mode \{#change-default-retention-period-mode}

You can only change the lock mode from Governance to Compliance.

<Tabs queryString="change-default-retention-period-regime">
  <TabItem value="control-panel" default>
    <TabItemLabel>
      Control panel
    </TabItemLabel>

    1. In the [control panel](https://my.selectel.ru/storage/), on the top menu, click **Products** and select **S3**.
    2. Go to the **Buckets** section.
    3. Open the bucket page → **Configuration** tab.
    4. In the **Data protection** block, in the **Object Lock** row, click **Edit**.
    5. Select the **Compliance** lock mode.
    6. Specify the lock duration. The maximum Compliance lock duration is one year. To set a Compliance lock for more than one year, use the API or tools, such as AWS CLI.
    7. Click **Save**.
  </TabItem>

  <TabItem value="aws-cli">
    <TabItemLabel>
      AWS CLI
    </TabItemLabel>

    To change the lock mode, use the [Enable default retention](#enable-default-retention) subsection and specify `COMPLIANCE` in the `<lock_mode>` parameter.
  </TabItem>
</Tabs>

### Disable default retention \{#disable-default-retention-perion}

You can only disable default retention in Governance mode.

When disabling temporary locking, new objects will not be locked. Objects that were uploaded and automatically locked before disabling temporary locking by default will remain locked in accordance with the [lock mode](#lock-types-and-modes). Object Lock itself will not be disabled in the bucket.

<Tabs queryString="disable-object-lock">
  <TabItem value="control-panel" default>
    <TabItemLabel>
      Control panel
    </TabItemLabel>

    Default retention can only be disabled in the control panel by the [Account Owner](/access-control/user-types.mdx#account-owner) or a user with the [`member`](/s3/about/manage-access.mdx#member) role.

    1. In the [control panel](https://my.selectel.ru/storage/), on the top menu, click **Products** and select **S3**.
    2. Go to the **Buckets** section.
    3. Open the bucket page → **Configuration** tab.
    4. In the **Data protection** block, in the **Object Lock** row, click **Edit**.
    5. Clear the **Enable default retention** checkbox.
    6. Click **Save**.
  </TabItem>

  <TabItem value="aws-cli">
    <TabItemLabel>
      AWS CLI
    </TabItemLabel>

    Default retention can be disabled via AWS CLI by the [Account Owner](/access-control/user-types.mdx#account-owner), a user with the [`member`](/s3/about/manage-access.mdx#member) role, or a user with another [role with S3 access](/s3/about/manage-access.mdx), if the access policy allows them the [action](/s3/buckets/bucket-policy/about-bucket-policy.mdx#actions) `s3:BypassGovernanceRetention`.

    1. Open the CLI.

    2. Disable default retention in the bucket:

       ```bash
       aws s3api put-object-lock-configuration \
           --bucket "<bucket_name>" \
           --object-lock-configuration '{
               "ObjectLockEnabled": "Enabled"
       }'
       ```

       Specify `<bucket_name>` as the bucket name.

    3. Verify that default retention is disabled in the bucket:

       ```bash
       aws s3api get-object-lock-configuration --bucket "<bucket_name>"
       ```

       Specify `<bucket_name>` as the bucket name.

       Example response when default retention is disabled:

       ```bash
       {
           "ObjectLockConfiguration": {
               "ObjectLockEnabled": "Enabled"
           }
       }
       ```
  </TabItem>
</Tabs>

<Formbricks />