Object Lock

Last update: September 07 2026Open in Markdown

Object Lock uses the WORM (Write Once Read Many) principle and allows you to lock objects to prevent them from being overwritten or deleted.

To use Object Lock, versioning must be enabled in the bucket. Object Lock applies only to object versions.

Locking can have different types and modes. Depending on the lock type, you can set it on individual objects or on the bucket by default — the lock will apply to new objects.

The ability to manage locking also depends on the user's role and bucket policy rules, for more details, see the Managing S3 access guide. You can work with Object Lock in the Control Panel (capabilities are limited), via S3 API and tools that use it — for example, AWS CLI.

To manage object locks after configuring Object Lock, use the Managing object locks guide.

If you delete a project that contains locked objects, they will not be deleted as long as the lock is active. At the same time, they will not be displayed in the Control Panel or via the API. To restore locked objects after deleting a project, create a ticket.

Types and retention modes

Locking can be temporary or indefinite. Temporary locking has two modes: Governance and Compliance.

If both a temporary and an indefinite lock are enabled for an object, the indefinite lock takes precedence.

	Indefinite	Temporary
		Governance mode	Compliance mode
What can it be applied to	Objects	to objects; to the default bucket — the lock will be applied to all new objects	to objects; to the default bucket — the lock will be applied to all new objects
Possible locking actions	Disabling the lock	shortening the lock duration *; extending the lock duration; changing the locking mode to Compliance	Extending the lock duration
Ability to delete objects	No one can while the lock is enabled	You can *	No one can until the lock expiration date

* Available only to users:

• with the member; role;
• with other roles with S3 access, if the bucket has an access policy that allows the action s3:BypassGovernance.

Enable Object Lock in a bucket

For your information

Object Lock can be enabled by:

• The account owner;
• users with the member, s3.admin, and object_storage:admin; roles;
• users with the s3.bucket.user, s3.user, and object_storage_user roles if the access policy allows them the action s3:PutBucketObjectLockConfiguration.

If you enable Object Lock, it cannot be disabled, and versioning cannot be suspended.

Enabling Object Lock does not lock objects automatically. After configuring Object Lock in a bucket, you will be able to:

• manage object locks;
• upload objects with an active lock (using only S3 API and tools that use it);
• manage the default retention lock in the bucket.

Control panel

If versioning is disabled or suspended in a bucket, it will be enabled automatically when Object Lock is enabled.

1. In the control panel, on the top menu, click Products and select S3.

2. Go to the Buckets section.

3. Open the bucket page → Configuration tab.

4. In the Data protection block, in the Object Lock row, click Edit.

5. Select the Enable Object Lock checkbox.

6. Optional: enable default retention in the bucket:

   6.1.Select the Enable default retention checkbox.

   6.2.Select the lock mode.

   6.3.Specify the lock duration. The maximum lock duration is:

   • for Compliance mode — one year. To set a Compliance lock for more than one year, use the API or tools, such as AWS CLI;
   • for Governance mode — 100 years.

   You will be able to manage the default retention even after Object Lock is enabled.

7. Click Save.

AWS CLI

1. Make sure that versioning is enabled.

2. If you have not used AWS CLI, configure it.

3. Open the CLI.

4. Enable Object Lock:

   aws s3api put-object-lock-configuration \
       --bucket "<bucket_name>" \
       --object-lock-configuration '{
           "ObjectLockEnabled": "Enabled"}'

   Specify <bucket_name> as the bucket name.

5. Verify that Object Lock is enabled:

   aws s3api get-object-lock-configuration --bucket "<bucket_name>"

   Specify <bucket_name> as the bucket name.

   When Object Lock is enabled, the response will be:

   {
       "ObjectLockConfiguration": {
           "ObjectLockEnabled": "Enabled"
       }
   }

Managing default retention in a bucket

For your information

Default retention can be managed by:

• Account Owner;
• users with the member, s3.admin, and object_storage:admin; roles;
• users with the s3.bucket.user, s3.user, and object_storage_user roles, if the access policy allows them the relevant actions.

Enable default retention

The temporary lock will be applied to all new objects in the bucket.

Control panel

1. In the control panel, on the top menu, click Products and select S3.

2. Go to the Buckets section.

3. Open the bucket page → Configuration tab.

4. In the Data protection block, in the Object Lock row, click Edit.

5. Make sure the Enable Object Lock checkbox is selected.

6. Select the Enable default retention checkbox.

7. Select a lock mode.

8. Specify the lock duration. The maximum lock duration is:

   • for Compliance mode — one year. To set a Compliance lock for more than one year, use the API or tools, such as AWS CLI;
   • for Governance mode — 100 years.

9. Click Save.

AWS CLI

1. Open the CLI.

2. Enable default retention in the bucket:

   aws s3api put-object-lock-configuration \
       --bucket "<bucket_name>" \
       --object-lock-configuration '{
           "ObjectLockEnabled": "Enabled",
           "Rule": { "DefaultRetention": { "Mode": "<lock_mode>", "<time_gap>": <number> } }
   }'

   Specify:

   • <bucket_name> — bucket name;
   • <lock_mode> — lock mode. Possible values are GOVERNANCE or COMPLIANCE;
   • <time_gap> — the time unit for the lock duration. Possible values are DAYS or YEARS;
   • <number> — lock duration in days or years. Cannot exceed 100 years.

3. Verify that default retention is enabled in the bucket:

   aws s3api get-object-lock-configuration --bucket "<bucket_name>"

   Specify <bucket_name> as the bucket name.

   Example response when default retention is enabled:

   {
       "ObjectLockConfiguration": {
           "ObjectLockEnabled": "Enabled",
           "Rule": {
               "DefaultRetention": {
                   "Mode": "GOVERNANCE",
                   "Days": 30
               }
           }
       }
   }

Change default retention duration

If the lock mode is:

• Governance — the lock duration can be shortened or extended;
• Compliance — the lock duration can only be extended.

Control panel

1. In the control panel, on the top menu, click Products and select S3.

2. Go to the Buckets section.

3. Open the bucket page → Configuration tab.

4. In the Data protection block, in the Object Lock row, click Edit.

5. Specify a new lock duration. The maximum lock duration is:

   • for Compliance mode — one year. To set a Compliance lock for more than one year, use the API or tools, such as AWS CLI;
   • for Governance mode — 100 years.

6. Click Save.

AWS CLI

To change the lock duration, use the Enable default retention subsection and specify new values for the <time_gap> and <number> parameters;.

Change default retention mode

You can only change the lock mode from Governance to Compliance.

Control panel

1. In the control panel, on the top menu, click Products and select S3.
2. Go to the Buckets section.
3. Open the bucket page → Configuration tab.
4. In the Data protection block, in the Object Lock row, click Edit.
5. Select the Compliance lock mode.
6. Specify the lock duration. The maximum Compliance lock duration is one year. To set a Compliance lock for more than one year, use the API or tools, such as AWS CLI.
7. Click Save.

AWS CLI

To change the lock mode, use the Enable default retention subsection and specify COMPLIANCE in the <lock_mode> parameter.

Disable default retention

You can only disable default retention in Governance mode.

When disabling temporary locking, new objects will not be locked. Objects that were uploaded and automatically locked before disabling temporary locking by default will remain locked in accordance with the lock mode. Object Lock itself will not be disabled in the bucket.

Control panel

Default retention can only be disabled in the control panel by the Account Owner or a user with the member role.

1. In the control panel, on the top menu, click Products and select S3.
2. Go to the Buckets section.
3. Open the bucket page → Configuration tab.
4. In the Data protection block, in the Object Lock row, click Edit.
5. Clear the Enable default retention checkbox.
6. Click Save.

AWS CLI

Default retention can be disabled via AWS CLI by the Account Owner, a user with the member role, or a user with another role with S3 access, if the access policy allows them the action s3:BypassGovernanceRetention.

1. Open the CLI.

2. Disable default retention in the bucket:

   aws s3api put-object-lock-configuration \
       --bucket "<bucket_name>" \
       --object-lock-configuration '{
           "ObjectLockEnabled": "Enabled"
   }'

   Specify <bucket_name> as the bucket name.

3. Verify that default retention is disabled in the bucket:

   aws s3api get-object-lock-configuration --bucket "<bucket_name>"

   Specify <bucket_name> as the bucket name.

   Example response when default retention is disabled:

   {
       "ObjectLockConfiguration": {
           "ObjectLockEnabled": "Enabled"
       }
   }