---
title: "Manage object lock"
sidebar_label: "Manage object lock"
description: "How to manage indefinite and temporary locking: enable, change lock duration, change lock mode, disable"
sidebar_position: 6
---

import Tabs from '@theme/Tabs'
import TabItem from '@theme/TabItem'
import {TabItemLabel} from '@selectel/docux/components'
import Formbricks from '@theme/MDXComponents/Formbricks'

# Manage object lock

:::info

Object locking can be managed by:

* [Account owner](/access-control/user-types.mdx#account-owner);
* users with the [`member`](/s3/about/manage-access.mdx#member), [`s3.admin`](/s3/about/manage-access.mdx#s3-admin) and [`object_storage:admin`](/s3/about/manage-access.mdx#object-storage-admin) roles;
* users with the [`s3.bucket.user`](/s3/about/manage-access.mdx#s3-bucket-user), [`s3.user`](/s3/about/manage-access.mdx#s3-user), and [`object_storage_user`](/s3/about/manage-access.mdx#object-storage-user) roles, if their access policy allows them the corresponding [actions](/s3/buckets/bucket-policy/about-bucket-policy.mdx#actions).

:::

If [Object Lock is enabled](/s3/buckets/object-lock.mdx#enable-object-lock) in your bucket, you can manage object locks. Available lock actions depend on the [lock type and mode](/s3/buckets/object-lock.mdx#lock-types-and-modes).

Object locking can be managed in the control panel, through [S3 API](/api/object-storage-s3/), and [tools](/s3/tools/) that use it—for example, [AWS CLI](/s3/tools/aws-cli.mdx).

## Retention-period lock \{#retention-period}

### Check for a retention-period lock \{#check-retention-period}

If you have [objects with segments](/s3/objects/upload-object.mdx#segmented-upload), you cannot check the lock status on individual segments; you can only check the lock on the object itself. Segments inherit the lock settings applied to the object.

<Tabs queryString="check-retention-period">
  <TabItem value="control-panel" default>
    <TabItemLabel>
      Control panel
    </TabItemLabel>

    1. In the [control panel](https://my.selectel.ru/storage/), on the top menu, click **Products** and select **S3**.
    2. Go to the **Buckets** section.
    3. Open the bucket page → **Objects** tab.
    4. Open the object page.
    5. In the **Object Lock** block, check the retention-period lock status.
  </TabItem>

  <TabItem value="aws-cli">
    <TabItemLabel>
      AWS CLI
    </TabItemLabel>

    1. Open the CLI.

    2. If you want to check the lock for a specific object version:

       2.1. Get the object version ID:

       ```bash
       aws s3api list-object-versions --bucket <bucket_name> --prefix <path_to_object>
       ```

       Specify:

       * `<bucket_name>` — bucket name;
       * `<path_to_object>` — path to the object in the bucket.

       2.2. Copy the ID of the required object version from the `VersionId` field.

    3. Check for the lock:

       ```bash
       aws s3api get-object-retention \
       --bucket <bucket_name> \
       --key <path_to_object> \
       --version-id <version_id>
       ```

       Specify:

       * `<bucket_name>` — bucket name;
       * `<path_to_object>` — path to the object in the bucket;
       * optional: `--version-id <version_id>` — parameter specifying a specific object [version](/s3/buckets/versioning.mdx#object-versions). Here, `<version_id>` is the version ID copied in step 2.2. If this parameter is not specified, the lock is checked for the current object version.
  </TabItem>
</Tabs>

### Enable retention-period lock \{#enable-retention-period}

If both a retention-period lock and a legal hold are enabled for an object, the legal hold takes precedence.

To have the retention-period lock applied to all new objects in a bucket by default, use the [Enable retention-period lock in a bucket by default](/s3/buckets/object-lock.mdx#enable-default-retention) section of the [Object Lock](/s3/buckets/object-lock.mdx) guide.

To upload an object with a lock enabled immediately, use AWS CLI; for details, see the [Upload object](/s3/tools/aws-cli.mdx#upload-object) section of the [AWS CLI](/s3/tools/aws-cli/) guide.

<Tabs queryString="enable-retention-period">
  <TabItem value="control-panel" default>
    <TabItemLabel>
      Control panel
    </TabItemLabel>

    1. In the [control panel](https://my.selectel.ru/storage/), on the top menu, click **Products** and select **S3**.

    2. Go to the **Buckets** section.

    3. Open the bucket page → **Objects** tab.

    4. Open the object page.

    5. In the **Object Lock** block, in the **Retention-period lock** row, click **Edit**.

    6. Select the **Lock object** checkbox.

    7. Select a [lock mode](/s3/buckets/object-lock.mdx#lock-types-and-modes).

    8. Specify the lock duration. Maximum lock duration:

       * for Compliance mode — one year. To set a Compliance lock for more than one year, use the API or tools, such as AWS CLI;
       * for Governance mode — 100 years.

    9. Click **Save**.
  </TabItem>

  <TabItem value="aws-cli">
    <TabItemLabel>
      AWS CLI
    </TabItemLabel>

    1. Open the CLI.

    2. If you want to lock an object version other than the current one:

       2.1. Get the object version ID:

       ```bash
       aws s3api list-object-versions --bucket <bucket_name> --prefix <path_to_object>
       ```

       Specify:

       * `<bucket_name>` — bucket name;
       * `<path_to_object>` — path to the object in the bucket.

       2.2. For the required object version, copy the ID specified in the `VersionId` field.

    3. Lock the object:

       ```bash
       aws s3api put-object-retention \
       --bucket <bucket_name> \
       --key <path_to_object> \
       --version-id <version_id> \
       --retention '{"Mode":"<lock_mode>","RetainUntilDate":"<date>"}'
       ```

       Specify:

       * `<bucket_name>` — bucket name;
       * `<path_to_object>` — path to the object in the bucket;
       * optionally: `--version-id <version_id>` — a parameter that points to a specific [version](/s3/buckets/versioning.mdx#object-versions) of the object. Here `<version_id>` is the version ID you copied in step 2.2. If you do not specify the parameter, the lock will be applied to the current object version;
       * `<lock_mode>` — [lock mode](/s3/buckets/object-lock.mdx#lock-types-and-modes). Possible values are `GOVERNANCE` or `COMPLIANCE`;
       * `<date>` — the date until which the object will be locked, in ISO 8601 format, for example `2025-09-06T00:00:00Z`. The object lock duration cannot exceed 100 years.
  </TabItem>
</Tabs>

### Change temporary lock duration \{#change-retention-period-time}

If the lock mode is set to:

* Governance — the lock duration can be shortened or extended;
* Compliance — the lock duration can only be extended.

<Tabs queryString="change-retention-period-time">
  <TabItem value="control-panel" default>
    <TabItemLabel>
      Control panel
    </TabItemLabel>

    In the Control Panel, you can only extend the lock duration. To reduce the duration, use the [S3 API](/api/object-storage-s3/) or [tools](/s3/tools/) that use it, such as [AWS CLI](/s3/tools/aws-cli.mdx).

    1. In the [control panel](https://my.selectel.ru/storage/), on the top menu, click **Products** and select **S3**.

    2. Go to the **Buckets** section.

    3. Open the bucket page → **Objects** tab.

    4. Open the object page.

    5. In the **Object Lock** block, in the **Temporary lock** row, click **Edit**.

    6. Specify the new lock duration. Maximum lock duration:

       * for Compliance mode — one year. To set a Compliance lock for more than one year, use the API or tools, such as AWS CLI;
       * for Governance mode — 100 years.

    7. Click **Save**.
  </TabItem>

  <TabItem value="aws-cli">
    <TabItemLabel>
      AWS CLI
    </TabItemLabel>

    To change the lock duration, use the [Enable temporary lock](#enable-retention-period) subsection and specify the new value in the `RetainUntilDate` field.
  </TabItem>
</Tabs>

### Change temporary lock mode \{#change-retention-period-mode}

You can only change the lock mode from Governance to Compliance.

<Tabs queryString="change-retention-period-regime">
  <TabItem value="control-panel" default>
    <TabItemLabel>
      Control panel
    </TabItemLabel>

    You cannot change the retention mode in the Control Panel. Use the [S3 API](/api/object-storage-s3/) or [tools](/s3/tools/) that use it, such as [AWS CLI](/s3/tools/aws-cli.mdx).
  </TabItem>

  <TabItem value="aws-cli">
    <TabItemLabel>
      AWS CLI
    </TabItemLabel>

    To change the lock mode, use the [Enable temporary lock](#enable-retention-period) subsection and specify `Mode` as `COMPLIANCE`.
  </TabItem>
</Tabs>

### Disable temporary lock \{#disable-retention-period}

You can only disable a temporary lock in Governance mode.

<Tabs queryString="disable-retention-period">
  <TabItem value="control-panel" default>
    <TabItemLabel>
      Control panel
    </TabItemLabel>

    In the control panel, a temporary lock can only be disabled by the [Account Owner](/access-control/user-types.mdx#account-owner) or a user with the [`member`](/s3/about/manage-access.mdx#member) role.

    1. In the [control panel](https://my.selectel.ru/storage/), on the top menu, click **Products** and select **S3**.
    2. Go to the **Buckets** section.
    3. Open the bucket page → **Objects** tab.
    4. Open the object page.
    5. In the **Object Lock** block, in the **Temporary lock** row, click **Edit**.
    6. Uncheck the **Lock object** checkbox.
    7. Click **Save**.
  </TabItem>

  <TabItem value="aws-cli">
    <TabItemLabel>
      AWS CLI
    </TabItemLabel>

    The temporary lock can be disabled via AWS CLI by the [Account Owner](/access-control/user-types.mdx#account-owner), a user with the [`member`](/s3/about/manage-access.mdx#member) role, or a user with another [role with access to S3](/s3/about/manage-access.mdx) if their access policy allows them the [action](/s3/buckets/bucket-policy/about-bucket-policy.mdx#actions) `s3:BypassGovernanceRetention`.

    1. Open the CLI.

    2. If you want to disable the lock for a specific object version:

       2.1. Get the object version ID:

       ```bash
       aws s3api list-object-versions --bucket <bucket_name> --prefix <path_to_object>
       ```

       Specify:

       * `<bucket_name>` — bucket name;
       * `<path_to_object>` — path to the object in the bucket.

       2.2. For the required object version, copy the ID specified in the `VersionId` field.

    3. Disable the lock:

       ```bash
       aws s3api put-object-retention \
           --bucket <bucket_name> \
           --key "<path_to_object>" \
           --version-id <version_id> \
           --retention '{}' \
           --bypass-governance-retention
       ```

       Specify:

       * `<bucket_name>` — bucket name;
       * `<path_to_object>` — path to the object in the bucket;
       * optionally: `--version-id <version_id>` — a parameter that points to a specific [version](/s3/buckets/versioning.mdx#object-versions) of the object. Here `<version_id>` is the version ID you copied in step 2.2. If you do not specify the parameter, the lock will be disabled for the current object version.
  </TabItem>
</Tabs>

## Legal hold \{#legal-hold}

### Check for a legal hold \{#check-legal-hold}

If you have [objects with segments](/s3/objects/upload-object.mdx#segmented-upload), you cannot check the lock status on individual segments; you can only check the lock on the object itself. Segments inherit the lock settings applied to the object.

<Tabs queryString="check-legal-hold">
  <TabItem value="control-panel" default>
    <TabItemLabel>
      Control panel
    </TabItemLabel>

    1. In the [control panel](https://my.selectel.ru/storage/), on the top menu, click **Products** and select **S3**.
    2. Go to the **Buckets** section.
    3. Open the bucket page → **Objects** tab.
    4. Open the object page.
    5. In the **Object Lock** block, check the status of the legal hold.
  </TabItem>

  <TabItem value="aws-cli">
    <TabItemLabel>
      AWS CLI
    </TabItemLabel>

    1. Open the CLI.

    2. If you want to check the lock for a specific object version:

       2.1. Get the object version ID:

       ```bash
       aws s3api list-object-versions --bucket <bucket_name> --prefix <path_to_object>
       ```

       Specify:

       * `<bucket_name>` — bucket name;
       * `<path_to_object>` — path to the object in the bucket.

       2.2. For the required object version, copy the ID specified in the `VersionId` field.

    3. Check for the lock:

       ```bash
       aws s3api get-object-legal-hold \
           --bucket <bucket_name> \
           --key <path_to_object> \
           --version-id <version_id>
       ```

       Specify:

       * `<bucket_name>` — bucket name;
       * `<path_to_object>` — path to the object in the bucket;
       * optionally: `--version-id <version_id>` — a parameter that points to a specific [version](/s3/buckets/versioning.mdx#object-versions) of the object. Here `<version_id>` is the version ID you copied in step 2.2. If you do not specify the parameter, the lock will be checked for the current object version.
  </TabItem>
</Tabs>

### Enable legal hold \{#enable-legal-hold}

If both a temporary lock and a legal hold are enabled for an object at the same time, the legal hold has priority.

<Tabs queryString="enable-legal-hold">
  <TabItem value="control-panel" default>
    <TabItemLabel>
      Control panel
    </TabItemLabel>

    1. In the [control panel](https://my.selectel.ru/storage/), on the top menu, click **Products** and select **S3**.
    2. Go to the **Buckets** section.
    3. Open the bucket page → **Objects** tab.
    4. Open the object page.
    5. In the **Object Lock** block, enable the legal hold.
  </TabItem>

  <TabItem value="aws-cli">
    <TabItemLabel>
      AWS CLI
    </TabItemLabel>

    1. Open the CLI.

    2. If you want to lock an object version other than the current one:

       2.1. Get the object version ID:

       ```bash
       aws s3api list-object-versions --bucket <bucket_name> --prefix <path_to_object>
       ```

       Specify:

       * `<bucket_name>` — bucket name;
       * `<path_to_object>` — path to the object in the bucket.

       2.2. For the required object version, copy the ID specified in the `VersionId` field.

    3. Lock the object:

       ```bash
       aws s3api put-object-legal-hold \
           --bucket <bucket_name> \
           --key <path_to_object> \
           --version-id <version_id> \
           --legal-hold '{"Status": "ON"}'
       ```

       Specify:

       * `<bucket_name>` — bucket name;
       * `<path_to_object>` — path to the object in the bucket;
       * optionally: `--version-id <version_id>` — a parameter that points to a specific [version](/s3/buckets/versioning.mdx#object-versions) of the object. Here `<version_id>` is the version ID you copied in step 2.2. If you do not specify the parameter, the lock will be applied to the current object version.
  </TabItem>
</Tabs>

### Disable legal hold \{#disable-legal-hold}

<Tabs queryString="disable-legal-hold">
  <TabItem value="control-panel" default>
    <TabItemLabel>
      Control panel
    </TabItemLabel>

    1. In the [control panel](https://my.selectel.ru/storage/), on the top menu, click **Products** and select **S3**.
    2. Go to the **Buckets** section.
    3. Open the bucket page → **Objects** tab.
    4. Open the object page.
    5. In the **Object Lock** block, disable the legal hold.
  </TabItem>

  <TabItem value="aws-cli">
    <TabItemLabel>
      AWS CLI
    </TabItemLabel>

    1. Open the CLI.

    2. If you want to disable the lock for an object version other than the current one:

       2.1. Get the object version ID:

       ```bash
       aws s3api list-object-versions --bucket <bucket_name> --prefix <path_to_object>
       ```

       Specify:

       * `<bucket_name>` — bucket name;
       * `<path_to_object>` — path to the object in the bucket.

       2.2. For the required object version, copy the ID specified in the `VersionId` field.

    3. Disable the lock:

       ```bash
       aws s3api put-object-legal-hold \
           --bucket <bucket_name> \
           --key <path_to_object> \
           --version-id <version_id> \
           --legal-hold '{"Status": "OFF"}'
       ```

       Specify:

       * `<bucket_name>` — bucket name;
       * `<path_to_object>` — path to the object in the bucket;
       * optionally: `--version-id <version_id>` — a parameter that points to a specific [version](/s3/buckets/versioning.mdx#object-versions) of the object. Here `<version_id>` is the version ID you copied in step 2.2. If you do not specify the parameter, the lock will be removed from the current object version.
  </TabItem>
</Tabs>

<Formbricks />