Skip to content

Object Lock

  • Object Lock is enabled when the bucket is created, so it is an option in the order. It cannot be switched on afterwards, and it implies versioning.
  • Retention is applied per object version in compliance mode: no user, no key and no operator can delete or shorten it before the retention date. Legal holds are supported as well.
  • Backup software sets retention per restore point (Veeam: "make recent backups immutable for N days"). Set a default retention on the bucket if your client does not.
  • Locked versions stay stored, and billed, until they expire. A bucket with locked versions cannot be emptied early, so plan retention as a cost decision.

Enable a default retention with the AWS CLI:

aws --endpoint-url https://fra.s3.zeroservices.eu s3api put-object-lock-configuration \
  --bucket my-bucket --object-lock-configuration \
  'ObjectLockEnabled=Enabled,Rule={DefaultRetention={Mode=COMPLIANCE,Days=30}}'

Veeam setup: Veeam Backup & Replication.