Skip to main content

Object lock

Intro​

Object Lock is a S3 feature for versioned buckets supported by Cubbit. This feature provides an added layer of protection for your data, allowing you to lock objects to prevent accidental or unauthorized deletion or overwrites. Object Lock is especially useful when it comes to data retention and regulatory compliance, which is why it has become increasingly important for many businesses.

Cubbit supports both duration-based object retention and indefinite Legal Hold retention.

Object Lock allows you to apply two different methods of preventing object deletion or modification: retention periods and legal holds.

Retention periods​

Retention periods are time-based policies that prevent objects from being deleted or modified until a specific date or time has been reached. You can set retention periods on individual objects or on an entire bucket.

In a bucket, you can set the default retention period to apply to all objects uploaded to the bucket, or you can set a retention period on individual objects. Existing objects are not retroactively locked when you set a bucket default; only objects uploaded afterwards inherit it.

To work with retention periods, you can use the S3 APIs PutObjectLockConfiguration to set the default retention configuration on a bucket, which will be applied to all objects which will be uploaded into it.

A new object inherits the bucket default retention periodPUTOBJECTLOCKCONFIGURATIONbucketDefault retention · 30 daysRule · DefaultRetentionMode · COMPLIANCEapplies to everynew objectnew object versionRetain until creation + 30 dayslocked by bucket default
Default retention set on the bucket is inherited by every object uploaded afterwards.

Otherwise, you can set a retention period on individual objects using the S3 API PutObjectRetention. This overrides the default bucket retention configuration for that specific object.

PutObjectRetention overrides the bucket default for a single objectPUTOBJECTRETENTIONoverride · retain until 2024-02-16T00:00:00Zbucket default · 30 daysoverride · retain untillockednowdefault expiry2024-02-16
Object-level retention overrides the bucket default for that specific object only.

Legal holds are another method of preventing object deletion or modification, but they are not time-based. Instead, legal holds are designed to keep objects preserved indefinitely until the legal hold is removed. You can set a legal hold on individual objects, but not on an entire bucket.

When a legal hold is in effect, the object cannot be deleted or modified until the hold is removed. Legal holds can be used for legal or regulatory compliance purposes.

To set a legal hold on an object, you can use the S3 API PutObjectLegalHold.

A legal hold preserves an object version indefinitelyPUTOBJECTLEGALHOLD · STATUS=ONLegal hold · until the hold is removedheld∞nownot a date — the object stays locked until the hold is removed
Legal holds are not time-based: the object stays locked until the hold is removed.

Compliance and Governance modes​

Object Lock has two retention modes: compliance and governance. Compliance mode is designed for regulatory compliance purposes, while governance mode is designed for general object management.

In both modes of Object Lock, the primary function remains the same: to prevent any deletion or modification of object versions. When it comes to updating existing retention settings, it is only permitted to extend the retention period.

Difference between the two modes is that the governance mode may allow for Object Lock to be bypassed, if user has some special permissions: either user has the s3:BypassGovernanceRetention permission or is an ROOT user. Moreover, the bypassing request needs to have the x-amz-bypass-governance-retention:true header set. Bypassing Object Lock means that, the object version may be deleted or modified and the retention may be updated in any way.

Bypassing governance retention does not affect an existing legal hold: an object version with a legal hold remains protected and cannot be deleted or overwritten until the hold is removed.

Locked objects​

Cubbit blocks any attempt to delete a specific object version which is locked, either through a legal hold or a retention period which is still not expired.

Deleting a specific version of a locked object is blockedDELETE · ?versionId=v2v3 · unlockedv2 · lockedretention activev1 · unlockedDELETE ?versionId=v2403AccessDenied · retained
A delete that targets a locked version is rejected; the version stays in place.

However, normal delete operations without specifying the version ID, still follow the normal behavior in versioned buckets and a delete marker is created.

Object Lock and lifecycle configuration​

Object Lock prevents the deletion of locked object versions, but it does not remove old versions by itself. To delete noncurrent versions after their retention expires, configure a NoncurrentVersionExpiration rule in the bucket lifecycle configuration.

Lifecycle deletion respects Object Lock: a noncurrent version is skipped while it has an active legal hold or its retention period has not expired. The version becomes eligible for deletion only after the retention period expires and, if present, the legal hold is removed.

This lets you enforce a retention window while still deleting versions once they become eligible for lifecycle deletion. PutBucketLifecycleConfiguration replaces the existing configuration; see Lifecycle Configuration.

Requirements for Object Lock​

There are a few requirements to remember when working with this feature, which are strictly related to bucket versioning.

  • You can only turn on object locking during bucket creation. A bucket created without Object Lock cannot be converted: create a new bucket with Object Lock enabled and copy the current objects into it. Version history and existing retention dates are not carried over.
  • When you create a bucket with Object Lock enabled, bucket versioning is automatically enabled.
  • You cannot turn off Object Lock or suspend versioning for a bucket that you created with Object Lock enabled.

How to​

The following section explains how to work with this feature, either using the Cubbit Console or the AWS s3api CLI commands. The examples use the <your-endpoint-gateway> placeholder: replace it with the endpoint gateway assigned to your account (see Endpoint gateway to retrieve it from the console).

Create a bucket with object locking enabled​

Let's start enabling object locking on a brand new bucket.

As we just said, according to the S3 protocol, the only way to enable locking on a bucket is during its creation.

  1. Sign in with the Cubbit Console.
  2. Click on the "Create bucket" button on the top right.
  3. Insert a bucket name in the top section called "Bucket name".
  4. In the section "Object Lock", enable "Object Lock enabled".
  5. Optionally, enable "Retention enabled" and configure the default retention mode (Compliance mode or Governance mode) and the retention period (in days or years).
  6. Click on the "Create bucket" button.

Object Lock alone does not apply a retention period: enable "Retention enabled" to lock new uploads automatically, or set object-level retention/legal hold on individual objects.

Cubbit Console - Create bucket with object locking

You should see a brand new bucket, with both versioning and object locking enabled.

note

Retention settings apply to objects uploaded after the settings are saved and can be changed later from the bucket settings. Existing objects are not retroactively locked. Object Lock itself cannot be enabled after bucket creation.

Set a default retention period on the bucket​

You can set a default retention period on an existing bucket with Object Lock enabled, either by days or years. The new default applies to objects uploaded after the configuration is saved; objects already in the bucket keep their current retention unless an object-level retention is set on them.

  1. Open the bucket list in the Cubbit Console.
  2. Click the three dots icon on the right of the bucket and select "Manage".
  3. In the "Object Lock" section, enable "Retention enabled".
  4. Choose the retention mode, either "Compliance mode" or "Governance mode".
  5. Set the retention period in days or years.
  6. Click "Save".

Cubbit Console - Set a default retention period on the bucket

note

For buckets created with Object Lock, the "Object Lock enabled" option is read-only after creation. Only the retention settings can be changed.

For the differences between the two modes and the governance bypass rules, see Compliance and Governance modes.

Lock a specific object up to a retention date​

You can then set a retention period on a specific object.

You can access this menu opening the object menu by clicking on the three dots icon on the right and clicking on the "Object details" button:

Cubbit Console - Lock a specific object up to a retention date

You can then set a legal hold on a specific object.

As above, you can access this menu opening the object menu by clicking on the three dots icon on the right and clicking on the "Object details" button:

Cubbit Console - Lock a specific object indefinitely with a legal hold

Last updated on