All 7 S3 & Storage questions
More in S3 & Storage
What are the different S3 storage classes, and how do you choose the right one for a specific type of data? How do S3 lifecycle policies automatically transition objects between storage classes or delete them entirely based on defined rules? How do S3 bucket policies and access control lists work together to control who can access objects stored in a bucket? What is S3 versioning, and how does it help protect against accidental object deletion or overwrite? How can S3 Multi-Region Access Points and Cross-Region Replication support building a resilient, low latency, globally distributed storage architecture?
Advertisement
AWS › S3 & Storage

How does S3 Object Lock support compliance requirements for write once read many, or WORM, data storage?

Advanced

Answer

S3 Object Lock lets you store objects using a write once read many model, preventing an object from being deleted or overwritten for a fixed retention period or indefinitely, using either governance mode, which allows certain privileged users to override the lock if genuinely necessary, or compliance mode, which prevents even the root account from deleting or altering the object until the retention period expires, satisfying strict regulatory requirements common in industries like financial services and healthcare.
aws s3api put-object-lock-configuration --bucket my-bucket --object-lock-configuration '{"ObjectLockEnabled":"Enabled","Rule":{"DefaultRetention":{"Mode":"COMPLIANCE","Days":365}}}'
Real-world example A financial institution stores its regulatory audit records in an S3 bucket with Object Lock enabled in compliance mode, guaranteeing that these records cannot be deleted or modified by anyone, including an administrator, until their mandated one year retention period has fully expired.

Common follow-ups: What is the difference between governance mode and compliance mode in terms of who can override the lock?;Can Object Lock be enabled on an existing bucket that already contains data?

AWS Backup & Disaster Recovery;AWS Security Hub & GuardDuty
All 7 S3 & Storage questions