S3 Object Lock

1. Overview

S3 Object Lock prevents objects from being deleted or overwritten for a fixed period of time, or indefinitely. It uses a write-once-read-many (WORM) model, which helps you meet regulatory and audit requirements and protects data against accidental or malicious deletion.

Object Lock is enabled at the bucket level and applies to the objects stored in that bucket.

2. Key Concepts

• Retention period: The length of time an object remains locked. During this period the object version cannot be overwritten or deleted.
• Retention mode: Determines how strictly the retention period is enforced. Two modes are defined by the S3 API:
  • Governance mode: Locked objects can still be overwritten or deleted, and retention can be shortened, but only by users with the special s3:BypassGovernanceRetention permission. Useful for testing and for protecting data while retaining an escape hatch.
  • Compliance mode: No user, including the account owner, can overwrite or delete the object or shorten its retention until the period expires. There is no bypass once the retention is set.
• Legal hold: A flag that is independent of the retention period. It prevents an object version from being deleted or overwritten indefinitely until the hold is removed (s3:PutObjectLegalHold).
• Versioning: Object Lock can only be enabled on a bucket that has versioning enabled. Locking applies to individual object versions.

3. Availability on Vietnix Cloud

Retention mode	Status on Vietnix Cloud S3 Storage
Governance mode	Supported
Compliance mode	Not yet supported

Compliance mode is not enabled yet

Vietnix Cloud S3 Storage currently supports Governance mode only. Compliance mode is not enabled at this time.

If your use case requires Compliance mode (for example, to satisfy a regulatory, legal, or audit requirement where retention must be impossible to bypass), you must contact Vietnix to request activation. Reach out through your Vietnix support channel or your account manager before you design a workflow that depends on Compliance mode.

4. Enabling Object Lock

Object Lock can be enabled through the S3 API using any S3-compatible tool, such as AWS CLI or the MinIO Client.

4.1. Create a bucket with Object Lock enabled

aws s3api create-bucket \
  --bucket your-bucket-name \
  --object-lock-enabled-for-bucket \
  --endpoint-url https://s3.vn-hcm-1.vietnix.cloud

4.2. Set a default retention rule for the bucket

The following example locks every new object for 30 days in Governance mode:

aws s3api put-object-lock-configuration \
  --bucket your-bucket-name \
  --object-lock-configuration 'ObjectLockEnabled=Enabled,Rule={DefaultRetention={Mode=GOVERNANCE,Days=30}}' \
  --endpoint-url https://s3.vn-hcm-1.vietnix.cloud

To use Compliance mode instead, replace GOVERNANCE with COMPLIANCE. Note that this will only work once Compliance mode is enabled for your account (see section 3).

4.3. Apply retention or a legal hold to a specific object

aws s3api put-object-retention \
  --bucket your-bucket-name \
  --key path/to/object \
  --retention 'Mode=GOVERNANCE,RetainUntilDate=2026-12-31T00:00:00Z' \
  --endpoint-url https://s3.vn-hcm-1.vietnix.cloud

aws s3api put-object-legal-hold \
  --bucket your-bucket-name \
  --key path/to/object \
  --legal-hold 'Status=ON' \
  --endpoint-url https://s3.vn-hcm-1.vietnix.cloud

4.4. Check the current configuration

aws s3api get-object-lock-configuration \
  --bucket your-bucket-name \
  --endpoint-url https://s3.vn-hcm-1.vietnix.cloud

5. Best Practices

• Plan before enabling. Once Object Lock is enabled on a bucket, it cannot be disabled. Confirm your retention requirements first.
• Start with Governance mode. Use it to validate your retention settings before committing to strict retention.
• Use legal hold for investigations. A legal hold is a quick way to freeze specific objects without changing the bucket default.
• Follow least privilege. Only grant s3:BypassGovernanceRetention and s3:PutObjectLegalHold to the roles that genuinely need them.
• Combine with lifecycle rules. Object Lock protects versions from deletion; lifecycle rules can still expire non-current versions once their retention has lapsed.

6. What's Next?

• Manage Bucket: Learn how to manage S3 buckets in Vietnix Cloud.
• Manage Access Key: Learn how to manage access keys for S3.
• AWS CLI: Connect AWS CLI to Vietnix Cloud S3 Storage.