# Ensure S3 Bucket Default Lock Enabled - Source: https://support.icompaas.com/support/solutions/articles/62000223481-ensure-s3-bucket-default-lock-enabled - Section: [Solutions](https://support.icompaas.com/support/solutions) › [Security Controls](https://support.icompaas.com/support/solutions/62000065178) › [AWS Services](https://support.icompaas.com/support/solutions/folders/62000097507) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) ### **Description:** Ensure that your Amazon S3 buckets have the Object Lock feature enabled to prevent the objects they store from being deleted.  AWS S3 Object Lock enables you to store your S3 objects in an immutable form, providing an additional layer of protection against object changes and deletion. S3 Object Lock feature can also help you meet regulatory requirements. **Rationale:** Amazon S3 Object Lock is an Amazon S3 feature that allows you to store objects using a write once, read many models. You can use WORM protection for scenarios where it is imperative that data is not changed or deleted after it has been written. **Impact:** Object lock enables adding an extra layer of protection against object changes and deletion. **Default Value:** S3 bucket Object Lock default value is disabled. ### **Pre-Requisites:** 1. Object Versioning should be enabled. 2. (Optional) Configure a default retention period for objects placed in the bucket. 3. Place the objects that you want to lock in the bucket. 4. Apply a retention period, a legal hold, or both, to the objects that you want to protect. **Note:** Object Lock cannot be enabled **after** the creation of an **S3 Bucket**. ### **Test Plan:** -  Sign in to the AWS Management Console. -  Open the Amazon S3 console at [https://console.aws.amazon.com/s3/](https://console.aws.amazon.com/s3/ "https://console.aws.amazon.com/s3/"). -  In the **Buckets** list, choose the name of the bucket that you want. - Select the Properties tab from the S3 dashboard top menu to view bucket properties. ![](https://support.icompaas.com/assets/kb/0f2dd1703dbdefff.png) - In the Advanced settings section, check the Object Lock feature status. If the configuration status is set to Disabled, Object Lock is not enabled for the selected Amazon S3 bucket. ![](https://support.icompaas.com/assets/kb/ef8e0df55bba3398.png) **Using AWS CLI:** **It will give us what is the current object lock status**  aws s3api get-object-lock-configuration --bucket ### **Implementation Steps:** - Sign in to the AWS Management Console. - Go to the S3 service dashboard at [https://console.aws.amazon.com/s3/](https://console.aws.amazon.com/s3/ "https://console.aws.amazon.com/s3/"). - select the bucket that you want to enable the Object lock. - Click on the **Properties** tab.![](https://support.icompaas.com/assets/kb/f7164e7a76fd776c.png)  - Go to Object lock.![](https://support.icompaas.com/assets/kb/78207b578e65d829.png) - To enable object lock we need to contact customer support![](https://support.icompaas.com/assets/kb/4e87550b5a18b29e.png) - When we clicked on customer support it will navigate to the next page. - Then it navigates to compliance report support we need to fill in the necessary details on this page. ![](https://support.icompaas.com/assets/kb/43d7b9001f6b312e.png) - Check the check box and Click on interest and **Submit**.![](https://support.icompaas.com/assets/kb/5866898f687cc732.png) - It will navigate to the confirmation page and you will also get confirmation to mail. Then follow the process suggested by the AWS.![](https://support.icompaas.com/assets/kb/7f07eee44efb4827.png) **Using AWS CLI:** **It will change the object lock Disable to Enable** aws s3api put-object-lock-configuration \\ --bucket my-bucket-with-object-lock \\ --object-lock-configuration '{ "ObjectLockEnabled": "Enabled", "Rule": { "DefaultRetention": { "Mode": "COMPLIANCE", "Days": 50 }}}' **Back out a plan:** - Once the object is enabled we can’t disable it![](https://support.icompaas.com/assets/kb/af78c9bfc833493f.png) **Using AWS CLI:** It will change the object lock Enable to Disable aws s3api put-object-lock-configuration \\ --bucket my-bucket-with-object-lock \\ --object-lock-configuration '{ "ObjectLockDisabled": "Disabled", "Rule": { "DefaultRetention": { "Mode": "COMPLIANCE", "Days": 50 }}}' ### Reference: [![](https://support.icompaas.com/assets/kb/b7a162fd59c39fe6.png)How S3 Object Lock works - Amazon Simple Storage Service](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-overview.html)  [![](https://support.icompaas.com/assets/kb/f9b903d3e049f63b.png)Configuring S3 Object Lock using the console - Amazon Simple Storage Service](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-console.html)  [![](https://support.icompaas.com/assets/kb/8b82fedbad8e347e.png)list-buckets — AWS CLI 1.22.80 Command Reference](https://docs.aws.amazon.com/cli/latest/reference/s3api/list-buckets.html)  [https://aws.amazon.com/blogs/storage/replicating-existing-objects-between-s3-buckets/](https://aws.amazon.com/blogs/storage/replicating-existing-objects-between-s3-buckets/ "https://aws.amazon.com/blogs/storage/replicating-existing-objects-between-s3-buckets/") ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.