Description

Ensure that Amazon S3 buckets storing data subject to retention or immutability requirements have S3 Object Lock enabled, in either Governance or Compliance mode, preventing objects from being deleted or overwritten for a defined retention period, or indefinitely if a legal hold is applied.

Rationale

Without Object Lock, objects in an S3 bucket can be deleted or overwritten by any principal with sufficient IAM permissions, which may violate regulatory requirements for data immutability (for example, financial records subject to SEC Rule 17a-4) or leave backup and audit data vulnerable to deletion by a compromised credential or malicious insider, including ransomware-style attacks that attempt to delete backups. Enabling Object Lock, particularly in Compliance mode, provides an enforceable, write-once-read-many (WORM) guarantee that even the root user cannot override before the retention period expires.

Impact

  • Guarantees that locked objects cannot be deleted or overwritten before the configured retention period elapses, even by the account root user (in Compliance mode)

  • Supports regulatory and compliance requirements mandating immutable data retention

  • Object Lock can only be enabled at bucket creation time and cannot be added to an existing bucket; Compliance mode retention cannot be shortened or removed once applied

Default Value

Object Lock is disabled by default and must be explicitly enabled at bucket creation time; it cannot be enabled on an existing bucket afterward.

Pre-Requisites

  • A documented, approved retention period and mode (Governance or Compliance) based on regulatory or business requirements

  • Versioning enabled on the bucket, since Object Lock requires it

  • IAM permissions to create buckets with Object Lock enabled (s3:CreateBucket, s3:PutBucketObjectLockConfiguration)

Test Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon S3 > Buckets and select the bucket to review.

  3. Open the Properties tab.

  4. Review the Object Lock field.

  5. Verify that it shows as Enabled, and review the default retention mode and period configured under Object Lock default retention settings.

  6. If Object Lock is not enabled for a bucket that requires immutable retention, follow the implementation steps.

Implementation Steps

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon S3 > Buckets and select Create bucket.

  3. Because Object Lock cannot be enabled on an existing bucket, create a new bucket and, under Advanced settings, enable Object Lock (this automatically enables versioning).

  4. Complete bucket creation, then configure the default retention mode (Governance or Compliance) and retention period under the bucket's Properties > Object Lock default retention.

  5. Migrate data into the new, Object Lock-enabled bucket (for example, via S3 Batch Operations or a copy job), applying the appropriate retention settings to each object as needed.

  6. Update application configuration to write to the new bucket, and decommission the old bucket once the migration is verified and any regulatory retention requirements for the old bucket's data are otherwise satisfied.

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon S3 > Buckets and create a new bucket without Object Lock enabled, if reverting is required.

  3. Migrate data (that is not still under an active retention period) to the new bucket, update application configuration, and decommission the Object Lock bucket once all objects are no longer subject to enforced retention.

Reference