Description
Ensure Object Storage buckets used to store backups are created with Object Lock enabled and a default retention rule, so backup objects cannot be deleted or overwritten during the retention period (WORM: write once, read many).
Rationale
Ransomware and attackers often delete or encrypt backups first, so that victims cannot recover. Object Lock makes backup objects immutable for a set period, protecting them even from users with delete rights. Object Lock can only be enabled when a bucket is created.
Impact
Backups cannot be deleted or changed during retention
Protects backups from ransomware
Object Lock can only be set at bucket creation and requires versioning
Default Value
By default, Object Lock is not enabled. It must be chosen when the bucket is created and cannot be added later.
Pre-Requisites
Permission to manage Object Storage in the Public Cloud project
A defined retention period and mode (Governance or Compliance)
Test Plan
Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.
In the left-hand menu, select Public Cloud and choose your project.
In the left-hand menu, select Object Storage.
Select the backup bucket and check whether Object Lock is enabled.
Alternatively, run: aws s3api get-object-lock-configuration --bucket <bucket_name>
If Object Lock is not enabled, follow the implementation steps.
Implementation Steps
Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.
In the left-hand menu, select Public Cloud and choose your project.
In the left-hand menu, select Object Storage.
Click Create object container and, in the dedicated step, enable Object Lock and set the default retention.
Point your backup tool to the new bucket and confirm that backups are written.
Delete the old bucket once its backups are no longer needed.
Backout Plan
Point the backup tool back to the previous bucket. Objects in the locked bucket stay protected until their retention ends.
Reference