Description

Ensure that every Amazon S3 bucket has S3 Object Lock enabled. Object Lock stores object versions using a write-once-read-many (WORM) model, so that locked object versions cannot be deleted or overwritten for a set retention period or while a legal hold is in place.

Rationale

Without Object Lock, object versions can be deleted or overwritten, which affects data integrity and availability. Ransomware, insider actions or mistakes can erase backups and other critical data and prevent recovery, and retention or legal hold requirements cannot be enforced. Object Lock should be enabled for critical data with a suitable default retention period in governance or compliance mode, and permissions that bypass retention should be tightly restricted.

Impact

  • Protects object versions from deletion and overwriting during the retention period

  • Object Lock cannot be disabled once enabled, and versioning cannot be suspended on the bucket

  • A default retention period prevents deletion of new object versions until it expires, which increases storage costs and may affect lifecycle rules and applications that delete or overwrite objects

Default Value

Object Lock is disabled by default on new and existing S3 buckets.

Pre-Requisites

  • IAM permissions: s3:ListAllMyBuckets, s3:GetBucketObjectLockConfiguration, s3:PutBucketObjectLockConfiguration, s3:GetBucketVersioning and s3:PutBucketVersioning

  • Agreement on the retention mode (governance or compliance) and retention period, if a default retention is required

  • Confirmation that the bucket's data and applications are suited to permanent versioning and WORM protection

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon S3 console and select a bucket.

  3. Open the Properties tab and find the Object Lock section.

  4. Check that Object Lock is Enabled.

  5. Repeat for each bucket.

  6. If Object Lock is disabled for any bucket, follow the implementation steps.

CLI:

Show the Object Lock configuration of a bucket:

aws s3api get-object-lock-configuration --bucket <BUCKET_NAME>

A bucket fails if the command returns an ObjectLockConfigurationNotFoundError error.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon S3 console and select the bucket.

  3. Open the Properties tab and confirm that Bucket Versioning is Enabled; if not, choose Edit, select Enable and save.

  4. In the Object Lock section, choose Edit.

  5. Select Enable, and acknowledge that Object Lock is permanent for this bucket.

  6. Optionally, enable Default retention and set the Default retention mode (for example, Governance) and the retention period.

  7. Choose Save changes.

  8. Repeat for each affected bucket.

CLI:

Enable versioning on the bucket (required for Object Lock):

aws s3api put-bucket-versioning --bucket <BUCKET_NAME> --versioning-configuration Status=Enabled

Enable Object Lock with a default retention of 1 day in governance mode (adjust the mode and days as required, or remove the Rule part to enable Object Lock without a default retention):

aws s3api put-object-lock-configuration --bucket <BUCKET_NAME> --object-lock-configuration '{"ObjectLockEnabled":"Enabled","Rule":{"DefaultRetention":{"Mode":"GOVERNANCE","Days":1}}}'

Backout Plan

Object Lock cannot be disabled after it is enabled. Only the default retention can be removed or changed:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon S3 console and select the bucket.

  3. Open the Properties tab and, in the Object Lock section, choose Edit.

  4. Disable Default retention or change the retention period.

  5. Choose Save changes.

CLI:

aws s3api put-object-lock-configuration --bucket <BUCKET_NAME> --object-lock-configuration '{"ObjectLockEnabled":"Enabled"}'

Note: object versions already locked keep their retention settings. Versions locked in compliance mode cannot be deleted by any user until their retention period ends.

Reference