Secure Objects in an S3 Bucket

S3 offers multiple ways to secure objects in the bucket by either restricting objects in the bucket or applying a standardized security pattern on all of the objects. Let’s dive to learn multiple ways we can protect objects stored in our bucket.

S3 Object Locks

S3 Object Locks prevent overwriting or deletion of an object. It is based on the WORM (write-one-read-many) model. Object Locks only work on versioning-enabled S3 buckets. We can lock a specific object version, which associates the lock information with the metadata of the version.

Object Lock provides two ways to manage the retention: retention period and legal holds.

Retention period

We lock the object for a specified amount of time. We can set up a unique or default object retention period on a bucket. Furthermore, we can set up maximum and minimum allowed retention periods using the s3:object-lock-remaining-retention-days condition key in the bucket policy. This ensures that users can only specify retention periods that fall within a predefined range, enforcing data retention policies and preventing users from setting overly restrictive or insufficient retention periods.

This mode offers two ways to lock an object:

• Compliance: When an object is locked in compliance mode, it can not be overwritten or deleted even the root user. Also, we can not shorten the retention period or modify the retention mode.

• Governance: When an object is locked in governance mode, it can only be overwritten or modified by users with special permissions.

Tip: Testing out Object Locks in governance mode is a good practice before locking objects in compliance mode.

Legal hold

We lock the object for an indefinite amount of time. It remains in action until we explicitly remove it. Legal holds are independent of retention periods. For example, consider an object with a retention period and legal hold. If the retention period expires before removing the legal hold, the object will remain protected. Similarly, if the legal hold is removed before the retention period expires, the object can not be overwritten or deleted.