{
  "slug": "object-lock",
  "term": "Object lock",
  "aliases": [
    "S3 Object Lock",
    "Object retention lock"
  ],
  "definition": "An object lock enforces retention restrictions on a specified object version through a retention policy or hold.",
  "note": "S3 requires versioning; enabling Object Lock and protecting a particular version are distinct configuration steps. [configure] Its retention API distinguishes GOVERNANCE and COMPLIANCE and includes event-hold settings for variable retention; do not assume every retention date was fixed at upload. [retentionapi]",
  "status": "shipping",
  "advantages": [
    {
      "text": "A protected version survives a new upload under the same key; protection is version-scoped.",
      "citationIds": [
        "lock"
      ]
    }
  ],
  "limitations": [
    {
      "text": "Governance bypass requires permission and an explicit request; it does not clear a legal hold.",
      "citationIds": [
        "manage"
      ]
    },
    {
      "text": "For S3 variable retention, an Inventory report reflects its generation time; query GetObjectRetention for current metadata instead of treating the report as live state.",
      "citationIds": [
        "manage"
      ]
    },
    {
      "text": "Neither retained bytes nor a lock label proves that encryption keys remain usable.",
      "citationIds": [
        "manage"
      ]
    }
  ],
  "related": [
    "object-versioning",
    "legal-hold",
    "immutability-storage",
    "worm-storage",
    "restore-test"
  ],
  "supersedes": [],
  "supersededBy": [],
  "firstSeen": null,
  "lastSeen": null,
  "updated": "2026-10-15",
  "citations": [
    {
      "id": "configure",
      "title": "Amazon S3: Configuring S3 Object Lock",
      "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-configure.html",
      "accessed": "2026-10-15"
    },
    {
      "id": "retentionapi",
      "title": "Amazon S3 API: PutObjectRetention",
      "url": "https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObjectRetention.html",
      "accessed": "2026-10-15"
    },
    {
      "id": "lock",
      "title": "Amazon S3: Locking objects with Object Lock",
      "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock.html",
      "accessed": "2026-10-15"
    },
    {
      "id": "manage",
      "title": "Amazon S3: Object Lock considerations",
      "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-managing.html",
      "accessed": "2026-10-15"
    },
    {
      "id": "hesela-backup-evidence",
      "title": "Hesela: Backup verification is not a restore test",
      "url": "https://hesela.com/analyses/backup-verification-is-not-a-restore-test/",
      "accessed": "2026-10-15"
    }
  ]
}