Skip to main content

Object Lock: Legal Hold & Retention

Object Lock makes object versions immutable (WORM – Write Once, Read Many): they cannot be overwritten or deleted whilst protection is active. This protects backups from ransomware and helps to meet retention requirements.

Basics​

  • Object Lock can only be enabled when creating a bucket and requires versioning (which is automatically enabled as well).
  • The maximum configurable retention period may be limited by centron at platform level.
  • Object Lock may affect the contract term: even in the event of early contract termination, protected data remains stored and is subject to billing until the end of the Object Lock period. centron is technically unable to delete protected data before the end of the set period.
  • Protection always applies to individual object versions.
  • Two mechanisms, which can be combined:
Legal HoldRetention
Durationindefinite, until manually deleteduntil a fixed date (RetainUntilDate)
Revocableat any time by authorised personsGovernance: with special authorisation; Compliance: never
Typical useongoing proceedings, investigationsbackup protection, statutory time limits

Retention modes​

  • Governance: Protection may be lifted early, provided that the s3:BypassGovernanceRetention authorisation (header x-amz-bypass-governance-retention) is available in the account. A good standard for backups. Please note: Contractually, an Object Lock that has been set cannot be deactivated or removed during the defined retention period.
  • Compliance: Protection cannot be shortened or removed by anyone – not even the account holder – until the specified date has been reached. Only use this feature if the consequences are clear: the data will inevitably incur storage costs until the expiry date.

Create a bucket with Object Lock​

aws s3api create-bucket --bucket sicherer-bucket \
  --object-lock-enabled-for-bucket \
  --endpoint-url https://s3.internet1.de

Default retention period for new objects (optional)​

All newly uploaded items are automatically granted, for example, 30 days’ governance protection:

aws s3api put-object-lock-configuration --bucket sicherer-bucket \
  --object-lock-configuration '{
    "ObjectLockEnabled": "Enabled",
    "Rule": {"DefaultRetention": {"Mode": "GOVERNANCE", "Days": 30}}
  }' \
  --endpoint-url https://s3.internet1.de
# Setzen
aws s3api put-object-legal-hold --bucket sicherer-bucket \
  --key vertraege/fall-4711.pdf \
  --legal-hold Status=ON \
  --endpoint-url https://s3.internet1.de

# Status prüfen
aws s3api get-object-legal-hold --bucket sicherer-bucket \
  --key vertraege/fall-4711.pdf \
  --endpoint-url https://s3.internet1.de

# Entfernen
aws s3api put-object-legal-hold --bucket sicherer-bucket \
  --key vertraege/fall-4711.pdf \
  --legal-hold Status=OFF \
  --endpoint-url https://s3.internet1.de

Set retention to a specific object version​

# Governance-Retention bis zu einem festen Datum
aws s3api put-object-retention --bucket sicherer-bucket \
  --key backups/2026-07-28.tar.gz \
  --retention '{"Mode":"GOVERNANCE","RetainUntilDate":"2026-08-28T00:00:00Z"}' \
  --endpoint-url https://s3.internet1.de

# Prüfen
aws s3api get-object-retention --bucket sicherer-bucket \
  --key backups/2026-07-28.tar.gz \
  --endpoint-url https://s3.internet1.de

You can extend the validity at any time (set a new, later date). Shortening is only possible in Governance mode with bypass rights:

aws s3api put-object-retention --bucket sicherer-bucket \
  --key backups/2026-07-28.tar.gz \
  --retention '{"Mode":"GOVERNANCE","RetainUntilDate":"2026-07-30T00:00:00Z"}' \
  --bypass-governance-retention \
  --endpoint-url https://s3.internet1.de

Behaviour of protected objects​

  • A DELETE without a VersionId only creates a delete marker – the protected version remains intact and can be restored.
  • Deleting the protected version itself using Access Denied will fail until the retention period has expired and no legal hold is active.
  • A bucket can only be deleted once there are no longer any protected versions.

Recommendations​

  • For backup purposes, select Governance mode with a runtime that matches the backup rotation (e.g. retention ≥ the backup software’s retention period).
  • Only use Compliance Mode after careful consideration – carry out test runs first with short retention periods.
  • Combine with Lifecycle Policies: automatically remove expired versions as soon as protection ends.
Last updated on