Demo S3 Object Lock

Learn how to enable and enforce Object Lock on Amazon S3 buckets, apply governance and compliance retention modes, and verify access restrictions using IAM policies.

Table of Contents

1. What You’ll Learn
2. 1. Create an S3 Bucket with Object Lock
3. 2. Upload an Object
4. 3. Configure Object Lock Retention
5. 4. Test Deletion with a Restricted IAM User
6. 5. Delete with an Admin User
7. 6. Demonstrate Object Legal Hold
8. 7. Deny Legal Hold Removal
9. Summary
10. References

What You’ll Learn

• How to enable Object Lock on an S3 bucket
• The difference between Governance and Compliance retention modes
• Applying and testing IAM policies that enforce or bypass retention settings
• Using Object Legal Hold for indefinite protection

1. Create an S3 Bucket with Object Lock

1. In the AWS S3 console, click Create bucket.
2. Under Advanced settings, check Enable Object Lock.

2. Upload an Object

Upload a test file, for example file1.txt, to your new bucket:

1. Click Upload.
2. Select file1.txt.
3. Confirm and upload.

After upload, open the object’s Properties to configure Object Lock.

3. Configure Object Lock Retention

In the object’s Object Lock section you can choose:

• Legal Hold: Indefinite hold without a retention date.
• Retention Mode: Specify Governance or Compliance mode and a retention date.

1. Select Governance mode.
2. Set the retention date (e.g., tomorrow).
3. Click Save.

4. Test Deletion with a Restricted IAM User

Switch to User Two, who has a policy denying s3:BypassGovernanceRetention. They have full S3 access but cannot bypass governance locks:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyBypassGovernanceRetention",
      "Effect": "Deny",
      "Action": "s3:BypassGovernanceRetention",
      "Resource": "*"
    }
  ]
}

When User Two tries to delete the locked object version, the request fails:

User Two also cannot modify retention settings.

5. Delete with an Admin User

Switch back to User One (Administrator) with full permissions, including s3:BypassGovernanceRetention:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "*",
      "Resource": "*"
    }
  ]
}

User One can now permanently delete the locked object version.

6. Demonstrate Object Legal Hold

1. Upload a second file, e.g., file2.txt.
2. Open its Properties and scroll to Object Lock.
3. Enable Legal Hold, then Save.

The object is now held indefinitely under Legal Hold.

7. Deny Legal Hold Removal

Update User Two’s policy to also deny s3:PutObjectLegalHold, preventing removal of legal holds:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyLegalHoldAndBypass",
      "Effect": "Deny",
      "Action": [
        "s3:PutObjectLegalHold",
        "s3:BypassGovernanceRetention"
      ],
      "Resource": "*"
    }
  ]
}

Now, when User Two tries to disable the legal hold, they see a permission error:

Only users with the correct permissions (e.g., User One) can remove a legal hold.

Summary

In this lesson, you’ve learned to:

• Enable Object Lock on an S3 bucket
• Apply Governance and Compliance retention modes
• Test deletion restrictions with IAM policies
• Use Object Legal Hold for indefinite protection

References

• AWS S3 Object Lock Documentation
• IAM JSON Policy Reference
• Amazon S3 Versioning