DEV Community

Bala Paranj
Bala Paranj

Posted on

Do we need Object Lock for PHI? HIPAA S3 retention: Object Lock compliance mode is not optional

#hipaa #aws #s3 #security

✓ Human-authored analysis; AI used for formatting and proofreading.

The thread repeats on r/aws: a team stores Protected Health Information (PHI) in S3, has versioning enabled, and assumes that's sufficient for retention. Someone suggests Object Lock. The team pushes back. It's complex and they already have lifecycle policies.

The answer: Object Lock in Compliance mode is not optional for HIPAA PHI buckets.

What HIPAA Requires

HIPAA section 164.316(b)(2) mandates a 6-year retention period for documentation related to PHI. This is a regulatory requirement that auditors verify.

Versioning alone doesn't satisfy this. A versioned object can still be permanently deleted by removing all versions and delete markers. Lifecycle policies can expire versions. An IAM principal with s3:DeleteObject can remove data before the retention period expires.

Object Lock provides WORM (Write Once Read Many) protection. But the mode matters:

  • Governance mode: Users with s3:BypassGovernanceRetention permission can override the lock. This is a privileged bypass.
  • Compliance mode: No user, including the root account, can delete or modify protected objects during the retention period. This is the only mode that provides the tamper-proof guarantee HIPAA requires.

How Stave Detects It

Stave evaluates this through three controls that tier the severity:

Control What it checks Severity
CTL.S3.LOCK.001 Object Lock not enabled on compliance-tagged bucket MEDIUM
CTL.S3.LOCK.002 Object Lock uses GOVERNANCE mode instead of COMPLIANCE MEDIUM
CTL.S3.LOCK.003 Retention period shorter than 2190 days (6 years) MEDIUM

This creates a severity cascade. A PHI bucket without Object Lock fails CTL.S3.LOCK.001. A PHI bucket with Object Lock in Governance mode passes LOCK.001 but fails LOCK.002. A PHI bucket with Compliance mode but a 365-day retention period passes both but fails LOCK.003.

stave evaluate \
  --controls controls/s3/lock/ \
  --observations observations/ \
  --eval-time 2026-04-08T00:00:00Z
Enter fullscreen mode Exit fullscreen mode

Output showing the tiered findings:

Security State: NON_COMPLIANT

Findings:
  phi-data-bucket:
    CTL.S3.LOCK.001  UNSAFE  Object Lock not enabled
      Compliance-tagged bucket does not have S3 Object Lock enabled.
      Objects can be deleted or overwritten without WORM protection.

  phi-archive-bucket:
    CTL.S3.LOCK.002  UNSAFE  GOVERNANCE mode instead of COMPLIANCE
      PHI bucket with Object Lock is using GOVERNANCE mode instead of
      COMPLIANCE mode. Users with special permissions can override retention.

  phi-logs-bucket:
    CTL.S3.LOCK.003  UNSAFE  Retention period 365 days < 2190 days required
      PHI bucket Object Lock retention period is shorter than the HIPAA
      minimum of 6 years (2190 days).
Enter fullscreen mode Exit fullscreen mode

HIPAA PHI retention is not "enable versioning and hope for the best." It's a specific requirement: 6 years, tamper-proof, no privileged override. Object Lock in Compliance mode with a 2190-day minimum retention period is the only S3 configuration that satisfies all three conditions. Stave detects each gap independently, so you know where your buckets fall on the compliance spectrum.

Top comments (0)