1 — Object Lock Modes
Amazon S3 Object Lock supports two modes:
| Mode | Purpose |
|---|---|
| Governance Mode | Protects objects from being deleted or overwritten by most users. Users with special permissions (s3:BypassGovernanceRetention) can still modify or delete objects. Useful when you want flexibility but still enforce retention rules. |
| Compliance Mode | Provides stricter protection. No one, including the root account, can overwrite or delete an object until the retention period expires. This mode is for strict compliance requirements (e.g., SEC Rule 17a-4(f), FINRA). |
✅ So Compliance Mode is the strictest mode.
2 — Retention Mode vs. Legal Hold
These are two separate mechanisms within Object Lock:
Retention Mode
- Applies a time-based retention period to an object.
- Prevents deletion or modification until the retention period expires.
-
Can be set in:
- Governance mode
- Compliance mode
Example: Retain a file for 5 years.
Legal Hold
- Overrides retention periods and prevents deletion regardless of retention period settings.
- Remains in effect until explicitly removed.
- Used when there is a legal requirement to preserve data (e.g., court order, legal investigation).
- Not tied to a time period.
Example: Legal hold stays active until removed, even if retention period expires.
3 — Summary Table
| Protection Type | Mode(s) Allowed | Can be overridden? |
|---|---|---|
| Retention Mode | Governance / Compliance | Governance: Yes Compliance: No |
| Legal Hold | Both | No |
So in total there are:
- 2 Object Lock modes: Governance, Compliance.
- 2 protection types: Retention Mode, Legal Hold.
💡 Quick tip: If your company says "No users can modify or delete any files" — that is Compliance mode with a retention period.
| Feature | Question wording clue |
|---|---|
| Compliance Mode | “No one, including root account, can delete or modify objects until retention period expires” — emphasizes time-based, strict retention. |
| Legal Hold | “Objects cannot be deleted or modified until legal hold is removed” — emphasizes indefinite retention until explicit removal, not tied to a time period. |
Top comments (1)
Object Lock's two modes trip up almost everyone setting up compliance storage. Practical cheat sheet:
Governance mode — users with s3:BypassGovernanceRetention can delete objects early. Good for production backups where you want ops to fix mistakes (deleted last week's archive by accident). Default for most teams.
Compliance mode — no one can delete until the retention period expires, including root. This is what regulators actually want. Watch out: you cannot shorten the retention period once set, and you cannot delete the bucket while objects are locked.
Legal hold — independent of retention period. s3:PutObjectLegalHold puts it on, s3:DeleteObjectLegalHold takes it off. Use this when you don't know how long you need to keep data.
Retention period defaults — 1 day minimum for both modes. Most teams set 7 years for financial records. Be aware that once the period starts ticking, you cannot reduce it. Test your policy in a non-prod bucket first.
Object Lock requires versioning — bucket must have versioning enabled first, and the lock config must be set at bucket creation. You cannot add Object Lock to an existing non-empty bucket.
For ops who want to browse Object Lock buckets from Windows like local drives: ScsDriver