The Problem: Deletion Is Not Always Accidental
Ransomware attacks increasingly target cloud backups. An attacker who gains access to your AWS account can delete your S3 backups before encrypting your production systems, leaving you with no recovery option. Similarly, a disgruntled employee with admin access could delete critical records. And in regulated industries, auditors require proof that records were not tampered with.
Write Once, Read Many (WORM) is the solution. Object Lock makes objects immutable for a defined period — they cannot be deleted or overwritten, regardless of who tries.
Critical prerequisite: Object Lock must be enabled when the bucket is created. It cannot be enabled on an existing bucket. Versioning is automatically enabled when Object Lock is turned on.
Retention Modes
Governance Mode:
* Most IAM users cannot delete or overwrite the object during the retention period.
* Users with the specific IAM permission s3:BypassGovernanceRetention can override the lock.
* Use case: Protecting against accidental deletion while allowing authorized administrators to intervene if a mistake is made (e.g., a file was locked with the wrong retention date).
Compliance Mode:
* No one can delete or overwrite the object — not even the AWS root account.
* The retention period cannot be shortened after it is set.
* Use case: SEC Rule 17a-4, FINRA, HIPAA, and other regulations that require tamper-proof records. This is the mode you use when an auditor needs a guarantee, not just a policy.
Legal Hold
A Legal Hold is a separate, simpler mechanism. It is a binary switch (on/off) that you can apply to any object version. While the Legal Hold is active, the object cannot be deleted. Unlike a retention period, it has no expiration date — it stays active until you explicitly remove it.
Use case: A lawsuit is filed. You immediately apply a Legal Hold to all relevant records. The hold stays in place until the legal team says the case is closed, regardless of how long that takes. This is independent of any Lifecycle Policy expiration rules — a Legal Hold overrides them.
A common interview scenario: "Your company needs to store financial records that cannot be deleted for 7 years, even by the root account. How do you implement this?" The answer is S3 Object Lock in Compliance Mode with a 7-year retention period. Governance Mode is wrong here because it can be bypassed. A bucket policy alone is wrong because it can be modified by an admin. Compliance Mode is the only mechanism that is truly immutable.