Versioning keeps earlier versions of an object so you can recover from an overwrite or delete. Object Lock goes further: it blocks deletion or overwrite of a version until a retention date passes. Object Lock needs versioning turned on, and the two work best together.
What each feature does
Versioning retains each version of an object. A simple delete adds a delete marker on top, and the older versions stay. Anyone with permission to delete a specific version can still remove it.
Object Lock uses a write once, read many model. AWS documents that it works only in buckets with versioning enabled and protects the specific version you lock. It does not stop new versions or delete markers from being added.
Retention modes
| Mode | Who can remove the lock | Typical use |
|---|---|---|
| Governance | Users with the bypass permission | Protect from most users, keep an escape hatch |
| Compliance | Nobody, including the account root user | Strict retention you must not shorten |
| Legal hold | Anyone with the legal hold permission | Keep until explicitly released |
In compliance mode the retention mode cannot be changed and the period cannot be shortened. AWS says the only way to delete such an object early is to delete the associated account. Think hard before choosing it, and test with governance mode first. AWS suggests exactly that.
Steps to protect a backup bucket
- Enable versioning on the bucket that receives backups.
- Enable Object Lock and set a default retention period that covers your recovery window.
- Start in governance mode. Restrict the bypass permission to a small break glass role.
- Separate duties: the identity that writes backups should not be able to change retention.
- Test a delete as the backup writer and confirm it is denied.
- After a trial period, decide whether compliance mode suits any bucket, accepting that you cannot undo it.
Cautions
- A locked object still costs storage until retention ends. Set periods you can afford.
- A permanent delete of a locked version returns an access denied error, but a simple delete returns success and adds a marker. Teams are sometimes surprised by that.
- CISA's ransomware guide says to use immutable storage with caution, since it may not meet certain compliance criteria and misconfiguration can be costly. It also recommends enabling delete protection or object lock on storage that ransomware commonly targets.
- Lock protects the data in the bucket. It does not protect the keys, the account or the restore process.
Safeguard policies and gates can check infrastructure definitions in pull requests, which helps catch a backup bucket defined without versioning. There is a free scan to start with.
Quick check
Can I turn on Object Lock without versioning?
No. AWS documents that Object Lock works only in buckets with versioning enabled.
Does Object Lock stop ransomware from encrypting my files?
It stops locked versions from being deleted or overwritten. Attackers who write new versions can still do so, so keep the locked prior versions and restrict who can write.
Sources
Last reviewed: 19 October 2026.
