Turn on versioning for any artifact bucket, because it lets you recover from overwrites and accidental deletes. Add Object Lock when released builds must not be changed or deleted for a set period, such as signed release binaries. Object Lock requires versioning, so you cannot have one without the other.
What each feature does
Versioning keeps multiple variants of an object in one bucket. AWS says an overwrite results in a new version and a delete inserts a delete marker instead of removing the object, so you can restore the previous version. Versioning is off by default, and once enabled a bucket can never return to unversioned. You can only suspend it.
Object Lock adds a write once, read many model. It prevents object versions from being deleted or overwritten for a fixed time or indefinitely. AWS states Object Lock works only in buckets that have versioning enabled, and that a lock protects the specific version, not the object name. New versions can still be created and delete markers can still be added.
Comparing the options
| Need | Versioning only | Versioning plus Object Lock |
|---|---|---|
| Recover a build overwritten by mistake | Yes | Yes |
| Recover after a bad delete | Yes | Yes |
| Stop a compromised role from permanently deleting a release | No, if the role may delete versions | Yes, during retention |
| Prove a released file was not changed | Weak | Stronger |
| Free to change your mind later | Mostly | Retention can be hard to undo |
Governance or compliance mode
Object Lock has two retention modes. In compliance mode, no user can overwrite or delete a protected version, including the root user, and the mode and period cannot be shortened. AWS adds that the only way to delete such an object before its retention date is to delete the associated account. In governance mode, most users cannot delete or alter lock settings, but users with the special bypass permission can, and the console includes the bypass header by default.
For most engineering teams, governance mode on release artifacts is the safer starting point. It stops routine mistakes and routine attackers, while leaving a break glass path. Choose compliance mode only if a requirement needs it, because a wrong retention period cannot be walked back.
A legal hold is a third option that has no expiry and stays until removed. It is useful when you want to freeze a set of builds during an investigation.
Setup steps
- Create or choose a bucket that holds only release artifacts. Keep scratch build output in a different bucket.
- Enable versioning.
- Enable Object Lock and set a default retention, for example matching your support window. You can also limit allowed retention with a bucket policy condition.
- Give the CI role permission to write objects, and no permission to change retention or bypass governance.
- Add a lifecycle rule for noncurrent versions of scratch buckets. AWS notes that you pay for every stored version, since each version is the whole object.
- Test: overwrite a file, delete a version, and confirm both behave as you expect.
Cost and housekeeping
Each version is a full copy and is billed as such. Versioned buckets with no lifecycle rule grow forever. Keep temporary artifacts out of locked buckets, since a locked object cannot be removed until retention ends.
Quick check
Can I enable Object Lock without versioning?
No. AWS says Object Lock works only in buckets with versioning enabled.
Does Object Lock stop someone adding a new version with the same name?
No. It protects the specific locked version. New versions and delete markers can still be created.
Safeguard does not manage your cloud accounts. It scans your code and dependencies, applies pull request policies and gates, and automates compliance evidence. Free scan: gold.safeguard.sh/scan.
Sources
- Amazon S3 User Guide: Locking objects with Object Lock
- Amazon S3 User Guide: Retaining multiple versions of objects with S3 Versioning
Last reviewed: 19 October 2026.
