Skip to content

S3 Object Lock (Immutability)

Object Lock makes an object impossible to delete or overwrite until a retention date you set has passed. It is the standard S3 mechanism for write-once storage, and it is available on Euronodes S3 today.

What we support

GOVERNANCE mode, with per-object retention dates and bucket-level default retention. Versioning is enabled automatically, it is a requirement of Object Lock.

Object Lock works with your existing Euronodes S3 credentials and the standard endpoint https://eu-west-1.euronodes.com. No account change and no ticket is needed, you can set it up yourself.

The one thing to get right first

Object Lock can only be enabled when a bucket is CREATED

There is no way to turn it on for a bucket that already exists. This is an S3 rule, not a Euronodes limitation.

If you want immutability for data that is already stored, you must create a new bucket with Object Lock enabled and copy your objects into it. Copying is not charged, you pay only for what is stored.

Create a bucket with Object Lock

aws --endpoint-url https://eu-west-1.euronodes.com s3api create-bucket \
    --bucket my-immutable-bucket \
    --object-lock-enabled-for-bucket

Confirm it took effect:

aws --endpoint-url https://eu-west-1.euronodes.com s3api get-object-lock-configuration \
    --bucket my-immutable-bucket

{
    "ObjectLockConfiguration": {
        "ObjectLockEnabled": "Enabled"
    }
}

Protect an object

Retention is set per object version. Upload first, then apply the retention date:

aws --endpoint-url https://eu-west-1.euronodes.com s3api put-object-retention \
    --bucket my-immutable-bucket \
    --key backup-2026-08-06.tar.gz \
    --retention '{"Mode":"GOVERNANCE","RetainUntilDate":"2027-01-01T00:00:00Z"}'

Until 2027-01-01, that object cannot be deleted:

An error occurred (AccessDenied) when calling the DeleteObject operation:
forbidden by object lock

Protect everything automatically

Rather than setting retention on each object, set a default on the bucket. Every object uploaded afterwards inherits it:

aws --endpoint-url https://eu-west-1.euronodes.com s3api put-object-lock-configuration \
    --bucket my-immutable-bucket \
    --object-lock-configuration '{
        "ObjectLockEnabled": "Enabled",
        "Rule": {"DefaultRetention": {"Mode": "GOVERNANCE", "Days": 30}}
    }'

This is the usual setup for backups: point your backup tool at the bucket and every backup it writes is automatically protected for 30 days.

What this protects you against, and what it does not

Read this section before you rely on Object Lock for anything important.

GOVERNANCE mode protects you against

  • An accidental aws s3 rm --recursive against the wrong bucket
  • A backup or sync script that misbehaves and deletes its own history
  • A user or application deleting data it should not have touched
  • Silent overwrites, since every version is kept

GOVERNANCE mode does NOT protect you against a stolen access key

The credentials that own a bucket are allowed to override GOVERNANCE retention by passing an explicit bypass flag. That is how the mode is defined in S3.

So if somebody obtains your S3 access key and secret, they can bypass the retention and delete your objects. Object Lock in GOVERNANCE mode is protection against mistakes, not against an attacker who already holds your keys.

If your requirement is protection from compromised credentials, or a regulatory retention that nobody at all may override, open a ticket and tell us which standard you need to meet. That needs a different arrangement than a self-service bucket and we will set it up with you.

Costs

Locked data cannot be deleted, including by you

Object Lock has no separate fee, storage is the usual 3.99 EUR per TB per month. But two things follow from immutability that are worth planning for:

  • Versioning is on, so every overwrite keeps the previous version and both count toward stored data. A daily backup that overwrites the same key will accumulate.
  • A locked object occupies paid storage until its retention date passes. You cannot delete it early to reduce your bill. Choose retention periods you are willing to pay for.

If you only need the lock on current data and want old versions cleaned up automatically, open a ticket and we will help you set that up for your bucket.

Migrating an existing bucket

# 1. new bucket, Object Lock on
aws --endpoint-url https://eu-west-1.euronodes.com s3api create-bucket \
    --bucket my-bucket-locked --object-lock-enabled-for-bucket

# 2. set the default retention you want
aws --endpoint-url https://eu-west-1.euronodes.com s3api put-object-lock-configuration \
    --bucket my-bucket-locked \
    --object-lock-configuration '{"ObjectLockEnabled":"Enabled",
        "Rule":{"DefaultRetention":{"Mode":"GOVERNANCE","Days":30}}}'

# 3. copy the data across
aws --endpoint-url https://eu-west-1.euronodes.com s3 sync \
    s3://my-bucket/ s3://my-bucket-locked/

# 4. verify, then remove the old bucket when you are satisfied
aws --endpoint-url https://eu-west-1.euronodes.com s3 ls s3://my-bucket-locked/ --recursive --summarize

Verify before you delete anything

Compare object counts and sizes between the two buckets, and confirm the lock is applied to newly copied objects with get-object-retention, before removing the original.

Client configuration

Object Lock uses your normal Euronodes S3 settings. Both the signature versions described in S3 Configuration work with it, so nothing in your existing setup needs to change.

Note that Object Lock is an S3 API feature and not every desktop client or backup tool exposes it. If your tool cannot set retention, use the AWS CLI to apply a bucket default retention as shown above, and the tool's uploads will inherit the lock without needing to know about it.