Skip to main content

📝 AWS S3 Bucket Object Lock is not enabled 🟠🟢

  • Contextual name: 📝 Bucket Object Lock is not enabled 🟠🟢
  • ID: /ce/ca/aws/s3/bucket-object-lock
  • Located in: 📁 AWS S3

Flags​

Our Metadata​

  • Policy Type: BEST_PRACTICE
  • Policy Category:
    • SECURITY
    • RELIABILITY

Similar Policies​

Similar Internal Rules​

RulePoliciesFlags
✉️ dec-x-b443805a3

Logic​

Internal Notes 🟠​

Open File

Internal notes​

This is a best practice since there are cases when object lock shouldn't be enabled.

When Not to Use S3 Object Lock​

  • Dynamic Data: When your data requires frequent updates, modifications, or deletions, implementing S3 Object Lock may hinder operational agility and flexibility.
  • Temporary Data: When dealing with transient or temporary data that doesn't require long-term retention or immutability, using S3 Object Lock may add unnecessary complexity and overhead.
  • High Frequency Write Workloads: When your application necessitates high throughput or frequent write operations to S3 objects, S3 Object Lock may introduce performance limitations due to its immutable nature.
  • Cost Considerations: When evaluating the cost implications, as enabling S3 Object Lock may incur additional charges for compliance features that might not be necessary for all types of data.

In summary, S3 Object Lock is best suited for scenarios where data integrity, immutability, and compliance are important. However, for dynamic or temporary data that requires frequent updates or doesn't have strict retention requirements, implementing S3 Object Lock may not be necessary and could potentially introduce operational complexities and additional costs.

Description​

Open File

Description​

Object Lock feature helps you ensure that your data remains unaltered and immutable for a specified retention period or indefinitely. It uses a write-once-read-many (WORM) model to store objects. You can use Object Lock to help meet regulatory requirements that require WORM storage, or to add another layer of protection against object changes or deletion.

Rational​

Best practices for using S3 Object Lock​
  • Consider using Governance mode if you want to protect objects from being deleted by most users during a pre-defined retention period, but at the same time want some users with special permissions to have the flexibility to alter the retention settings or delete the objects.
  • Consider using Compliance mode if you never want any user, including the root user in your AWS account, to be able to delete the objects during a pre-defined retention period.
  • You can use Legal Hold when you are not sure for how long you want your objects to stay immutable. This could be because you have an upcoming external audit of your data and want to keep objects immutable till the audit is complete. Alternatively, you may have an ongoing project utilizing a dataset that you want to keep immutable until the project is complete.

... see more

Remediation​

Open File

Enable S3 Object Lock via AWS CLI​

Before you lock any objects, you must enable S3 Versioning and Object Lock on a bucket. Afterward, you can set a retention period, a legal hold, or both.

Important Notes​

  • After you enable Object Lock on a bucket, you can't disable Object Lock or suspend versioning for that bucket.
  • S3 buckets with Object Lock can't be used as destination buckets for server access logs.

Topics​

  1. Enable Object Lock when creating a new S3 bucket

  2. Enable Object Lock on an existing S3 bucket

  3. Set or modify a legal hold on an S3 object

  4. Set or modify a retention period on an S3 object

Enable Object Lock when creating a new S3 bucket​

From Command Line​
aws s3api create-bucket --bucket {{your-bucket-name}} --object-lock-enabled-for-bucket

Replace {{your-bucket-name}} with a desired bucket name. The command activates versioning automatically.

... see more

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlags
💼 Cloudaware Framework → 💼 Data Protection and Recovery10
💼 Cloudaware Framework → 💼 System Configuration24
💼 FedRAMP High Security Controls → 💼 AC-3 Access Enforcement (L)(M)(H)3747
💼 FedRAMP Low Security Controls → 💼 AC-3 Access Enforcement (L)(M)(H)47
💼 FedRAMP Moderate Security Controls → 💼 AC-3 Access Enforcement (L)(M)(H)47
💼 NIST CSF v2.0 → 💼 PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties58
💼 NIST CSF v2.0 → 💼 PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected67
💼 NIST CSF v2.0 → 💼 PR.IR-01: Networks and environments are protected from unauthorized logical access and usage40
💼 NIST SP 800-53 Revision 5 → 💼 AC-3 Access Enforcement15417