Get started
Yandex Object Storage

Object locks

Written by

Using object locks in versioned buckets lets you prevent an object version from being deleted or overwritten. Object locks ensure version storage based on the WORM (write once, read many) technology, while you can still upload new object versions.

To be able to put locks on object versions in your bucket:

  1. Contact support and request the object lock feature for your cloud. You only need to do it once per cloud.
  2. Enable locks in your bucket settings by following the instructions.

When you enable locks, this doesn't put locks on previously uploaded object versions (you only get an option to put locks). If you disable object lock, this doesn't disable the locks that were put previously. Such locks are still in effect, and you can't remove or change them.

There are different types of object locks depending on their retention period and severity.

You can enable object locks for specific object versions (when or after uploading them) or set default object locks for all new versions uploaded to a bucket.

Object lock types

Two types of object locks are set for a certain period until the date and time you specify:

Object locks with governance-mode retention
Users with permission to upload objects (the storage.uploader role) can set a lock.
Users who are Object Storage administrators (the storage.admin role) can bypass a lock (delete or overwrite an object version), change its retention period, or remove it. The user should explicitly confirm these actions, for example, when sending a request via the Amazon S3-compatible REST API with the X-Amz-Bypass-Governance-Retention: true header.
Object locks with compliance-mode retention
Users with permission to upload objects (the storage.uploader role) can set a lock.
Users who are Object Storage administrators (the storage.admin role) can only extend a lock's retention period.
This lock can't be bypassed, shortened, or removed until it expires.

There is one more type of object lock that is set indefinitely:

Legal hold
Users with permission to upload objects (the storage.uploader role) can set and remove a lock.
This lock can't be bypassed.

Object locks set for a certain amount of time and those set indefinitely are managed independently. You can concurrently lock an object version using one lock with a retention period and one legal hold. If applied together, a legal hold takes priority: an object version can't be deleted or overwritten even if a lock with a retention period allows some users to do that.

Table of roles and actions

Type of object lock ⏳ Governance
 ⏳ Compliance
 ♾ Legal hold
Who can...
...set a lock storage.uploader storage.uploader storage.uploader
...delete or overwrite an object version storage.admin No one No one
...shorten a lock's retention period storage.admin No one —
...extend a lock's retention period storage.admin storage.admin —
...remove a lock set for a certain period and place a new one storage.admin No one —
...remove a lock storage.admin No one storage.uploader

Default object locks

You can set default object locks for a bucket: they will apply to all new object versions uploaded to it.

Specify the following for the default object locks:

  • Type: Governance-mode or compliance-mode retention.
  • Retention period in days or years after an object version is uploaded. The retain until date and time are defined for each version automatically.

If you set up the default object locks for your bucket, an MD5 hash needs to be calculated for each uploaded object version and encoded with Base64. The resulting value should be specified in a request. For example, if you send requests using the REST API, specify it in the Content-MD5 header.

Even if the bucket has the default object locks configured, you can change the settings of a lock with a retention period when or after uploading a specific object version and the new settings will take priority. In this case, you can't upload a version without a lock set for a certain period or remove it.

Changes to the default lock settings don't affect the object versions already uploaded to the bucket.

How to configure object locks

See the instructions:

In this article: