S3 bucket has Object Lock enabled

Check ID: s3_bucket_object_lock
Provider: AWS
Service: s3
Severity: LOW
Categories: resilience
Resource type: AwsS3Bucket

What this check verifies

Amazon S3 buckets have Object Lock enabled at the bucket level, applying WORM controls to object versions

Risk

Without Object Lock, object versions can be deleted or overwritten, undermining data integrity and availability. Threats include ransomware erasing backups, insider or mistaken deletions, and tampering that defeats recovery. Inability to enforce retention or legal holds increases exposure to data loss and compliance gaps.

Recommendation

Enable Object Lock for critical data and set appropriate default retention in GOVERNANCE or COMPLIANCE mode. Apply immutability and least privilege by restricting permissions that bypass retention, and use legal holds when you need indefinite protection for investigations or regulatory requirements.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws s3api put-object-lock-configuration --bucket <BUCKET_NAME> --object-lock-configuration '{"ObjectLockEnabled":"Enabled","Rule":{"DefaultRetention":{"Mode":"GOVERNANCE","Days":1}}}'

resource "aws_s3_bucket_object_lock_configuration" "<example_resource_name>" {
  bucket               = "<example_resource_name>"
  object_lock_enabled  = "Enabled"  # CRITICAL: Enables Object Lock configuration on the bucket
  rule {
    default_retention {
      mode = "GOVERNANCE"  # CRITICAL: Default retention mode
      days = 1              # CRITICAL: Minimal retention period
    }
  }
}

Resources:
  <example_resource_name>:
    Type: AWS::S3::Bucket
    Properties:
      ObjectLockEnabled: true  # CRITICAL: Enables Object Lock on the bucket at creation
      ObjectLockConfiguration:
        ObjectLockEnabled: Enabled  # CRITICAL: Turns on Object Lock configuration
        Rule:
          DefaultRetention:
            Mode: GOVERNANCE  # CRITICAL: Sets default retention mode
            Days: 1           # CRITICAL: Minimal retention to enable default lock

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = s3_bucket_object_lock. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

S3 bucket has MFA Delete enabled S3 bucket has object versioning enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires