All checks
Medium
S3 general purpose buckets should have Object Lock enabled
Checks that the S3 general purpose bucket has Object Lock enabled. Object Lock stores objects write-once-read-many, so a locked object version cannot be overwritten or deleted until its retention ends, even by someone holding valid credentials.
- service
- S3
- severity
- Medium
- scope
- evaluated once per account
How to fix it
In the console
S3 → the bucket → Properties
With the AWS CLI
aws s3api put-object-lock-configuration --bucket <bucket-name> --object-lock-configuration '{"ObjectLockEnabled":"Enabled","Rule":{"DefaultRetention":{"Mode":"GOVERNANCE","Days":30}}}'With Terraform
resource "aws_s3_bucket_object_lock_configuration" "this" {
bucket = var.bucket_name
rule {
default_retention {
mode = "GOVERNANCE"
days = 30
}
}
}See which of your accounts this check is failing on.
Book a demo