Vault Lock vs. S3 Object Lock
| Feature | Vault Lock (Glacier) | S3 Object Lock |
|---|
| Applies to | Entire Vault | Individual Objects |
| Compliance Enforcement | Vault-wide Policy | Per-object WORM settings |
| Retention Control | Time-based Policy | Retention periods per object |
| Modification After Locking | No changes allowed | Object retention settings can be extended |
2. Retention Modes
S3 Object Lock supports two modes:
| Mode | Description | Can Extend Retention? | Can Reduce Retention? | Can Delete Object? |
|---|
| Governance Mode | Protects objects, but AWS accounts with special permissions (s3:BypassGovernanceRetention) can override restrictions. | ✅ Yes | ✅ Yes (if permitted) | ✅ Yes (if permitted) |
| Compliance Mode | Fully enforces WORM – no one (even the root user) can delete or modify the object until retention expires. | ✅ Yes | ❌ No | ❌ No |
3. Key Differences: Retention Period vs. Legal Hold
| Feature | Retention Period | Legal Hold |
|---|
| Purpose | Automatically enforces protection for a fixed period | Manual, temporary hold on deletion |
| Duration | Set for days, months, or years | Indefinite (removed manually) |
| Can Be Modified? | ✅ Yes (only extended in Compliance Mode) | ✅ Yes (can be removed anytime) |
| Applies to | Individual objects | Individual objects |
S3 Object Lock vs. Glacier Vault Lock
| Feature | S3 Object Lock | Glacier Vault Lock |
|---|
| Scope | Individual objects | Entire vault |
| Compliance | SEC, FINRA, HIPAA, GDPR | SEC, FINRA, HIPAA |
| Retention Type | Retention Period & Legal Hold | Time-Based Policy |
| Can Modify After Lock? | Governance Mode: Yes (with permission)
Compliance Mode: No | No (Once locked, it’s permanent) |
| Deletion Protection | Object-level | Vault-level |
| Best for | Regular S3 objects needing WORM | Long-term archives in Glacier |
.
Key Differences: S3 Object Lock vs. Legal Hold
| Feature | S3 Object Lock | Legal Hold |
|---|
| Retention Type | Time-based (Fixed period) | Manual (On/Off toggle) |
| Modes | Governance & Compliance | No modes, just ON/OFF |
| Expiration | Expires automatically after the set period | Does not expire unless manually removed |
| Prevents Deletion? | Yes | Yes |
| Can be Overridden? | Governance Mode: Yes (if allowed), Compliance Mode: No | No (must be manually disabled) |
| Use Case | Regulatory retention, data immutability | Legal cases, temporary retention |