Why an archive needs a bucket-level retention audit
A historical society may receive high-resolution scans, donor releases, and preservation masters in an S3 bucket. Before a new intake begins, the storage administrator needs to know whether Object Lock default retention applies to incoming object versions. GetObjectLockConfiguration reads the bucket’s Object Lock configuration, including a default rule when one is present. It is a safer first step than modifying an unfamiliar bucket.
The setting is about storage retention, not copyright, authenticity, privacy consent, or which digital file is the authoritative artifact. A protected object can still contain an incorrect scan. Keep a separate catalog and rights register, and do not infer full preservation compliance from one successful API read.
Read the exact bucket, with an owner guard
Amazon’s API reference describes GET /?object-lock for a bucket. It supports the x-amz-expected-bucket-owner header, which causes the request to fail when the supplied owner account does not match. Use authorized, read-only credentials scoped to the correct bucket, and record the account and region in a restricted audit system rather than in public documentation.
The required IAM permission is s3:GetBucketObjectLockConfiguration. AWS documents that requesting Object Lock configuration on a bucket without Object Lock enabled can produce an error. An access-denied error, incorrect bucket identity, unsupported bucket type, and absent configuration must not be lumped together as “no retention.” The operation is not supported for directory buckets.
Interpret the default retention rule
The response may include ObjectLockEnabled and a Rule containing DefaultRetention. The default retention policy can use governance or compliance mode and a duration expressed as days or years. Do not assume a missing default rule means existing versions are not individually retained. Do not extrapolate a bucket-level rule to every historical object without checking those versions.
AWS documents that a bucket default applies to new objects placed in the bucket. Retention modes have different change and bypass semantics: governance mode allows specifically authorized bypass operations, while compliance mode is much more restrictive. Choosing either mode is a serious preservation policy decision requiring security and legal review.
Treat enablement as a one-way architectural decision
The AWS Object Lock guide explains that once Object Lock is enabled on a bucket, it cannot be disabled, and bucket versioning cannot be suspended. That is a major distinction from ordinary lifecycle configuration. An intake team should inspect application compatibility, replication design, deletion expectations, and organizational retention requirements before anyone enables or adjusts the feature.
Do not grant a broad PutBucketObjectLockConfiguration permission merely to run a read-only audit. A Get call should not make changes. Production retention changes should have a documented approval path, a clear affected scope, and a rehearsal using separate test storage where possible.
Compare bucket defaults with object-version facts
The first conceptual panel depicts a bucket with no verified retention status; it should not be treated as evidence that objects are unprotected. The second shows a configured default retention rule for new versions. The third shows a version-level inspection, which is necessary to establish the actual retention and hold status of a specific object version. These are explanatory states, not live AWS screenshots.
For important existing holdings, retrieve retention and legal hold data for specific version identifiers using the appropriate permissions and APIs. AWS documents s3:GetObjectRetention and s3:GetObjectLegalHold as distinct permissions. A legal hold is not the same field as a default retention duration, and it must be audited separately.
Distinguish retention from rights and access
Storage-level protection can prevent deletion of a version without determining who may read the object. Access is governed by IAM and related S3 resource policies. A museum also needs a permission trail for reproduction and public display, because neither object versioning nor Object Lock licenses an image for reuse. Record access control, encryption, and legal publication rights through independent checks.
A bucket protected by a long retention period may contain donor correspondence that should never appear in public search. Segment sensitive originals from derivatives and approved display copies. Use least privilege for uploaders and reviewers, and ensure that archive retention does not accidentally become a permanent exposure of private material.
Check new intake and old-version differences
Create a version-aware audit matrix listing each protected source asset, its bucket and key reference, expected owner, version ID, actual retention mode and retain-until date where applicable, and legal hold status. Separate versions created before a default was configured from versions uploaded afterward. Do not deduce an older object version’s settings solely from the current bucket response.
For a proposed policy change, simulate new uploads in authorized test storage and inspect their resulting version-level settings. Preserve complete test evidence, but do not present those results as production guarantees. Confirm handling of multipart uploads, replication and lifecycle interactions using current AWS documentation and your architecture.
Plan safe exceptions and recovery
Unexpected retention settings can block an otherwise routine archive correction or cleanup. Governance-mode bypass requires specific permission and an explicit request; compliance mode has much stronger restrictions. Avoid designing a repair process that assumes every protected version can be deleted by an administrator. Prefer adding corrected versions and preserving a traceable supersession history when policy permits.
Work with records management on retention schedules, holds, and lawful deletion obligations. If policy conflicts are discovered, escalate before applying new rules. A storage error caused by Object Lock is not a reason to silently disable unrelated security protections or create a broad exception for every uploader.
Audit checklist and verification limits
Before new archive intake, check the exact bucket and owner, supported bucket type, Object Lock enablement, default mode and duration, existing-version inspection, legal holds, IAM permissions, access logs, and human approval of the retention schedule. Retain a restricted change record and test an authorized sample upload when the policy is deployed.
No AWS bucket was queried or changed while writing this guide. The diagrams are conceptual and the examples are hypothetical. Check current AWS Object Lock behavior, storage charges, supported environments, and organizational legal requirements before relying on a configuration in production.
How We Research
Official primary documentation reviewed November 11, 2026: S3 GetObjectLockConfiguration API; S3 Object Lock user guide; S3 Object Lock considerations and permissions. We compared the named technical feature against its provider reference and designed a hypothetical archive workflow covering configuration, risks, error handling, and human authorization. We did not run an API call, inspect a customer account, benchmark software, or verify outcomes in a production environment. Images are editorial diagrams rather than product screenshots or observed results. Confirm current documentation, support, privacy requirements, quotas, costs, and actual deployed settings before making changes.
Frequently Asked Questions
It retrieves the bucket Object Lock configuration and, if configured, its default retention rule for incoming object versions.
No. Inspect individual object versions for their actual retention settings and any legal hold.
AWS documents s3:GetBucketObjectLockConfiguration for this audit.
AWS states that enabling Object Lock on a bucket is irreversible and bucket versioning cannot then be suspended.
No. Storage immutability, access authorization, and copyright or consent for publication are separate concerns.