Amazon S3 buckets have Object Lock enabled at the bucket level, applying WORM controls to object versions
Risk
Without Object Lock, object versions can be deleted or overwritten, undermining data integrity and availability.
Threats include ransomware erasing backups, insider or mistaken deletions, and tampering that defeats recovery. Inability to enforce retention or legal holds increases exposure to data loss and compliance gaps.
prowler aws --checks s3_bucket_object_lock
Recommendation
Enable Object Lock for critical data and set appropriate default retention in GOVERNANCE or COMPLIANCE mode.
Apply immutability and least privilege by restricting permissions that bypass retention, and use legal holds when you need indefinite protection for investigations or regulatory requirements.
Remediation
aws s3api put-object-lock-configuration --bucket <BUCKET_NAME> --object-lock-configuration '{"ObjectLockEnabled":"Enabled","Rule":{"DefaultRetention":{"Mode":"GOVERNANCE","Days":1}}}'
- Open the AWS S3 console and select the target bucket
- Go to the Properties tab
- Find Object Lock and click Edit
- Enable Object Lock
- Set Default retention: Mode = Governance, Days = 1
- Click Save changes
Note: If the bucket was not created with Object Lock, create a new bucket with Object Lock enabled and migrate objects.
Source Code
Resource Type
AwsS3Bucket
References
- https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-overview.html
- https://aws.amazon.com/about-aws/whats-new/2018/11/s3-object-lock/
- https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/aws/S3/object-lock.html
- https://docs.aws.amazon.com/de_de/cli/latest/reference/s3api/put-object-lock-configuration.html