The short answer
In banking, healthcare, and federal government analytics platforms, regulatory frameworks (such as SEC Rule 17a-4, FINRA, and HIPAA) mandate that transaction records, financial ledgers, and audit logs must be preserved in an immutable, tamper-proof state.
Amazon S3 provides S3 Object Lock, implementing a Write Once, Read Many (WORM) storage model.
Retention modes: Governance versus Compliance
S3 Object Lock operates on versioned buckets and supports two distinct retention modes:
- Governance mode: Protects objects from being overwritten or deleted by standard users. However, users granted special permissions (such as
s3:BypassGovernanceRetention) can override retention periods or delete objects if an operational emergency arises. - Compliance mode: Enforces absolute, unalterable immutability. Once an object is locked in Compliance mode, its retention period cannot be shortened, and the object cannot be deleted or modified by any IAM identity, including the AWS account root user. Even AWS Support cannot delete an object protected under Compliance mode until the retention period expires.
Incoming Audit Logs
|
v
S3 Object Lock Bucket (WORM)
+-------------------------------------------------------------+
| s3://compliance-vault/audit_2024.parquet |
| Mode: COMPLIANCE | Retention Period: 7 Years (Immutable) |
| Legal Hold: ON |
| |
| Root User Delete Request ---> [ ACCESS DENIED ] |
| S3 Lifecycle Expiration ---> [ BLOCKED UNTIL EXPIRATION ] |
+-------------------------------------------------------------+Legal holds
In addition to fixed retention dates, S3 Object Lock supports Legal Holds.
A legal hold places an indefinite lock on an object version without setting an expiration date. An object placed under a legal hold cannot be deleted until an authorized compliance officer explicitly removes the hold via the s3:PutObjectLegalHold API, regardless of whether its standard retention period has lapsed.