Object lock (Epic)

[jhmarina]

High level documentation

S3 Object Lock implements storing of objects using a write-once-read-many (WORM) model.
You can use S3 Object Lock to meet regulatory requirements that require WORM storage, or add an extra layer of protection against object changes and deletion.

• Object Lock is intended for versioned buckets only.
• You can't disable Object Lock or suspend versioning for a Object Lock enabled bucket.
• on AWS, you can only enable Object Lock for new buckets (no public API for doing this ; but they can enable this in the backoffice probably).

Main topics

• Retention modes
  S3 Object Lock provides two retention modes:

  • Governance mode: only authorized users can delete an object

  • Compliance mode: no-one can delete the object (until the associated retention period expires)

    Retention modes apply to Object's versions.
    Different versions of a single object can have different retention modes and periods.

• Retention periods

  • A retention period protects an object version for a fixed amount of time. It is implemented with a timestamp in the object version's metadata to indicate when the retention period expires
  • You can extend a retention period but not shrink it

• Legal holds

  • You can also place a legal hold on an object version. Like a retention period.
  • They remain in effect until removed by any user who has the s3:PutObjectLegalHold permission.
  • Legal holds are independent from retention periods.

• Bucket configuration

  • To use Object Lock, you must enable it for a bucket.
  • You can also optionally configure a default retention mode and period that applies to new objects that are placed in the bucket.

• Required permissions

  • Object Lock operations require specific permissions for the user:

  • s3:BypassGovernanceRetention

  • s3:GetBucketObjectLockConfiguration

  • s3:GetObjectLegalHold

  • s3:GetObjectRetention

  • s3:PutBucketObjectLockConfiguration

  • s3:PutObjectLegalHold

  • s3:PutObjectRetention

### Tasks
- [ ] #313 
- [ ] #327 
- [ ] #312 
- [ ] https://github.com/aquarist-labs/s3gw/issues/355

[jhmarina]

Closing this Epic as it is marked as Done