Back to Checks
aws

S3 bucket has Object Lock enabled

s3_bucket_object_lock
Service: s3Severity: low
OfficialBuilt-inVerified
Categories:resilience
Resource Type:AwsS3Bucket

Amazon S3 buckets have Object Lock enabled at the bucket level, applying WORM controls to object versions

Prowler logoProwlerprowler-provider-aws

Risk

Without Object Lock, object versions can be deleted or overwritten, undermining data integrity and availability.

Threats include ransomware erasing backups, insider or mistaken deletions, and tampering that defeats recovery. Inability to enforce retention or legal holds increases exposure to data loss and compliance gaps.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks s3_bucket_object_lock

Recommendation

Enable Object Lock for critical data and set appropriate default retention in GOVERNANCE or COMPLIANCE mode.

Apply immutability and least privilege by restricting permissions that bypass retention, and use legal holds when you need indefinite protection for investigations or regulatory requirements.

Remediation

CLI

aws s3api put-object-lock-configuration --bucket <BUCKET_NAME> --object-lock-configuration '{"ObjectLockEnabled":"Enabled","Rule":{"DefaultRetention":{"Mode":"GOVERNANCE","Days":1}}}'

Terraform

resource "aws_s3_bucket_object_lock_configuration" "<example_resource_name>" {
  bucket               = "<example_resource_name>"
  object_lock_enabled  = "Enabled"  # CRITICAL: Enables Object Lock configuration on the bucket
  rule {
    default_retention {
      mode = "GOVERNANCE"  # CRITICAL: Default retention mode
      days = 1              # CRITICAL: Minimal retention period
    }
  }
}

NativeIaC

Resources:
  <example_resource_name>:
    Type: AWS::S3::Bucket
    Properties:
      ObjectLockEnabled: true  # CRITICAL: Enables Object Lock on the bucket at creation
      ObjectLockConfiguration:
        ObjectLockEnabled: Enabled  # CRITICAL: Turns on Object Lock configuration
        Rule:
          DefaultRetention:
            Mode: GOVERNANCE  # CRITICAL: Sets default retention mode
            Days: 1           # CRITICAL: Minimal retention to enable default lock

Other

1Open the AWS S3 console and select the target bucket
2Go to the Properties tab
3Find Object Lock and click Edit
4Enable Object Lock
5Set Default retention: Mode = Governance, Days = 1
6Click Save changes
7Note: If the bucket was not created with Object Lock, create a new bucket with Object Lock enabled and migrate objects.

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.s3.s3_client import s3_client


class s3_bucket_object_lock(Check):
    def execute(self):
        findings = []
        for bucket in s3_client.buckets.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=bucket)
            if bucket.object_lock:
                report.status = "PASS"
                report.status_extended = (
                    f"S3 Bucket {bucket.name} has Object Lock enabled."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"S3 Bucket {bucket.name} has Object Lock disabled."
                )
            findings.append(report)

        return findings

References