Back to Checks
stackit

ObjectStorage buckets should have S3 Object Lock enabled

objectstorage_bucket_object_lock_enabled
Service: objectstorageSeverity: high
OfficialBuilt-inVerified
Categories:resilience
Resource Type:NotDefined

S3 Object Lock prevents objects from being deleted or overwritten for a fixed period or indefinitely. Enabling it protects against accidental deletion and ransomware by enforcing a write-once-read-many (WORM) model. Object Lock can only be enabled when the bucket is created.

Prowler logoProwlerprowler-provider-stackit

Risk

Without Object Lock, objects can be deleted or overwritten at any time, increasing the risk of data loss from accidental deletion, malicious actors, or ransomware. Backups and compliance data are particularly vulnerable.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler stackit --checks objectstorage_bucket_object_lock_enabled

Recommendation

Create ObjectStorage buckets with S3 Object Lock enabled for workloads that require data immutability, compliance archiving, or ransomware protection. Object Lock cannot be retroactively enabled on existing buckets.

Remediation

Other

1Object Lock must be enabled at bucket creation time and cannot be enabled on an existing bucket. Create a new bucket with Object Lock enabled and migrate your data to it.

Check Code

from prowler.lib.check.models import Check, CheckReportStackIT
from prowler.providers.stackit.services.objectstorage.objectstorage_client import (
    objectstorage_client,
)


class objectstorage_bucket_object_lock_enabled(Check):
    def execute(self):
        findings = []
        for bucket in objectstorage_client.buckets:
            report = CheckReportStackIT(
                metadata=self.metadata(),
                resource=bucket,
            )
            report.resource_id = bucket.name
            report.resource_name = bucket.name
            report.location = bucket.region

            if bucket.object_lock_enabled:
                report.status = "PASS"
                report.status_extended = (
                    f"Bucket {bucket.name} has S3 Object Lock enabled."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Bucket {bucket.name} does not have S3 Object Lock enabled."
                )

            findings.append(report)
        return findings

References