Impreza S3 buckets can be created with object lock in GOVERNANCE mode: every object version is locked for the bucket's retention period (for example 30 days) and cannot be deleted or overwritten before it ends.
Object lock uses GOVERNANCE mode. Your keys, including service accounts, can never shorten, remove or bypass a retention period or lower the bucket's default. Only Impreza's storage administrators hold the bypass permission, and they use it only for a documented request from the account owner. If you need retention that nobody can bypass, ask us before creating the bucket.
What your keys can and cannot do
Your access keys, the main key and every additional key, can:
- write, read and list objects in locked buckets;
- delete objects whose lock has ended (normal retention and pruning keep working);
- use buckets without object lock exactly as before.
Your access keys cannot change retention, so that a stolen key cannot remove the protection:
- shorten or remove the lock of an object, with or without the "bypass governance" option;
- extend the lock of individual objects;
- upload an object with its own retention date or legal hold;
- change the bucket's default retention;
- set or remove a legal hold.
What no longer works
These requests used to be accepted from your keys and are now refused, with no exception:
- extending the retention of individual objects, for example by backup software such as Veeam with immutability enabled;
- uploading an object with its own retention or legal hold;
- changing the bucket's default retention.
What this means for backup software
Backup tools that set or extend retention object by object (for example Veeam with immutability enabled) cannot do that on Impreza S3 any more. Use a bucket whose default retention covers your needs instead: every object written to it is locked for that period automatically.
Creating a locked bucket
Locked buckets are created by Impreza on your request, with the retention period you choose. Object lock can only be turned on when a bucket is created; it cannot be added to an existing bucket.