# Object lock on Impreza S3

Source: https://docs.imprezahost.com/security/s3-object-lock.html

Impreza S3 buckets can be created with **object lock** in **GOVERNANCE** mode: every object version is locked for
the bucket's retention period (for example 30 days) and cannot be deleted or overwritten before it ends.

Object lock uses GOVERNANCE mode. Your keys, including service accounts, can never shorten, remove or bypass a
retention period or lower the bucket's default. Only Impreza's storage administrators hold the bypass
permission, and they use it only for a documented request from the account owner. If you need retention that
nobody can bypass, ask us before creating the bucket.

## What your keys can and cannot do

Your access keys, the main key and every additional key, can:
- write, read and list objects in locked buckets;
- delete objects whose lock has ended (normal retention and pruning keep working);
- use buckets without object lock exactly as before.

Your access keys **cannot** change retention, so that a stolen key cannot remove the protection:
- shorten or remove the lock of an object, with or without the "bypass governance" option;
- **extend** the lock of individual objects;
- upload an object with its own retention date or legal hold;
- change the bucket's default retention;
- set or remove a legal hold.

## What no longer works

These requests used to be accepted from your keys and are now refused, with no exception:
- **extending the retention of individual objects**, for example by backup software such as Veeam with
  immutability enabled;
- **uploading an object with its own retention or legal hold**;
- **changing the bucket's default retention**.

## What this means for backup software

Backup tools that set or extend retention object by object (for example Veeam with immutability enabled) cannot do
that on Impreza S3 any more. Use a bucket whose default retention covers your needs instead: every object written
to it is locked for that period automatically.

## Creating a locked bucket

Locked buckets are created by Impreza on your request, with the retention period you choose. Object lock can only be turned on when a bucket is created; it cannot be added to an existing
bucket.