[Yandex Cloud documentation](../../../index.md) > [Yandex Object Storage](../../index.md) > [Step-by-step guides](../index.md) > Buckets > Managing object locks

# Managing object locks in a bucket

You can set up _[object locks](../../concepts/object-lock.md)_ in [versioned](versioning.md) buckets. With object lock enabled, you can lock an object version so that it cannot be deleted or overwritten. You can also set default object locks for a bucket that will apply to all new object versions.

{% note info %}

In buckets with disabled or suspended versioning, object version locks are not available.

When locking is disabled, you cannot pause versioning.

{% endnote %}

## Enabling object locks {#enable}

Enabling object locks does not automatically lock previously uploaded object versions. You can lock them manually as needed.

The minimum required role is `storage.admin`.

To enable object locks:

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select a folder.
  1. Navigate to **Object Storage**.
  1. Select the bucket you want to configure encryption for.
  1. In the left-hand panel, select ![image](../../../_assets/console-icons/persons-lock.svg) **Security**.
  1. Select the **Object locks** tab.
  1. To enable using locks, check **Enable locks**.
  1. Click **Save**.

- AWS CLI {#cli}

  If you do not have the AWS CLI yet, [install and configure it](../../tools/aws-cli.md).

  Run this command:

  ```bash
  aws s3api put-object-lock-configuration \
    --bucket <bucket_name> \
    --object-lock-configuration ObjectLockEnabled=Enabled \
    --endpoint-url=https://storage.yandexcloud.net
  ```

  Where:

  * `--bucket`: Bucket name.
  * `--object-lock-configuration`: Bucket lock settings. The `ObjectLockEnabled=Enabled` value enables object locks.
  * `--endpoint-url`: Object Storage endpoint.

- Terraform {#tf}

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../../terraform/authentication.md) using the appropriate method.


  1. Open the Terraform configuration file and add the `object_lock_configuration` section to the bucket description:

      ```hcl
      resource "yandex_storage_bucket" "b" {
        ...
        object_lock_configuration {
          object_lock_enabled = "Enabled"
        }
      }
      ```

      Where:

      * `object_lock_configuration`: Object lock settings:
        * `object_lock_enabled`: Enables object locks. You must enable bucket versioning to set this property. This is an optional setting.

      For more information about the bucket properties you can specify using Terraform, see [this provider guide](../../../terraform/resources/storage_bucket.md).

  1. Create the resources:

      1. In the terminal, navigate to the configuration file directory.
      1. Make sure the configuration is correct using this command:
      
         ```bash
         terraform validate
         ```
      
         If the configuration is valid, you will get this message:
      
         ```bash
         Success! The configuration is valid.
         ```
      
      1. Run this command:
      
         ```bash
         terraform plan
         ```
      
         You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
      1. Apply the configuration changes:
      
         ```bash
         terraform apply
         ```
      
      1. Type `yes` and press **Enter** to confirm the changes.

  The specified folder will now contain object locks for the bucket. You can check that object locks are now enabled using this [CLI](../../../cli/quickstart.md) command:

    ```bash
    yc storage bucket get <bucket_name>
    ```

    Result:

    ```text
    name: my-bucket
    folder_id: b1geoelk2fld*********
    ...
    object_lock:
      status: OBJECT_LOCK_STATUS_ENABLED
    ```

- API {#api}

  Use the [putObjectLockConfiguration](../../s3/api-ref/bucket/putobjectlockconfiguration.md) S3 API method, [update](../../api-ref/Bucket/update.md) REST API method for the [Bucket](../../api-ref/Bucket/index.md) resource, or the [BucketService/Update](../../api-ref/grpc/Bucket/update.md) gRPC API call.

{% endlist %}

## Setting up default object locks {#default}

Default locks apply to all new object versions you upload to the bucket. These settings do not affect the previously uploaded versions.

The minimum required role is `storage.admin`.

To set up default object locks:

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select a folder.
  1. Navigate to **Object Storage**.
  1. Select the bucket you want to configure default locks for.
  1. In the left-hand panel, select ![image](../../../_assets/console-icons/persons-lock.svg) **Security**.
  1. Select the **Object locks** tab.
  1. To enable or disable using locks, use the **Enable locks** option.
  1. Enable **Default locks for new versions**.
  1. Select **Default lock type**:
     * **Governance**: User with the `storage.admin` role can bypass the lock, change its expiration date, or remove it.
     * **Compliance**: User with the `storage.admin` role can only extend the retention period. You cannot override, shorten, or remove such locks until they expire.
  1. Specify **Default lock period** in days or years. It starts from the moment you upload the object version to the bucket.
  1. Click **Save**.

- AWS CLI {#cli}

  If you do not have the AWS CLI yet, [install and configure it](../../tools/aws-cli.md).

  1. Specify the configuration for default object locks in JSON format:
 
     ```json
     {
       "ObjectLockEnabled": "Enabled",
       "Rule": {
         "DefaultRetention": {
           "Mode": "<lock_type>",
           "Days": <retention_period_in_days>,
           "Years": <retention_period_in_years>
         }
       }
     }
     ```

     Where:

     * `ObjectLockEnabled`: Object lock status. If this property is set to `Enabled`, you can use object locks.
 
       {% note alert %}

       This is a required field. If you do not set it to `Enabled`, you will get the `InvalidRequest` error message, and the object lock will be disabled. See also [Disabling object locks](#disable).

       {% endnote %}

     * `Mode`: Lock [type](../../concepts/object-lock.md#types):

       * `GOVERNANCE`: Governance-mode retention.
       * `COMPLIANCE`: Compliance-mode retention.

     * `Days`: Retention period in days after uploading an object version. It must be a positive integer. You cannot use it together with `Years`.
     * `Years`: Retention period in years after uploading an object version. It must be a positive integer. You cannot use it together with `Days`.

     Once the configuration is complete, save it a file, e.g., `default-object-lock.json`.

  1. Upload the configuration to the bucket:

     ```bash
     aws s3api put-object-lock-configuration \
       --bucket <bucket_name> \
       --object-lock-configuration file://default-object-lock.json \
       --endpoint-url=https://storage.yandexcloud.net
     ```

     Where:

     * `--bucket`: Bucket name.
     * `--object-lock-configuration`: Default lock settings. In our case, they are specified in the `default-object-lock.json` file.
     * `--endpoint-url`: Object Storage endpoint.

- Terraform {#tf}

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../../terraform/authentication.md) using the appropriate method.


  1. Open the Terraform configuration file and add the default lock settings to the `object_lock_configuration` section:

      ```
      ...
      rule {
        default_retention {
          mode = "GOVERNANCE"
          years = 1
        }
      }
      ...
      ```

      Where:

      * `rule`: Object lock rule. It contains the `default_retention` parameter with retention settings:
        * `mode`: Lock type. It can be either `GOVERNANCE` or `COMPLIANCE`. This is an optional setting.
        * `years` or `days`: Object lock duration (retention period). Provide it as a number. This is an optional setting.

     For more information on the properties of the `yandex_storage_bucket` resource in Terraform, see [this provider guide](../../../terraform/resources/storage_bucket.md).

  1. Apply the changes:

      1. In the terminal, navigate to the configuration file directory.
      1. Make sure the configuration is correct using this command:
      
         ```bash
         terraform validate
         ```
      
         If the configuration is valid, you will get this message:
      
         ```bash
         Success! The configuration is valid.
         ```
      
      1. Run this command:
      
         ```bash
         terraform plan
         ```
      
         You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
      1. Apply the configuration changes:
      
         ```bash
         terraform apply
         ```
      
      1. Type `yes` and press **Enter** to confirm the changes.

  You can check that object locks are now enabled using this [CLI](../../../cli/quickstart.md) command:

    ```bash
    yc storage bucket get <bucket_name>
    ```

    Result:

    ```text
    name: my-bucket
    folder_id: b1geoelk2fld********
    ...
    object_lock:
    status: OBJECT_LOCK_STATUS_ENABLED
    default_retention:
      mode: MODE_GOVERNANCE
      years: "1"
    ```

{% endlist %}

## Disabling object locks {#disable}

Disabling object locks only affects the lock feature itself and does not automatically remove existing locks. They will still be there, and you will not be able to remove or change them.

The minimum required role is `storage.admin`.

To disable object locks:

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select a folder.
  1. Navigate to **Object Storage**.
  1. Select the bucket you want to configure encryption for.
  1. In the left-hand panel, select ![image](../../../_assets/console-icons/persons-lock.svg) **Security**.
  1. Select the **Object locks** tab.
  1. To disable using locks, uncheck **Enable locks**.
  1. Click **Save**.

- AWS CLI {#cli}

  If you do not have the AWS CLI yet, [install and configure it](../../tools/aws-cli.md).

  Run this command:

  ```bash
  aws s3api put-object-lock-configuration \
    --bucket <bucket_name> \
    --object-lock-configuration ObjectLockEnabled="" \
    --endpoint-url=https://storage.yandexcloud.net
  ```

  Where:

  * `--bucket`: Bucket name.
  * `--object-lock-configuration`: Bucket lock settings. The `ObjectLockEnabled=""` value disables object locks.
  * `--endpoint-url`: Object Storage endpoint.

- Terraform {#tf}

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../../terraform/authentication.md) using the appropriate method.


  1. Open the Terraform configuration file and delete the `object_lock_configuration` section:

      {% cut "Example of specifying object locks in Terraform configuration" %}

        ```
        ...
        object_lock_configuration {
          object_lock_enabled = "Enabled"
          rule {
            default_retention {
              mode = "GOVERNANCE"
              years = 1
            }
          }
        }
        ...
        ```

      {% endcut %}

  1. Apply the changes:

      1. In the terminal, navigate to the configuration file directory.
      1. Make sure the configuration is correct using this command:
      
         ```bash
         terraform validate
         ```
      
         If the configuration is valid, you will get this message:
      
         ```bash
         Success! The configuration is valid.
         ```
      
      1. Run this command:
      
         ```bash
         terraform plan
         ```
      
         You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
      1. Apply the configuration changes:
      
         ```bash
         terraform apply
         ```
      
      1. Type `yes` and press **Enter** to confirm the changes.

  You can check that object locks are now disabled using this [CLI](../../../cli/quickstart.md) command:

    ```bash
    yc storage bucket get <bucket_name>
    ```

    Result:

    ```text
    name: my-bucket
    folder_id: b1geoelk2fld********
    ...
    object_lock:
      status: OBJECT_LOCK_STATUS_DISABLED
    ```

- API {#api}

  To disable object locks for a bucket, use the[putObjectLockConfiguration](../../s3/api-ref/bucket/putobjectlockconfiguration.md) S3 API method, [update](../../api-ref/Bucket/update.md) REST API method for the [Bucket](../../api-ref/Bucket/index.md) resource, or the [BucketService/Update](../../api-ref/grpc/Bucket/update.md) gRPC API call.

  In the request body, provide the object lock parameter with an empty value:

  * `ObjectLockConfiguration`: For S3 API.
  * `objectLock`: For REST API.
  * `object_lock`: For gRPC API.

  Here is an example of an HTTP request body for S3 API:

  ```xml
  <ObjectLockConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/" />
  ```

{% endlist %}