Locking objects with object lock

VK Object Storage allows you to prevent objects from being deleted or overwritten using the object lock feature. Object lock in VK Object Storage ensures the following:

• Resistance to cyberattacks. Immutable backups allow you to restore objects in their uncompromised state.
• Data integrity and error protection. The immutability of objects ensures that critical information is protected from accidental or malicious deletion, as well as damage caused by human error or software failure.
• Compliance with regulatory requirements. To ensure auditing and legal relevance, the law might require that data be retained unchanged for a specified time.

You can only use object lock in buckets created with this feature explicitly enabled, for example, via AWS CLI.

In VK Object Storage, two types of object lock are supported: retention period and legal hold. These types can be used separately or together for the same object, offering flexible protection scenarios.

You can only enable object lock in a bucket with versioning enabled. After you enable object lock, you cannot suspend bucket versioning while the lock remains enabled.

A retention period provides a temporary lock for a fixed amount of time. Two modes of the retention period are supported: a managed GOVERNANCE lock and a strict COMPLIANCE lock.

In both modes of the retention period:

• An object cannot be deleted before its specified expiration date.
• The locking period cannot be reduced, only prolonged.

A managed GOVERNANCE lock is best suited for implementing internal data protection policies. It prevents developers or automated scripts from accidentally deleting critical files while allowing administrators to perform necessary data management operations.

If the GOVERNANCE lock is used, a user with the WRITE permissions can bypass it as follows:

• Delete the object before its specified expiration date.
• Reduce the locking period.
• Change the mode to COMPLIANCE.

A strict COMPLIANCE lock provides the highest level of protection. With this lock, no user can overwrite or delete the object, including the project administrator, before its specified expiration date.

This mode is best suited for meeting strict regulatory or legislative requirements (for example, Federal Law No. 152-FZ), where the immutability of data must be guaranteed at the technical and procedural level.

A legal hold has no expiration date, and it remains in place until you explicitly remove it. A user with the WRITE permissions can apply this type of lock or remove it from an object at any time.

A legal hold is valid regardless of the retention period set for an object and takes precedence over it.

A legal hold is used in situations with indefinite data retention, such as court proceedings, internal audits, or investigations. The data remains protected until the relevant process is completed, after which the legal hold can be removed.

Attempting to delete an object with object lock enabled produces different results depending on whether a version ID is used:

• in the versionId parameter of an API request with the DeleteObject or DeleteMultipleObjects methods, or the AWS CLI delete-object and delete-objects commands;
• when deleting an object in the control panel with the Show object versions option enabled.

A delete marker cannot be locked. When you delete a delete marker, the previous version of the object becomes the current version.