Skip to main content
emnode
Sign up
Compliance Medium severity

AWS Security Hub · S3

S3.15: Buckets should have Object Lock enabled

Written and reviewed by Emnode · Last reviewed

What does AWS Security Hub S3.15 check?

S3.15 checks that a general-purpose bucket has Object Lock enabled. It reports FAILED when Object Lock is not configured, meaning objects can be overwritten or deleted with no write-once-read-many protection.

Why does S3.15 matter?

Object Lock gives a bucket WORM protection, so ransomware, a compromised credential or an accidental script cannot tamper with or delete protected objects within their retention period. Without it, anyone with write access can quietly destroy data that compliance or recovery depends on.

How do I fix S3.15?

  1. Object Lock requires versioning, so first confirm the bucket has versioning enabled (it works only with versioned buckets).
  2. Enable Object Lock in place on the existing bucket: in the console, open the bucket's Properties tab, find the Object Lock section, choose Edit, then Enable. The same can be done with `aws s3api put-object-lock-configuration` or the PutObjectLockConfiguration REST API.
  3. Choose GOVERNANCE or COMPLIANCE retention to match the protection level required.
  4. Set a default retention period so new objects inherit protection.

Remediation script · bash

# 1. Enable Object Lock in place and set a default retention rule in one call.
#    Versioning is turned on automatically. Use COMPLIANCE for true regulatory WORM.
aws s3api put-object-lock-configuration \
  --bucket fintech-db-snapshots \
  --object-lock-configuration \
    'ObjectLockEnabled=Enabled,Rule={DefaultRetention={Mode=COMPLIANCE,Days=2555}}'

# 2. The default retention only covers new objects. Lock the objects already in
#    the bucket with an S3 Batch Operations job (put-object-retention operation),
#    driven by an inventory or CSV manifest of the existing keys.
aws s3control create-job \
  --account-id 111122223333 \
  --operation '{"S3PutObjectRetention":{"Retention":{"Mode":"COMPLIANCE","RetainUntilDate":"2033-01-01T00:00:00Z"}}}' \
  --manifest file://manifest.json \
  --report file://report.json \
  --priority 1 \
  --role-arn arn:aws:iam::111122223333:role/S3BatchOpsRole \
  --region us-east-1

# 3. Confirm the lock configuration is in place on the bucket.
aws s3api get-object-lock-configuration --bucket fintech-db-snapshots

Full walkthrough (console steps, edge cases and verification) in the lesson Enable Object Lock on S3 general purpose buckets.

Is S3.15 a false positive?

If you intentionally enabled Object Lock with a retention mode that doesn't match the control's optional `mode` parameter (GOVERNANCE vs COMPLIANCE), the control can report FAILED even though Object Lock is on; align the mode or adjust the parameter to clear it.

Full lesson Enable Object Lock on S3 general purpose buckets Step-by-step remediation with CLI, code and persona-specific context.
AWS documentation for S3 controls ↗ Check your own account for S3.15 →

More S3 controls

  • S3.1 Account-level S3 public access is not fully blocked
  • S3.2 Public S3 buckets expose data to anyone on the internet
  • S3.3 Buckets can be written to by anyone on the internet
  • S3.5 S3 is accepting unencrypted HTTP requests
  • S3.6 Bucket policy grants broad access to other AWS accounts
  • S3.8 Buckets can still be made public; Block Public Access is off
  • S3.9 No S3 access logs, so reads and writes go unaudited
  • S3.10 Versioned buckets should have lifecycle configurations
  • S3.11 Buckets should have event notifications enabled
  • S3.12 ACLs should not be used to manage bucket access
  • S3.13 Buckets have no lifecycle rules and grow forever
  • S3.17 Buckets should be encrypted at rest with KMS keys