So now let's talk about S3 Glacier Vault Lock.
So the idea is that you want to lock your Glacier Vault
to adapt a WORM model.
That means Write Once Read Many.
So the idea is that you take an object,
you put it into your S3 Glacier Vault,
and then you lock it so it cannot
be ever modified or deleted.
So for this, you need to create a Vault Lock
Policy on top of your Glacier
and then you lock the policy itself for future edits.
That means that once you've set a Vault Lock
Policy and you locked it,
it can no longer be changed or deleted by anyone
which is very helpful for compliance and data retention.
So that means that once an object is inserted into your
Glacier vault and the vault itself has a Vault Lock Policy
then the object can never be deleted
and even by administrator or AWS or whatever you want.
So it's very helpful for anything legal
such as compliance or data retention.
So that's for the Glacier option.
And it's quite simple to understand.
Now, there is the same option or something similar at least
for the S3 buckets, but it's a bit more complicated.
So for enabling S3 Object Lock,
you must first enable versioning.
And again, it allows you to adapt a WORM model, okay?
But this time it's not a lock policy
at the whole S3 bucket level.
It is a lock you can adapt for each and every object
within your bucket.
So you can do an object lock on the single object.
And the idea is that thanks to an S3 object lock,
you want to block a specific object version to be deleted
for a specified amount of time.
So we have two retention modes.
And the first one is the compliance mode.
The compliance mode looks a lot like what we had
for S3 Glacier Vault Lock.
So the idea is that the object versions cannot be
overwritten or deleted by any user,
including the root user.
So that means that once you are in your compliance mode,
no one can change anything.
And also the retention modes themselves cannot be changed
and the retention period cannot be shortened.
So it's when you wanna be super compliance.
But if you want to be a bit more flexibility
you have the Governance Retention mode.
So in this case, most user cannot override or delete
an object version or alter its lock settings.
But some users, the admin users,
have special permissions and that's given through IAM
and they can change the retention or delete
an object directly.
So compliance is very strict as a retention mode.
Whereas government's is a bit more lenient
and some users have had admin powers
and can change a few things.
Now, in both these modes you have to set a retention period.
That means that you can either apply the compliance
or the governance mode with a retention period
to say that you want to protect the object for
a fixed period of time.
And that period of time can be extended,
if you wanted to.
Now, there is one more thing you can do
with the S3 object log, it's to pull the legal hold
on an object.
So this is different from what we saw.
So legal hold protects any object
on your S3 bucket indefinitely
and that's independent from the retention period.
So once you place a legal hold on an object
think of like, oh, this object is very important.
We need to use it in a trial.
Let's place a legal hold on it.
Then the object is protected forever
regardless of what retention mode
and retention period you've set on it from before.
And then someone who has the IAM permissions
S3 PutObjectLegalHold has the option to take any objects
and put legal holds on them or to remove them.
So this is a flexible mode where you can say, hey,
when someone wants to protect an object in admin,
they use the PutObjectLegalHold permission.
And then once, for example, a legal investigation is over
then it gets removed again using this
PutObjectLegalHold IAM permissions.
Okay.
So you need to know the differences
of the S3 object lock going at the exam.
So I hope you liked it.
And I will see you in the next lecture.