S3 Object lock: Governance Mode and Legal Hold

[ferristocrat]

Summary

Our current implementation of S3 Compatible Object Lock only accounts for Compliance Mode. This roadmap item is meant to cover the remaining functionality to complete full Object Lock compatibility.

New operations to support

• PutObjectLockConfiguration
  • ObjectLockEnabled: Indicates whether this bucket has an Object Lock configuration enabled. Enable ObjectLockEnabled when you apply ObjectLockConfiguration to a bucket.
  • Rule: Specifies the Object Lock rule for the specified object. Enable the this rule when you apply ObjectLockConfiguration to a bucket. Bucket settings require both a mode and a period. The period can be either Days or Years but you must select one. You cannot specify Days and Years at the same time.
• GetObjectLegalHold
• PutObjectLegalHold

Existing operations to update

• PutObject
  • Should support the following request params:
    • x-amz-object-lock-mode (GOVERNANCE should be added)
    • x-amz-object-lock-legal-hold
• GetObjectLockConfiguration
  • Should return any Rule that has been applied via PutObjectLockConfiguration
• GetObjectRetention
  • Should now also return mode of GOVERNANCE for objects locked with Governance Mode
• PutObjectRetention
  • Should support the following request params:
    • x-amz-bypass-governance-retention
  • Should accept GOVERNANCE Mode

TBD on filling these out:

• CreateBucket
• HeadObject
• GetObject
• PutObject
• FinishMoveObject
• CopyObject
• DeleteBucket
• DeleteObjectVersion

New permissions/access to consider

S3 Permission	Description	Notes
s3:BypassGovernanceRetention	Grants permission to allow circumvention of governance-mode object retention settings	Notes on how this permission is utilized/how it works: Object Lock considerations - Amazon Simple Storage Service
s3:PutBucketObjectLockConfiguration	Grants permission to put Object Lock configuration on a specific bucket.
s3:GetObjectLegalHold	Grants permission to get an object's current Legal Hold status
s3:PutObjectLegalHold	Grants permission to apply a Legal Hold configuration to the specified object