Prevents items from being deleted or overwritten.

Can be activated only at Bucket Creation, and only if Versioning is enabled.

Level of compliance known as WORM Write Once Read Many

Two possible retention mode exist:

Governance mode: allows to set a retention period, during which can not be deleted, afterwards, it is possible to delete the file.

It is important to note that if a User/Role had specific permissions like for example BypassGovernanceMode or s3:GetObjectLockConfiguration it will indeed be possible to bypass object locking.

Compliance mode: also has a retention period, but there are no permission that could allow bypassing it.

Compliance mode also allows to put versions in LegalHold - so that even when object is deleted after retention period, its versions still can not be deleted (unless a user has specific permission to remove LegalHold).