S3 Object lock in compliance mode, file uploaded thru cli, file properties shows compliance mode, I can still delete it.

0

I have a bucket with Object lock and compliance mode of 7 days. I upload a file thru the CLI. I show the file in the bucket with compliance mode of 7 days. I can immediately delete the file thru the CLI or the console. I am using an assumed role account from the Org parent that does have full permissions. But compliance mode should still not let me remove the file even with full permissions on the account? It says even the root account shouldn't be able to delete. Is this a bug?

3개 답변
1
수락된 답변

Hi,

The behavior you're seeing here is due to versioning. Versioning is mandatory when you enable object lock, so when you delete an object it places a delete marker on the object, but the original version of the object is retained. If you want to see the delete marker and original version of the object, in the management console toggle the "show versions" switch.

For reference: https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-managing.html#object-lock-managing-lifecycle

AWS
Tom-B
답변함 2년 전
AWS
전문가
Hernito
검토됨 2년 전
0

I had read about the versioning, but assumed in compliance mode you could not even add the delete marker. That we would get an error trying to remove, not add the marker and hide it? That seems counter intuitive.

답변함 2년 전
0

Is the file definitely being deleted? In S3 when you delete a versioned file a delete marker is added but the previous version still remains - this can be seen by toggling the 'Show Versions' switch in the console.

This file was set with default object lock of 7 days with compliance mode and could be 'deleted' via the CLI, but the previous version is still available.

Phurl
답변함 2년 전

로그인하지 않았습니다. 로그인해야 답변을 게시할 수 있습니다.

좋은 답변은 질문에 명확하게 답하고 건설적인 피드백을 제공하며 질문자의 전문적인 성장을 장려합니다.

질문 답변하기에 대한 가이드라인

관련 콘텐츠