Can I add or modify tags to S3 objects that is Object Locked with Compliance mode?

Question

We have a new requirement where we need to add tags to existing S3 objects, but all of our buckets are object locked with Compliance mode. We understand that objects in compliance mode cannot be overwritten and deleted by any user, including root user. So we want to clarify if this also affects adding tags to objects?

We're planning to do this automatically using Lambda and the PutObjectTagging API to accomplish this. Looking forward for any response, thank you!

Riku_Kobayashi · Accepted Answer

Hello.

Even with Object Lock, you can still tag existing S3 objects.  
I tried the following command in my AWS account.  
The target S3 bucket has Object Lock enabled in compliance mode.  
As a result, the tag was set on the object.
```
aws s3api put-object-tagging --bucket cloudtrail-12345689012 --key AWSLogs/123456789012/CloudTrail/ap-northeast-1/2025/01/01/123456789012_CloudTrail_ap-northeast-1_20250101T0000Z_hoge.json.gz --tagging '{"TagSet":[{"Key": "testtag","Value": "hoge"}]}'
```

Shahed Kazi (@shajam) · Answer

Yes, you can add tags to an object even if that object has a legal hold or is under a retention period in Compliance mode. You can modify the metadata of the object but not the data of the object itself. That is, you cannot delete or override the data.

EXPERT

Shahed Kazi (@shajam)

answered a year ago

EXPERT

Gary Mclean

reviewed a year ago

Can I add or modify tags to S3 objects that is Object Locked with Compliance mode?

Add your answer

Relevant content