S3 general purpose buckets should have Object Lock enabled

How to fix it

• Can't be undone: Once Object Lock is on, it cannot be turned off and versioning can no longer be suspended on this bucket.
• Can break clients: A bucket with Object Lock cannot be a server access log destination, so leave it off any bucket that other buckets log to for S3.9.

In the console

S3 → the bucket → Properties

Bucket Versioning

Enable first: Object Lock works only on versioned buckets

Object Lock

Enable, acknowledging that objects in the bucket can then be locked permanently

Default retention

Enable; this check passes without it, but then only objects given their own retention or legal hold are locked

Retention mode

Governance mode while you settle the period; Compliance mode cannot be shortened or removed, even by the root user

Default retention period

How long each new object version must be kept; objects already stored are not covered

With the AWS CLI

aws s3api put-object-lock-configuration --bucket <bucket-name> --object-lock-configuration '{"ObjectLockEnabled":"Enabled","Rule":{"DefaultRetention":{"Mode":"GOVERNANCE","Days":30}}}'

With Terraform

resource "aws_s3_bucket_object_lock_configuration" "this" {
  bucket = var.bucket_name

  rule {
    default_retention {
      mode = "GOVERNANCE"
      days = 30
    }
  }
}