Create an S3 bucket with Object Lock

Part 75 of AWS from Zero. This lesson keeps the scope to one S3 behavior you can verify from the terminal.

What we are learning

Object Lock supports write-once-read-many controls. For a new bucket, enable the capability during bucket creation.

Before you run it

REGION="ap-south-1"
LOCK_BUCKET="aws-zero-object-lock-12345"

Use a globally unique name. Object Lock is a compliance feature; test only in a disposable bucket with clear cleanup expectations.

The command

aws s3api create-bucket \
  --bucket "$LOCK_BUCKET" \
  --region "$REGION" \
  --create-bucket-configuration LocationConstraint="$REGION" \
  --object-lock-enabled-for-bucket

A successful configuration command may return no output. Treat inspection as a separate required step.

Inspect the result

aws s3api get-object-lock-configuration \
  --bucket "$LOCK_BUCKET"
aws s3api get-bucket-versioning \
  --bucket "$LOCK_BUCKET"

Object Lock requires versioning; verify both states.

One tiny variation

aws s3api put-public-access-block \
  --bucket "$LOCK_BUCKET" \
  --public-access-block-configuration \
  BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true

Keep compliance storage private with explicit Block Public Access controls.

Common mistake

You cannot disable Object Lock after enabling it for a bucket. Retained object versions may also prevent deletion until retention expires.

Cleanup

aws s3api list-object-versions --bucket "$LOCK_BUCKET"
aws s3api delete-bucket --bucket "$LOCK_BUCKET" --region "$REGION"

An empty demo bucket can be deleted. If retained versions exist, their protection rules govern cleanup.

Next, we will learn Set default S3 Object Lock retention.

Official AWS CLI reference