Apply an S3 Object Lock legal hold

Part 77 of AWS from Zero. This lesson keeps the scope to one S3 behavior you can verify from the terminal.

What we are learning

A legal hold has no expiration date. It remains active until an authorized caller explicitly turns it off.

Before you run it

LOCK_BUCKET="replace-with-object-lock-enabled-bucket"
KEY="case-file.txt"
VERSION_ID="replace-with-exact-version-id"

Legal holds apply to specific versions. Capture the version ID when uploading the object.

The command

aws s3api put-object-legal-hold \
  --bucket "$LOCK_BUCKET" \
  --key "$KEY" \
  --version-id "$VERSION_ID" \
  --legal-hold Status=ON

A successful configuration command may return no output. Treat inspection as a separate required step.

Inspect the result

aws s3api get-object-legal-hold \
  --bucket "$LOCK_BUCKET" \
  --key "$KEY" \
  --version-id "$VERSION_ID"

Read the returned fields rather than assuming the write succeeded exactly as intended.

One tiny variation

aws s3api put-object-legal-hold \
  --bucket "$LOCK_BUCKET" \
  --key "$KEY" \
  --version-id "$VERSION_ID" \
  --legal-hold Status=OFF

Turning the legal hold off does not override a separate retention period.

Common mistake

Do not apply a hold to a key without the exact version ID when your intent concerns one immutable version. Versioned keys can have multiple independent states.

Cleanup

aws s3api put-object-legal-hold \
  --bucket "$LOCK_BUCKET" \
  --key "$KEY" \
  --version-id "$VERSION_ID" \
  --legal-hold Status=OFF

Remove the demonstration hold, then follow any remaining retention rule before deletion.

Next, we will learn List every incomplete S3 multipart upload.

Official AWS CLI reference