AWS AmazonS3 low security documentation change

Service: AmazonS3 · 2025-10-07 · Security-related low

File: AmazonS3/latest/userguide/troubleshoot-403-errors.md

Summary

Clarified S3 Object Lock behavior when deleting objects with retention periods/legal holds by differentiating responses between permanent DELETE (403 error) and simple DELETE (200 OK with delete marker)

Security assessment

Explains security implications of object retention protections (legal holds/retention periods) and how they enforce data protection by restricting deletions. While not fixing a vulnerability, it documents security controls that prevent unauthorized deletions.

Diff

diff --git a/AmazonS3/latest/userguide/troubleshoot-403-errors.md b/AmazonS3/latest/userguide/troubleshoot-403-errors.md
index ef2cae3e8..1bf8aed7e 100644
--- a//AmazonS3/latest/userguide/troubleshoot-403-errors.md
+++ b//AmazonS3/latest/userguide/troubleshoot-403-errors.md
@@ -587 +587,8 @@ If the object is encrypted with a customer managed key, make sure that the KMS k
-If your bucket has [S3 Object Lock](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock.html) enabled and the object is protected by a [retention period](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-overview.html#object-lock-retention-periods) or [legal hold](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-overview.html#object-lock-legal-holds), Amazon S3 returns an Access Denied (403 Forbidden) error when you try to delete the object.
+If your bucket has [S3 Object Lock](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock.html) enabled and the object is protected by a [retention period](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-overview.html#object-lock-retention-periods) or [legal hold](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-overview.html#object-lock-legal-holds) and you try to delete an object, Amazon S3 returns one of the following responses, depending on how you tried to delete the object:
+
+  * **Permanent`DELETE` request** – If you issued a permanent `DELETE` request (a request that specifies a version ID), Amazon S3 returns an Access Denied (`403 Forbidden`) error when you try to delete the object.
+
+  * **Simple`DELETE` request** – If you issued a simple `DELETE` request (a request that doesn't specify a version ID), Amazon S3 returns a `200 OK` response and inserts a [delete marker](./DeleteMarker.html) in the bucket, and that marker becomes the current version of the object with a new ID.
+
+
+