AWS AmazonS3 medium security documentation change
Summary
Simplified explanation of S3 Object Lock deletion behavior - removed distinction between permanent/simple DELETE requests and consolidated error response to 403 Forbidden for protected objects
Security assessment
Clarifies security enforcement for Object Lock protected objects by removing ambiguity about deletion scenarios. Ensures users understand retention policies and legal holds actively prevent deletion attempts, which strengthens data protection controls.
Diff
diff --git a/AmazonS3/latest/userguide/troubleshoot-403-errors.md b/AmazonS3/latest/userguide/troubleshoot-403-errors.md index 1bf8aed7e..ef2cae3e8 100644 --- a//AmazonS3/latest/userguide/troubleshoot-403-errors.md +++ b//AmazonS3/latest/userguide/troubleshoot-403-errors.md @@ -587,8 +587 @@ If the object is encrypted with a customer managed key, make sure that the KMS k -If your bucket has [S3 Object Lock](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock.html) enabled and the object is protected by a [retention period](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-overview.html#object-lock-retention-periods) or [legal hold](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-overview.html#object-lock-legal-holds) and you try to delete an object, Amazon S3 returns one of the following responses, depending on how you tried to delete the object: - - * **Permanent`DELETE` request** – If you issued a permanent `DELETE` request (a request that specifies a version ID), Amazon S3 returns an Access Denied (`403 Forbidden`) error when you try to delete the object. - - * **Simple`DELETE` request** – If you issued a simple `DELETE` request (a request that doesn't specify a version ID), Amazon S3 returns a `200 OK` response and inserts a [delete marker](./DeleteMarker.html) in the bucket, and that marker becomes the current version of the object with a new ID. - - - +If your bucket has [S3 Object Lock](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock.html) enabled and the object is protected by a [retention period](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-overview.html#object-lock-retention-periods) or [legal hold](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-overview.html#object-lock-legal-holds), Amazon S3 returns an Access Denied (403 Forbidden) error when you try to delete the object.