AWS AmazonS3 medium security documentation change
Summary
Added documentation on how deletes work with S3 Object Lock, including responses for protected objects.
Security assessment
Clarifies how Object Lock prevents unauthorized deletions (e.g., Access Denied errors for protected objects), which is a security feature. This helps users enforce retention policies and avoid accidental/malicious data loss.
Diff
diff --git a/AmazonS3/latest/userguide/object-lock.md b/AmazonS3/latest/userguide/object-lock.md index 31ee3a777..249e2b3ba 100644 --- a//AmazonS3/latest/userguide/object-lock.md +++ b//AmazonS3/latest/userguide/object-lock.md @@ -37,0 +38,2 @@ If you put an object into a bucket that already contains an existing protected o + * How deletes work with S3 Object Lock + @@ -97,0 +100,11 @@ For example, suppose that you place a legal hold on an object version and that o +### How deletes work with S3 Object Lock + +If your bucket has S3 Object Lock enabled and the object is protected by a retention period or legal hold and you try to delete an object, Amazon S3 returns one of the following responses, depending on how you tried to delete the object: + + * **Permanent`DELETE` request** – If you issued a permanent `DELETE` request (a request that specifies a version ID), Amazon S3 returns an Access Denied (`403 Forbidden`) error when you try to delete the object. For more information about troubleshooting Access Denied errors with Object Lock, see [S3 Object Lock settings](./troubleshoot-403-errors.html#troubleshoot-403-object-lock). + + * **Simple`DELETE` request** – If you issued a simple `DELETE` request (a request that doesn't specify a version ID), Amazon S3 returns a `200 OK` response and inserts a [delete marker](./DeleteMarker.html) in the bucket, and that marker becomes the current version of the object with a new ID. For more information about managing delete markers with Object Lock, see [Managing delete markers with Object Lock](./object-lock-managing.html#object-lock-managing-delete-markers). + + + +