AWS AmazonS3 documentation change

Service: AmazonS3 · 2025-10-13 · Documentation low

File: AmazonS3/latest/userguide/troubleshoot-403-errors.md

Summary

Clarified S3 Object Lock behavior for DELETE requests, distinguishing between permanent and simple DELETE operations

Security assessment

The change provides operational clarification about error responses when deleting locked objects but does not address a security vulnerability or introduce security features. It improves documentation accuracy without security implications.

Diff

diff --git a/AmazonS3/latest/userguide/troubleshoot-403-errors.md b/AmazonS3/latest/userguide/troubleshoot-403-errors.md
index ef2cae3e8..1bf8aed7e 100644
--- a//AmazonS3/latest/userguide/troubleshoot-403-errors.md
+++ b//AmazonS3/latest/userguide/troubleshoot-403-errors.md
@@ -587 +587,8 @@ If the object is encrypted with a customer managed key, make sure that the KMS k
-If your bucket has [S3 Object Lock](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock.html) enabled and the object is protected by a [retention period](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-overview.html#object-lock-retention-periods) or [legal hold](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-overview.html#object-lock-legal-holds), Amazon S3 returns an Access Denied (403 Forbidden) error when you try to delete the object.
+If your bucket has [S3 Object Lock](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock.html) enabled and the object is protected by a [retention period](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-overview.html#object-lock-retention-periods) or [legal hold](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-overview.html#object-lock-legal-holds) and you try to delete an object, Amazon S3 returns one of the following responses, depending on how you tried to delete the object:
+
+  * **Permanent`DELETE` request** – If you issued a permanent `DELETE` request (a request that specifies a version ID), Amazon S3 returns an Access Denied (`403 Forbidden`) error when you try to delete the object.
+
+  * **Simple`DELETE` request** – If you issued a simple `DELETE` request (a request that doesn't specify a version ID), Amazon S3 returns a `200 OK` response and inserts a [delete marker](./DeleteMarker.html) in the bucket, and that marker becomes the current version of the object with a new ID.
+
+
+