{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/choose-s3-retention-modes-by-the-permitted-override-authority/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/choose-s3-retention-modes-by-the-permitted-override-authority/",
        "slug": "choose-s3-retention-modes-by-the-permitted-override-authority",
        "url": "https://update.dsesecurity.com/updates/choose-s3-retention-modes-by-the-permitted-override-authority/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/choose-s3-retention-modes-by-the-permitted-override-authority.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/choose-s3-retention-modes-by-the-permitted-override-authority/"
        },
        "title": "Choose S3 retention modes by the permitted override authority",
        "summary": "Decide who may override object retention before selecting an Object Lock mode.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "cyber-defense",
            "label": "Cyber defense",
            "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-10-20T18:13:23+00:00",
        "modified_at": "2026-10-20T18:34:28+00:00",
        "reviewed_on": "2026-10-20",
        "reading_minutes": 2,
        "word_count": 245,
        "potentially_affected": "This decision concerns retention authority for S3 object versions; writing a newer version is still possible.",
        "dse_recommendation": "DSE recommends documenting the required retention outcome and the people permitted to override it before creating production policies.",
        "primary_source": {
            "name": "AWS Documentation",
            "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock.html",
            "published_on": null,
            "authority": "docs.aws.amazon.com"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p>Decide who may override object retention before selecting an Object Lock mode.</p>\n<h2>Source facts</h2>\n<p>S3 Object Lock protects individual versions in versioned buckets. Compliance retention cannot be shortened or bypassed by an ordinary account user, including root. Governance retention permits an explicitly authorized bypass. A legal hold is independent of the retention period and remains until an authorized user removes it.</p>\n<p>Source: <a href=\"https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock.html\">AWS Documentation</a>.</p>\n<h2>Applicability</h2>\n<p>This decision concerns retention authority for S3 object versions; writing a newer version is still possible.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends documenting the required retention outcome and the people permitted to override it before creating production policies. Use a disposable bucket to evaluate governance behavior first. Separate retention administration from routine upload access and record the treatment of legal holds. Have the business owner approve irreversible retention choices and the storage implications. Keep the retained version identifier in recovery procedures so an operator does not mistake a newer object or a delete marker for loss of the protected version. Make the bypass approval specific to a version and business purpose. Ask reviewers to distinguish routine recovery from an early-deletion request, and include the remaining retention obligation in the handoff when staff ownership changes.</p>\n<h2>Verification</h2>\n<p>Proposed verification: apply a short governance period to disposable data, compare deletion using routine and separately approved bypass identities, and inspect the protected version directly. Check legal-hold status separately. Record actual results without presenting this procedure as a completed compliance assessment.</p>\n<h2>Official reference</h2>\n<p><a href=\"https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock.html\">AWS Documentation</a>. Reviewed October 20, 2026.</p>",
        "content_text": "Decide who may override object retention before selecting an Object Lock mode.\nSource facts\nS3 Object Lock protects individual versions in versioned buckets. Compliance retention cannot be shortened or bypassed by an ordinary account user, including root. Governance retention permits an explicitly authorized bypass. A legal hold is independent of the retention period and remains until an authorized user removes it.\nSource: AWS Documentation.\nApplicability\nThis decision concerns retention authority for S3 object versions; writing a newer version is still possible.\nDSE recommendation\nDSE recommends documenting the required retention outcome and the people permitted to override it before creating production policies. Use a disposable bucket to evaluate governance behavior first. Separate retention administration from routine upload access and record the treatment of legal holds. Have the business owner approve irreversible retention choices and the storage implications. Keep the retained version identifier in recovery procedures so an operator does not mistake a newer object or a delete marker for loss of the protected version. Make the bypass approval specific to a version and business purpose. Ask reviewers to distinguish routine recovery from an early-deletion request, and include the remaining retention obligation in the handoff when staff ownership changes.\nVerification\nProposed verification: apply a short governance period to disposable data, compare deletion using routine and separately approved bypass identities, and inspect the protected version directly. Check legal-hold status separately. Record actual results without presenting this procedure as a completed compliance assessment.\nOfficial reference\nAWS Documentation. Reviewed October 20, 2026.",
        "content_markdown": "Decide who may override object retention before selecting an Object Lock mode.\n\n## Source facts\n\nS3 Object Lock protects individual versions in versioned buckets. Compliance retention cannot be shortened or bypassed by an ordinary account user, including root. Governance retention permits an explicitly authorized bypass. A legal hold is independent of the retention period and remains until an authorized user removes it.\n\nSource: [AWS Documentation](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock.html).\n\n## Applicability\n\nThis decision concerns retention authority for S3 object versions; writing a newer version is still possible.\n\n## DSE recommendation\n\nDSE recommends documenting the required retention outcome and the people permitted to override it before creating production policies. Use a disposable bucket to evaluate governance behavior first. Separate retention administration from routine upload access and record the treatment of legal holds. Have the business owner approve irreversible retention choices and the storage implications. Keep the retained version identifier in recovery procedures so an operator does not mistake a newer object or a delete marker for loss of the protected version. Make the bypass approval specific to a version and business purpose. Ask reviewers to distinguish routine recovery from an early-deletion request, and include the remaining retention obligation in the handoff when staff ownership changes.\n\n## Verification\n\nProposed verification: apply a short governance period to disposable data, compare deletion using routine and separately approved bypass identities, and inspect the protected version directly. Check legal-hold status separately. Record actual results without presenting this procedure as a completed compliance assessment.\n\n## Official reference\n\n[AWS Documentation](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock.html). Reviewed October 20, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/choose-s3-retention-modes-by-the-permitted-override-authority/",
                "url": "https://update.dsesecurity.com/updates/choose-s3-retention-modes-by-the-permitted-override-authority/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-10-20"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/choose-s3-retention-modes-by-the-permitted-override-authority/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Cybersecurity",
                        "item": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 3,
                        "name": "Choose S3 retention modes by the permitted override authority",
                        "item": "https://update.dsesecurity.com/updates/choose-s3-retention-modes-by-the-permitted-override-authority/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/choose-s3-retention-modes-by-the-permitted-override-authority/#article",
                "identifier": "https://update.dsesecurity.com/updates/choose-s3-retention-modes-by-the-permitted-override-authority/",
                "url": "https://update.dsesecurity.com/updates/choose-s3-retention-modes-by-the-permitted-override-authority/",
                "headline": "Choose S3 retention modes by the permitted override authority",
                "description": "Decide who may override object retention before selecting an Object Lock mode.",
                "abstract": "Decide who may override object retention before selecting an Object Lock mode.",
                "articleBody": "Decide who may override object retention before selecting an Object Lock mode.\nSource facts\nS3 Object Lock protects individual versions in versioned buckets. Compliance retention cannot be shortened or bypassed by an ordinary account user, including root. Governance retention permits an explicitly authorized bypass. A legal hold is independent of the retention period and remains until an authorized user removes it.\nSource: AWS Documentation.\nApplicability\nThis decision concerns retention authority for S3 object versions; writing a newer version is still possible.\nDSE recommendation\nDSE recommends documenting the required retention outcome and the people permitted to override it before creating production policies. Use a disposable bucket to evaluate governance behavior first. Separate retention administration from routine upload access and record the treatment of legal holds. Have the business owner approve irreversible retention choices and the storage implications. Keep the retained version identifier in recovery procedures so an operator does not mistake a newer object or a delete marker for loss of the protected version. Make the bypass approval specific to a version and business purpose. Ask reviewers to distinguish routine recovery from an early-deletion request, and include the remaining retention obligation in the handoff when staff ownership changes.\nVerification\nProposed verification: apply a short governance period to disposable data, compare deletion using routine and separately approved bypass identities, and inspect the protected version directly. Check legal-hold status separately. Record actual results without presenting this procedure as a completed compliance assessment.\nOfficial reference\nAWS Documentation. Reviewed October 20, 2026.",
                "datePublished": "2026-10-20T18:13:23+00:00",
                "dateModified": "2026-10-20T18:34:28+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/choose-s3-retention-modes-by-the-permitted-override-authority/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/choose-s3-retention-modes-by-the-permitted-override-authority/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Choose S3 retention modes by the permitted override authority"
                },
                "articleSection": [
                    "Cybersecurity",
                    "IT"
                ],
                "keywords": [
                    "Cybersecurity",
                    "IT",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    }
                ],
                "wordCount": 245,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "AWS Documentation",
                    "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock.html"
                }
            }
        ]
    }
}