# Choose S3 retention modes by the permitted override authority

> Decide who may override object retention before selecting an Object Lock mode.

- Canonical URL: https://update.dsesecurity.com/updates/choose-s3-retention-modes-by-the-permitted-override-authority/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:13:23+00:00
- Modified: 2026-10-20T18:34:28+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 2 minutes

## What you need to know

Decide who may override object retention before selecting an Object Lock mode.

## Potentially affected

This decision concerns retention authority for S3 object versions; writing a newer version is still possible.

## DSE recommendation

DSE recommends documenting the required retention outcome and the people permitted to override it before creating production policies.

## Article

Decide who may override object retention before selecting an Object Lock mode.

## Source facts

S3 Object Lock protects individual versions in versioned buckets. Compliance retention cannot be shortened or bypassed by an ordinary account user, including root. Governance retention permits an explicitly authorized bypass. A legal hold is independent of the retention period and remains until an authorized user removes it.

Source: [AWS Documentation](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock.html).

## Applicability

This decision concerns retention authority for S3 object versions; writing a newer version is still possible.

## DSE recommendation

DSE recommends documenting the required retention outcome and the people permitted to override it before creating production policies. Use a disposable bucket to evaluate governance behavior first. Separate retention administration from routine upload access and record the treatment of legal holds. Have the business owner approve irreversible retention choices and the storage implications. Keep the retained version identifier in recovery procedures so an operator does not mistake a newer object or a delete marker for loss of the protected version. Make the bypass approval specific to a version and business purpose. Ask reviewers to distinguish routine recovery from an early-deletion request, and include the remaining retention obligation in the handoff when staff ownership changes.

## Verification

Proposed verification: apply a short governance period to disposable data, compare deletion using routine and separately approved bypass identities, and inspect the protected version directly. Check legal-hold status separately. Record actual results without presenting this procedure as a completed compliance assessment.

## Official reference

[AWS Documentation](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock.html). Reviewed October 20, 2026.

## Primary reference

- Name: AWS Documentation
- Authority: docs.aws.amazon.com
- URL: https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock.html
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Choose S3 retention modes by the permitted override authority,” DSE Security, https://update.dsesecurity.com/updates/choose-s3-retention-modes-by-the-permitted-override-authority/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.