# S3 Object Lock

**What is S3 Object Lock?**

S3 Object Lock is a deletion lock for object storage: a stored file cannot be changed or deleted until a set date, not even with admin rights. For backups it means a copy an attacker cannot destroy.

In ransomware attacks the backups are found and deleted first. With Object Lock that step fails, even if the backup system's credentials were stolen.

The name comes from Amazon S3; many S3-compatible providers offer it today, including data centres in Austria and the EU. In compliance mode not even the provider can lift the lock early.

Object Lock does not replace a backup strategy. It is the last copy in a 3-2-1 setup, next to fast local snapshots, and the retention period has to fit the recovery plan.

## Related terms
- [Immutable backup](https://vetosec.at/en/it-security/unveraenderliche-sicherung/)
- [The 3-2-1 backup rule](https://vetosec.at/en/it-security/drei-zwei-eins-regel/)
- [Ransomware](https://vetosec.at/en/it-security/ransomware/)
- [Backup and restore](https://vetosec.at/en/it-security/backup-wiederherstellung/)

## Source
https://vetosec.at/en/it-security/s3-object-lock/ (vetosec, schutz)