S3 Object Lock governance mode has a console override

Your S3 archive has a lock. The console has the override

Why it matters

“Locked” sounds final until the person with the right IAM permission opens the S3 console. Governance mode protects an object version from ordinary deletion, but the power to bypass that retention is a grantable permission. The archive's real constitution sits in the access policy.

Mara Voss2 November 2026 at 15:34 UTCReading Time 2 minLast update: 2 November 2026

A delegated exit beside a harder retention promise. Conceptual illustration.

Summary

S3 Object Lock governance mode protects a version until its retention date, except that a principal with s3:BypassGovernanceRetention can override it with an explicit bypass signal. The S3 console adds that signal for a user who holds the permission.
Compliance mode does not offer that override during the retention period. A legal hold is a separate protection and survives a governance bypass.

The key is in the access policy

Someone tells the board that the archive cannot be deleted. That sentence may describe a retention setting, a permission design, or a hope. In S3 governance mode, ordinary users cannot delete a protected object version or shorten its retention. A user granted s3:BypassGovernanceRetention can. The API requires an explicit bypass indication; AWS says its console supplies the header automatically when the user has the permission. The interface therefore makes the exception easy to exercise precisely for the people allowed to exercise it.

The unit of protection is the version. Writing another object with the same key creates another version; a delete marker can make the key look absent while the protected version remains. A screen showing an empty current view is not proof that the archived version was destroyed. Check the version and its retention state, then check which principals can bypass governance. Those are two different questions, and the second is usually the more political one.

AWS also offers compliance mode: during the retention period even the account root cannot shorten the deadline or delete the protected version. That is a much harder promise, with a correspondingly harder exit. An independent legal hold can keep a version protected after a retention period or a governance bypass; it can be removed by someone with s3:PutObjectLegalHold. And neither retention mode restores data whose encryption key is gone. The word “immutable” cannot carry those separate decisions by itself.

Governance mode has a legitimate market: teams that want protection against routine mistakes while retaining an emergency exit. The price of that flexibility is an authority map. The next audit should name every principal with the bypass permission and show a version-level test. If the buyer expects a lock no administrator can undo during its term, the purchase specification must say compliance mode, not merely Object Lock.