Versioning and Object Lock
Bucket versioning, Object Lock, default retention, and implications for deletion and backups.
Buckets can be created with Versioning and Object Lock on the Create Bucket modal (or configured via S3 API). Both affect how deletes work and how backup products use the bucket.
Versioning
When Enable Versioning is on:
Each overwrite creates a new version of the object.
Deletes may create delete markers instead of removing all versions.
The Bucket Browser Show object versions view lists versions and delete markers.
Versioning is required for some lifecycle actions on noncurrent versions. See Lifecycle rules.
Object Lock
When Enable Object Locking is on at bucket creation:
Objects (or versions) can have retention and legal hold.
Protected data cannot be deleted until retention expires and holds are cleared.
Buckets with active locks cannot be deleted until protections are resolved.
Default retention policy (at create)
Optional toggle: Set a default retention policy
Applies a default retention mode/duration to new objects when enabled.
Leave off when a backup product (e.g. Veeam) manages its own Object Lock per object.
Combining a bucket-level default retention with application-managed locks can cause unintended retention or cleanup failures. Follow your backup vendor’s Object Lock guidance.
Deletion impact
Versioning off
Delete removes the object.
Versioning on
Delete may add a delete marker; older versions remain until expired or deleted.
Object Lock
Versions under retention or legal hold cannot be deleted until eligible.
Cancel service
Buckets with blocking Object Lock may prevent full account cleanup.
See Cancel or delete the service and Buckets delete modal.
Browser behavior
With Object Lock enabled, the Bucket Browser may treat some versions as read-only and block delete actions on protected versions.
Backup product notes
Veeam — enable Object Lock on the bucket; do not enable default retention at bucket create. See Veeam guide.
General — confirm whether your app expects versioning, lock mode (Governance vs Compliance), and retention before enabling defaults.