Versioning and object lock as in-place protection

Advanced⏱ ~18 minawsradosgw-admin

What you'll learn

Enable and manage versioning
Configure object lock retention
Manage the capacity that versioning consumes
Understand what object lock does and does not stop

Prerequisites

None — start here.

Verified against Ceph Tentacle 20.2.x · Ceph Squid 19.2.x (supported previous) · cephadm matches the verified Ceph release · podman 4.x · csi-rbd and csi-cephfs current · RBD / CephFS / RGW current (matches Ceph release) · Linux kernel 5.15+ (5.10 minimum) · Ubuntu 24.04 LTS (Ceph host baseline) · Debian 12 (Bookworm) (Ceph host baseline) · Rocky Linux / RHEL / AlmaLinux 9.x (Ceph host baseline) · Proxmox VE 9.x (cross-course integration) · Kubernetes 1.31+ (cross-course integration) · 2026-08-18

Why this matters in production

Versioning with object lock is the only mechanism that protects object data from an attacker holding valid credentials.

Versioning

aws --endpoint-url $EP s3api put-bucket-versioning --bucket acme-data \
  --versioning-configuration Status=Enabled
aws --endpoint-url $EP s3api get-bucket-versioning --bucket acme-data

# what a delete does in a versioned bucket
aws --endpoint-url $EP s3 rm s3://acme-data/report.pdf
aws --endpoint-url $EP s3api list-object-versions --bucket acme-data \
  --prefix report.pdf

A delete creates a delete marker. The prior version remains and is
recoverable by removing the marker.

# recover
DELETE_MARKER_VERSION_ID=12
aws --endpoint-url $EP s3api delete-object --bucket acme-data \
  --key report.pdf --version-id ${DELETE_MARKER_VERSION_ID}

Operation	In a versioned bucket
PUT over an existing key	previous version retained
DELETE	delete marker added; versions retained
DELETE with `--version-id`	that version permanently removed
Overwrite by ransomware	the original version remains

Object lock

# must be enabled at bucket creation, with versioning
aws --endpoint-url $EP s3api create-bucket --bucket audit-logs \
  --object-lock-enabled-for-bucket
aws --endpoint-url $EP s3api put-bucket-versioning --bucket audit-logs \
  --versioning-configuration Status=Enabled

aws --endpoint-url $EP s3api put-object-lock-configuration --bucket audit-logs \
  --object-lock-configuration '{
    "ObjectLockEnabled":"Enabled",
    "Rule":{"DefaultRetention":{"Mode":"COMPLIANCE","Days":2555}}}'

Mode	Behaviour
`GOVERNANCE`	retention can be bypassed by a principal with the bypass permission
`COMPLIANCE`	retention cannot be bypassed by anyone, including the account owner

aws --endpoint-url $EP s3api get-object-retention --bucket audit-logs \
  --key 2026/08/audit.log

COMPLIANCE mode is what actually resists a compromised administrator.
GOVERNANCE mode resists mistakes.

Capacity

Versioning means deletes and overwrites stop freeing space. Capacity
grows with total write volume rather than with current data.

radosgw-admin bucket stats --bucket=acme-data | python3 -c '
import sys,json
d = json.load(sys.stdin).get("usage", {})
for k, v in d.items():
    print("%-24s %10d obj  %9.2f GiB" %
          (k, v.get("num_objects",0), v.get("size_actual",0)/1024**3))'

rgw.main holds current versions; non-current versions and delete markers
appear in the usage breakdown too.

# lifecycle rules to expire non-current versions
aws --endpoint-url $EP s3api put-bucket-lifecycle-configuration \
  --bucket acme-data --lifecycle-configuration '{
    "Rules":[{"ID":"expire-noncurrent","Status":"Enabled",
              "Filter":{"Prefix":""},
              "NoncurrentVersionExpiration":{"NoncurrentDays":90}}]}'

radosgw-admin lc list
radosgw-admin lc get --bucket=acme-data

What object lock does not stop

Threat	Object lock
Object deletion	stopped for the retention period
Object overwrite	the prior version is retained and locked
Ransomware with valid keys	stopped — it cannot remove locked versions
Deleting the bucket	stopped while locked objects remain
Destroying the Ceph cluster	not stopped
Deleting the underlying pool	not stopped

Object lock is enforced by RGW, so it protects against the S3 API and
not against someone with cluster-level access.

Quiz

Knowledge check · 4 questions

Q1. What does object lock in COMPLIANCE mode protect against?

Deletions and overwrites through the S3 API for the retention period, including by a principal holding valid credentials — but not cluster-level access Cluster hardware failure, because locked objects are written with an extra replica and a stricter scrub schedule that survives the loss of an OSD or a whole host Loss of the Ceph cluster, because RGW records locked object versions in a separate store outside the data pools Bit rot, because a locked version is scrubbed more often than an ordinary object and repaired from its replicas
Q2. Versioning makes bucket capacity track current data size.

True False
Q3. Protect a bucket against ransomware.

An application writes to an RGW bucket with credentials stored on the application host. The concern is a compromise of that host encrypting the bucket contents.
Q4. What happens to an object when it is deleted from a versioned bucket?

Passing score: 75%. Answers are checked in this browser.

Production discipline

Use COMPLIANCE mode object lock where the threat is a compromised credential — GOVERNANCE mode can be bypassed by a principal with the bypass permission. Add lifecycle rules expiring non-current versions; versioning makes capacity track write volume rather than data size.

Cross-course references

Kubernetes: immutable ConfigMaps prevent modification but not namespace deletion
Linux: immutability enforced at one layer says nothing about the layer beneath