Immutability: Compliance and Object Lock

Immutability prevents the modification or deletion of objects, throughout the storage lifetime. You can define immutability in Wasabi using the Compliance or Object Lock feature.

The Compliance and Object Lock immutability features are mutually exclusive. A bucket can have either Compliance or Object Lock, but not both features.

Either feature, Compliance or Object Lock, must be first enabled and then set (described below).

Compliance Overview

The compliance feature prevents the deletion of any objects and provides additional information to prove that the original data is not modified since the time it was stored. The compliance feature may be required for certain regulatory needs, but it is also useful to prevent accidental deletion. You can lock compliance mode on to prevent disabling it. However, once it is locked on, compliance mode cannot be unlocked without the intervention of Wasabi Customer Support. This restriction is for your data protection as part of Wasabi’s immutable bucket feature.

Use the compliance feature cautiously. Inappropriate use of this feature will restrict your ability to delete storage buckets and associated files, which will result in storage charges for these objects.

Object Lock Overview

The Object Lock feature prohibits modification, overwriting, or deletion of specific object versions during a configured retention period, which can be a fixed amount of time or indefinitely. Object lock is a method that can be used to achieve WORM or a form of airgapped storage. The retention setting can be specified on each object placed into a bucket. Additionally, bucket-level settings can be applied so that new objects placed in a bucket will have the default settings applied. 

Object locking must be enabled on a bucket (as described below) before you can use the functionality. You can enable object locking only during bucket creation. You cannot enable object locking on an existing bucket. Enabling object locking simply enables the ability to set a locking retention mode for the bucket and specific objects within the bucket. After you enable object locking (as described below), you can set object locking modes and retention as bucket settings.

If you create a bucket and do not select Object Locking, the bucket is created with Compliance enabled by default. The Object Locking and Compliance features are referenced as immutability, and these two types of immutability are mutually exclusive. A bucket can have either Object Locking or Compliance, but not both features. 

Enabling and Setting Immutability Features

Either feature, Compliance or Object Lock, must be first enabled and then set. Enabling either feature simply enables the ability to set the feature for the bucket. When the feature is enabled, you can set the feature with bucket settings.

• A bucket is created with Compliance enabled by default (unless the Object Lock feature was selected while creating the bucket).
  Instructions to set the Compliance feature are provided in Compliance: Enabling and Locking Compliance Mode.
• You can enable object lock on a bucket only during bucket creation. You cannot enable object lock on an existing bucket. If you create a bucket with object lock enabled, Compliance is disabled automatically and cannot be used.
  Instructions to enable the Object Lock feature are provided in Object Lock: Enabling, and instructions to set the feature are provided for bucket settings in Object Lock: Setting for a Bucket or Object, Disabling, and Applying a Legal Hold.

Refer also to Checking for Immutability (below).
You may also want to refer to immutability for Third-Party Integrations (below).

Compliance and Object Lock Differences

Checking for Immutability

Remember that either feature, Compliance or Object Lock, must be first enabled and then set. Enabling either feature simply enables the ability to set the feature for the bucket. When the feature is enabled, you can set the feature with bucket settings.

Determining If Compliance is Enabled

A bucket is created with Compliance enabled by default (unless the Object Lock feature was selected while creating the bucket).

1. In the Wasabi Console, navigate to your bucket.

   If compliance is enabled, you will see this in the Bucket Details:

   

2. Click the gear icon for Settings:

   

When compliance is enabled, bucket settings will have a Compliance tab:

Instructions to set the Compliance feature are provided in Compliance: Enabling and Locking Compliance Mode.

Determining If Object Lock is Enabled

1. In the Wasabi Console, navigate to your bucket.

   If object lock is enabled, you will see this in the Bucket Details:

   

2. Click the gear icon for Settings:

When object lock is enabled, bucket settings will have an Object Lock tab:

 Instructions to set the feature are provided in Bucket Settings: Object Lock.

 Checking Object Lock for a Specific Object

1. In the Wasabi Console, navigate to your bucket. 
2. Click the toggle to show versions.

   

3. Click on the object name. For example:

   

You can check the object lock status in the File Details. For example:

Third-Party Integrations

• Arcserve UDP
• Arcserve Cloud Console
• Arq Backup
• Atempo Miria
• Atempo Tina
• BackupAssist Classic
• BackupAssist ER
• Catalogic DPX
• Catalogic DPX vPlus
• Comet Enterprise Backup
• Commvault
• HornetSecurity VM Backup (Altaro VM Backup)
• HYCU
• Kasten K10
• Marquis Project Parking
• Marquis Workspace Backup
• MSP360
• Nakivo
• SEP sesam
• Veeam Object Lock Integration
• Veritas Backup Exec
• Veritas NetBackup
• Zerto