{"type":"doc","content":[{"type":"paragraph","content":[{"text":"This guide presents the steps required for configuring and using the S3 Object Locking feature using curl and the AWS CLI.","type":"text"}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{"minLevel":{"value":"1"},"maxLevel":{"value":"7"}},"macroMetadata":{"macroId":{"value":"086f8e0b9be1ba84956297410d20fd81"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"b18af041-c209-4de7-80eb-2d34d73a5da2"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"Prerequisites","type":"text"}]},{"type":"paragraph","content":[{"text":"Before proceeding with configuring object locking please perform the following steps","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Make sure you have a Swarm 14.0+ cluster with a search feed pointing to an Elasticsearch 7+ cluster; also make sure to issue the requests in this guide through a Content Gateway 7.6 or higher.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create a tenant, a domain in that tenant and a bucket, using either the Content UI or the Content Gateway’s Management API, as follows:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create a tenant.","type":"text"}]},{"type":"codeBlock","content":[{"text":"curl -XPUT -i -u caringoadmin:caringo \"http://192.168.8.109:9090/_admin/manage/tenants/example.tenant.com\"","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create a domain within that tenant.","type":"text"}]},{"type":"codeBlock","content":[{"text":"curl -XPUT -i -u caringoadmin:caringo \"http://192.168.8.109:9090/_admin/manage/tenants/example.tenant.com/domains/locking.example.com\"","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create a bucket in the domain.","type":"text"}]},{"type":"codeBlock","content":[{"text":"curl -XPUT -i -u caringoadmin:caringo \"http://192.168.8.109:9090/_admin/manage/tenants/example.tenant.com/domains/locking.example.com/buckets/b1\"","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Enable versioning at the cluster-level. You can do that through the swarmctl utility available in our support bundle ","type":"text"},{"text":"https://support.cloud.datacore.com/tools/swarm-support-tools.tgz","type":"text","marks":[{"type":"link","attrs":{"href":"https://support.cloud.datacore.com/tools/swarm-support-tools.tgz"}}]},{"text":", by running the following command from within the dist/ folder.","type":"text"}]},{"type":"codeBlock","content":[{"text":"./swarmctl -C policy.versioning -V \"allowed\" -d ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Enable versioning for the newly created domain.","type":"text"}]},{"type":"codeBlock","content":[{"text":"curl -XCOPY -i -H \"Policy-Versioning: enabled\" -u caringoadmin:caringo \"http://192.168.8.109:9090?domain=locking.example.com&preserve\"","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Enable versioning for the newly created bucket.","type":"text"}]},{"type":"codeBlock","content":[{"text":"curl -XCOPY -i -H \"Policy-Versioning: enabled\" -u caringoadmin:caringo \"http://192.168.8.109:9090/b1?domain=locking.example.com&preserve\"","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In order to use the S3 API, create an S3 token for the user that’s going to manage object locking on the bucket. In the following examples, that role will be played by ","type":"text"},{"text":"someuser","type":"text","marks":[{"type":"em"}]},{"text":". Write down the token UUID outputted by the request below which will be your S3 AWS_ACCESS_KEY_ID and the secret that you’ve configured for this token, which will be your S3 AWS_SECRET_ACCESS_KEY.","type":"text"}]},{"type":"codeBlock","content":[{"text":"curl -H \"x-user-secret-key-meta: somesecret\" -H \"x-user-token-expires-meta: +365\" -H 'x-owner-meta: someuser' -XPOST \"http://192.168.8.109:9090/.TOKEN/?domain=locking.example.com\" -u caringoadmin:caringo","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The user that will manage object locking on the bucket needs to be either the bucket’s owner or a user with admin-level permissions for that bucket. The following requests grant all privileges on the bucket to ","type":"text"},{"text":"someuser","type":"text","marks":[{"type":"em"}]},{"text":", which is the user that we’re going to employ in the next steps.","type":"text"}]},{"type":"codeBlock","content":[{"text":"curl -XPUT -u caringoadmin:caringo -H \"Content-Type: application/json+policy\" \"http://192.168.8.109:9090/b1?domain=locking.example.com&policy\" --data-binary '{\n \"Version\": \"2008-10-17\",\n \"Id\": \"Unnamed Policy\",\n \"Statement\": [\n {\n \"Sid\": \"1: Custom\",\n \"Effect\": \"Allow\",\n \"Principal\": {\n \"user\": [\n \"someuser\"\n ],\n \"group\": []\n },\n \"Action\": [\n \"*\"\n ],\n \"Resource\": \"*\"\n }\n ]\n }'","type":"text"}]}]}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"All the above steps need to be performed by an user that has the required administrative permissions at the tenant, domain and bucket levels. In these examples the requests were issued by the ","type":"text"},{"text":"caringoadmin ","type":"text","marks":[{"type":"em"}]},{"text":"user which is configured as the root-level admin user. ","type":"text"}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Configuring Object Locking through the SCSP API","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"A. Enabling object locking on the bucket and all subsequently created objects","type":"text"}]},{"type":"paragraph","content":[{"text":"In this case, the object locking parameters that you will apply through the following request will be automatically applied to all the objects that you write onwards, ","type":"text"},{"text":"unless","type":"text","marks":[{"type":"strong"}]},{"text":" you explicitly set the object-locking headers when writing an object. In the latter case, Gateway will always use the maximum of either the bucket default retention duration or the duration specified in a per-object request.","type":"text"}]},{"type":"paragraph","content":[{"text":"Enabling object-locking at the bucket level through SCSP","type":"text","marks":[{"type":"strong"}]},{"text":" requires the following steps:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Do a PUT ","type":"text"},{"text":"/?","type":"text","marks":[{"type":"code"}]},{"text":"objectlock= [ : ]","type":"text","marks":[{"type":"strong"}]},{"text":" where","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"defaultmode","type":"text","marks":[{"type":"code"}]},{"text":" can be either \"governance\" or \"compliance\"","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"defaultperiod","type":"text","marks":[{"type":"code"}]},{"text":" is optional; it is a number of years (y) or days (d), eg. ","type":"text"},{"text":"1y","type":"text","marks":[{"type":"code"}]},{"text":" or ","type":"text"},{"text":"20d","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"codeBlock","content":[{"text":"curl --location-trusted -i -XPUT \"http://192.168.8.109:9090/b1?domain=locking.example.com&objectlock=compliance:20d\" -u someuser:caringo","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"(Optional) ","type":"text","marks":[{"type":"em"}]},{"text":"Check that object-locking was enabled at the bucket level by issuing a","type":"text"},{"text":" ","type":"text","marks":[{"type":"em"}]},{"text":"GET /?","type":"text","marks":[{"type":"code"}]},{"text":"objectlock ","type":"text","marks":[{"type":"strong"}]},{"text":"and checking that the following headers exist and that the response body says: ","type":"text"},{"text":"Object locking is enabled on bucket","type":"text","marks":[{"type":"code"}]}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"x-object-lock-meta-status: ENABLED","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"(Optionally)","type":"text","marks":[{"type":"em"}]},{"text":" ","type":"text"},{"text":"x-object-lock-meta-default: [:]","type":"text","marks":[{"type":"code"}]}]},{"type":"codeBlock","content":[{"text":"curl --location-trusted -i \"http://192.168.8.109:9090/b1?domain=locking.example.com&objectlock\" -u someuser:caringo\nHTTP/1.1 200 OK\nDate: Mon, 25 Oct 2021 06:37:33 GMT\nGateway-Request-Id: 55C57E6997420CD2\nServer: CAStor Cluster/14.0.0\nVia: 1.1 192.168.8.109 (Cloud Gateway SCSP/7.6.0)\nGateway-Protocol: scsp\nX-Object-Lock-Meta-Status: ENABLED\nContent-Length: 39\n\nObject locking is enabled on bucket b1","type":"text"}]}]}]}]}]},{"type":"paragraph","content":[{"text":"All the objects that you write/modify after this, will have the bucket-level object-locking specification automatically applied to them. To verify this do the following:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create a new object in the bucket.","type":"text"}]},{"type":"codeBlock","content":[{"text":"curl --location-trusted -i -XPOST --data-binary 'test' \"http://192.168.8.109:9090/b1/file1?domain=locking.example.com\" -u someuser:caringo","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Make sure the object is locked according to the locking configuration defined at the bucket level, namely that it has the following headers:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"X-Object-Lock-Meta-Mode: COMPLIANCE","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"X-Object-Lock-Meta-Retain-until-date: ","type":"text","marks":[{"type":"code"}]}]},{"type":"codeBlock","content":[{"text":"curl --location-trusted -I \"http://192.168.8.109:9090/b1/file1?domain=locking.example.com\" -u someuser:caringo\nHTTP/1.1 200 OK\nDate: Fri, 22 Oct 2021 08:48:16 GMT\nGateway-Request-Id: 09EC017DBBD195E6\nServer: CAStor Cluster/14.0.0\nVia: 1.1 192.168.8.109 (Cloud Gateway SCSP/7.6.0)\nGateway-Protocol: scsp\nCastor-System-CID: e5c51ad561fcc0f361dd7c941a004ce6\nCastor-System-Cluster: swarm.demo.internal\nCastor-System-Created: Fri, 22 Oct 2021 08:46:39 GMT\nCastor-System-IsVersioned: True\nCastor-System-Name: file1\nCastor-System-Version: 1634892399.199\nContent-Type: application/x-www-form-urlencoded\nLast-Modified: Fri, 22 Oct 2021 08:46:39 GMT\nX-Last-Modified-By-Meta: someuser@\nX-Owner-Meta: someuser\nETag: \"ba2263c7ff58ebc15526fbafc1076787\"\nCastor-System-Path: /locking.example.com/b1/file1\nCastor-System-Domain: locking.example.com\nVolume: fdd5be4d6b82c11a9c68e89106281fa4\nContent-MD5: CY9rzUYh03PK3k6DJie09g==\nX-Object-Lock-Meta-Mode: COMPLIANCE\nX-Object-Lock-Meta-Retain-until-date: Thu, 11 Nov 2021 08:46:38 GMT\nContent-Length: 4","type":"text"}]}]}]}]}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"B. Enabling object locking on the bucket without automatically setting it on the objects written afterwards.","type":"text"}]},{"type":"paragraph","content":[{"text":"For users that want object locking enabled on the bucket, but not automatically applied to all subsequently created objects/versions, the following request needs to be performed.","type":"text"}]},{"type":"codeBlock","content":[{"text":"curl --location-trusted -i -XPUT \"http://192.168.8.109:9090/b1?domain=locking.example.com&objectlock=\" -u someuser:caringo","type":"text"}]},{"type":"paragraph","content":[{"text":"In order to verify that object-locking is not automatically set on a new object (","type":"text"},{"text":"i.e. new objects are unlocked unless the user explicitly locks them when creating them","type":"text","marks":[{"type":"strong"}]},{"text":") do the following:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create a new object.","type":"text"}]},{"type":"codeBlock","content":[{"text":"curl --location-trusted -i -XPOST --data-binary 'test' \"http://192.168.8.109:9090/b1/file2?domain=locking.example.com\" -u someuser:caringo","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Check that it ","type":"text"},{"text":"does not","type":"text","marks":[{"type":"strong"}]},{"text":" have the ","type":"text"},{"text":"X-Object-Lock-Meta-Mode","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":"X-Object-Lock-Meta-Retain-until-date","type":"text","marks":[{"type":"code"}]},{"text":" headers.","type":"text"}]},{"type":"codeBlock","content":[{"text":"curl --location-trusted -I \"http://192.168.8.109:9090/b1/file2?domain=locking.example.com\" -u someuser:caringo\nHTTP/1.1 200 OK\nDate: Fri, 22 Oct 2021 08:56:10 GMT\nGateway-Request-Id: 36555A75CE064B5C\nServer: CAStor Cluster/14.0.0\nVia: 1.1 192.168.8.109 (Cloud Gateway SCSP/7.6.0)\nGateway-Protocol: scsp\nCastor-System-CID: e5c51ad561fcc0f361dd7c941a004ce6\nCastor-System-Cluster: swarm.demo.internal\nCastor-System-Created: Fri, 22 Oct 2021 08:53:31 GMT\nCastor-System-IsVersioned: True\nCastor-System-Name: file2\nCastor-System-Version: 1634892811.229\nContent-Type: application/x-www-form-urlencoded\nLast-Modified: Fri, 22 Oct 2021 08:53:31 GMT\nX-Last-Modified-By-Meta: someuser@\nX-Owner-Meta: someuser\nETag: \"321375af02fecb94ca33dee20aa17f0c\"\nCastor-System-Path: /locking.example.com/b1/file2\nCastor-System-Domain: locking.example.com\nVolume: eb4715ce21e9a8a20e0b4397bdc825d5\nContent-MD5: CY9rzUYh03PK3k6DJie09g==\nContent-Length: 4","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"At this point ","type":"text"},{"text":"you can create another object for which you can define your object-locking","type":"text","marks":[{"type":"strong"}]},{"text":" parameters of choice by setting the ","type":"text"},{"text":"X-Object-Lock-Meta-Mode","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":"X-Object-Lock-Meta-Retain-until-date","type":"text","marks":[{"type":"code"}]},{"text":" headers, as follows:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create the object, making sure to set the aforementioned headers.","type":"text"}]},{"type":"codeBlock","content":[{"text":"curl --location-trusted -i -XPOST --data-binary 'test' -H \"x-object-lock-meta-mode: COMPLIANCE\" -H \"x-object-lock-meta-retain-until-date: Sat, 23 Oct 2021 08:53:31 GMT\" \"http://192.168.8.109:9090/b1/file3?domain=locking.example.com\" -u someuser:caringo","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Make sure that the object has the 2 headers, ","type":"text"},{"text":"namely that it is locked.","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"curl --location-trusted -I \"http://192.168.8.109:9090/b1/file3?domain=locking.example.com\" -u someuser:caringo HTTP/1.1 200 OK\nDate: Fri, 22 Oct 2021 09:04:09 GMT\nGateway-Request-Id: DE2913658216FD69\nServer: CAStor Cluster/14.0.0\nVia: 1.1 192.168.8.109 (Cloud Gateway SCSP/7.6.0)\nGateway-Protocol: scsp\nCastor-System-CID: e5c51ad561fcc0f361dd7c941a004ce6\nCastor-System-Cluster: swarm.demo.internal\nCastor-System-Created: Fri, 22 Oct 2021 09:03:32 GMT\nCastor-System-IsVersioned: True\nCastor-System-Name: file3\nCastor-System-Version: 1634893412.164\nContent-Type: application/x-www-form-urlencoded\nLast-Modified: Fri, 22 Oct 2021 09:03:32 GMT\nX-Last-Modified-By-Meta: someuser@\nX-Owner-Meta: someuser\nETag: \"b7bf6149bf811e057f2006b58e6dbbae\"\nCastor-System-Path: /locking.example.com/b1/file3\nCastor-System-Domain: locking.example.com\nVolume: eb4715ce21e9a8a20e0b4397bdc825d5\nContent-MD5: CY9rzUYh03PK3k6DJie09g==\nX-Object-Lock-Meta-Mode: COMPLIANCE\nX-Object-Lock-Meta-Retain-until-date: Sat, 23 Oct 2021 08:53:31 GMT\nContent-Length: 4","type":"text"}]}]}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"C. Enabling legal hold for a newly written object","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Enabling legal hold on a newly created object requires setting the ","type":"text"},{"text":"x-object-lock-meta-legal-hold: ON","type":"text","marks":[{"type":"code"}]},{"text":" header when writing the object. For this particular use case, you need to perform the following steps:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Write the object with the aforementioned header.","type":"text"}]},{"type":"codeBlock","content":[{"text":"curl --location-trusted -i -XPOST --data-binary 'test' -H \"x-object-lock-meta-legal-hold: ON\" \"http://192.168.8.109:9090/b1/file8?domain=locking.example.com\" -u someuser:caringo","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Check that legal hold was applied on the object by issuing a HEAD request and confirming the presence of the following headers:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"X-Object-Lock-Meta-Legal-Hold: ON","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Lifepoint: [] deletable=no","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"X-Object-Lock-Meta-Original-Lifepoints: ","type":"text","marks":[{"type":"code"}]}]},{"type":"codeBlock","content":[{"text":"curl --location-trusted -I \"http://192.168.209.84/b1/file8?domain=locking.example.com\"\nHTTP/1.1 301 Moved Permanently\nDate: Mon, 25 Oct 2021 07:04:42 GMT\nServer: CAStor Cluster/14.0.0\nLocation: http://192.168.209.85:80/b1/file8?domain=locking.example.com&auth=b5bd5c429a3366969d5b57f0e2cba0cb\nContent-Length: 0\nKeep-Alive: timeout=14400\n\nHTTP/1.1 200 OK\nCastor-System-CID: e5c51ad561fcc0f361dd7c941a004ce6\nCastor-System-Cluster: swarm.demo.internal\nCastor-System-Created: Mon, 25 Oct 2021 07:04:28 GMT\nCastor-System-IsVersioned: True\nCastor-System-Name: file8\nCastor-System-Version: 1635145468.896\nContent-Length: 4\nContent-Type: application/x-www-form-urlencoded\nLast-Modified: Mon, 25 Oct 2021 07:04:28 GMT\nLifepoint: [] deletable=no\nX-Last-Modified-By-Meta: someuser@\nX-Object-Lock-Meta-Legal-Hold: ON\nX-Object-Lock-Meta-Original-Lifepoints:\nX-Owner-Meta: someuser\nEtag: \"c52c8d4ee80b6a86b74eb95caf449582\"\nCastor-System-Path: /locking.example.com/b1/file8\nCastor-System-Domain: locking.example.com\nVolume: c613440c53abae81420b93211625b54b\nContent-MD5: CY9rzUYh03PK3k6DJie09g==\nDate: Mon, 25 Oct 2021 07:04:42 GMT\nServer: CAStor Cluster/14.0.0\nKeep-Alive: timeout=14400","type":"text"}]}]}]}]}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"D. Managing the retention settings of an existing object","type":"text","marks":[{"type":"strong"}]}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"Managing the retention and/or legal-hold settings of an existing object is done on particular versions of that object, so the request will need to specify the version for which the retention and/or legal-hold settings are changed using the ","type":"text"},{"text":"?version=","type":"text","marks":[{"type":"code"}]},{"text":" query argument. One needs to also take into account the specific permissions and limitations as mentioned in ","type":"text"},{"type":"inlineCard","attrs":{"url":"https://caringo.atlassian.net/wiki/spaces/public/pages/2859925505"}},{"text":" ","type":"text"}]}]},{"type":"paragraph","content":[{"text":"The workflow for managing the retention settings of an existing object is generally the following (","type":"text"},{"text":"in these examples we will use an object for which no object locking was set, stored in a bucket that has object-locking enabled, but not enforced, namely X-Object-Lock-Meta-Retain-until-date is not set on the bucket","type":"text","marks":[{"type":"em"}]},{"text":"):","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"List the versions, noting the hash field returned by the listing requests, which is the versionId/etag of that particular version.","type":"text"}]},{"type":"codeBlock","content":[{"text":"curl --location-trusted -s \"http://192.168.8.109:9090/b1?domain=locking.example.com&format=json&versions&name=file2&sort=tmborn:DESC,etag:DESC\" -u someuser:caringo\n[\n{\"last_modified\": \"2021-10-25T09:10:45.768000Z\", \"bytes\": 8, \"versioned\": \"true\", \"name\": \"file2\", \"hash\": \"5823fac0dd0f21e32026c3ff1291c104\", \"written\": \"2021-10-25T09:10:45.768000Z\", \"accessed\": \"2021-10-25T09:10:45.768000Z\", \"content_type\": \"application/x-www-form-urlencoded\"},\n{\"last_modified\": \"2021-10-22T08:53:31.228000Z\", \"bytes\": 4, \"versioned\": \"true\", \"name\": \"file2\", \"hash\": \"321375af02fecb94ca33dee20aa17f0c\", \"written\": \"2021-10-22T08:53:31.228000Z\", \"accessed\": \"2021-10-22T08:53:31.228000Z\", \"content_type\": \"application/x-www-form-urlencoded\", \"version\": \"321375af02fecb94ca33dee20aa17f0c\"}\n]","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set your desired lock (governance | compliance) and the retention period on one of the versions. In this example, we will set a governance lock with a retention period of 30 days. This is done through the ","type":"text"},{"text":"?objectlock=governance:30d","type":"text","marks":[{"type":"code"}]},{"text":" query argument.","type":"text"}]},{"type":"codeBlock","content":[{"text":"curl --location-trusted -i -XPUT \"http://192.168.8.109:9090/b1/fileA1?domain=locking.example.com&version=18e9adfcfc2b102e05162fe1633118f1&objectlock=governance:30d\" -u someuser:caringo","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Try to remove the governance lock, making sure to set the ","type":"text"},{"text":"x-object-lock-meta-bypass-governance-retention: true","type":"text","marks":[{"type":"code"}]},{"text":" header and the ","type":"text"},{"text":"?objectlock=retention","type":"text","marks":[{"type":"code"}]},{"text":" query argument.","type":"text"}]},{"type":"codeBlock","content":[{"text":"curl --location-trusted -i -XDELETE -H \"x-object-lock-meta-bypass-governance-retention: true\" \"http://192.168.8.109:9090/b1/fileA1?domain=locking.example.com&version=18e9adfcfc2b102e05162fe1633118f1&objectlock=retention\" -u someuser:caringo","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set the version’s locking to compliance with a retention period of 40 days.","type":"text"}]},{"type":"codeBlock","content":[{"text":"curl --location-trusted -i -XPUT \"http://192.168.8.109:9090/b1/fileA1?domain=locking.example.com&version=18e9adfcfc2b102e05162fe1633118f1&objectlock=compliance:40d\" -u someuser:caringo","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Try to reduce the retention period to 30 days, confirming that this is not allowed.","type":"text"}]},{"type":"codeBlock","content":[{"text":"curl --location-trusted -i -XPUT \"http://192.168.8.109:9090/b1/fileA1?domain=locking.example.com&version=18e9adfcfc2b102e05162fe1633118f1&objectlock=compliance:30d\" -u someuser:caringo\nHTTP/1.1 403 Forbidden\nDate: Mon, 25 Oct 2021 11:44:58 GMT\nGateway-Request-Id: 3CAEFC561F5AB1D8\nServer: CAStor Cluster/14.0.0\nVia: 1.1 192.168.8.109 (Cloud Gateway SCSP/7.6.0)\nGateway-Protocol: scsp\nContent-Length: 44\n\nCannot shorten compliance retention period","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Try to increase the retention period to 50 days, which is allowed.","type":"text"}]},{"type":"codeBlock","content":[{"text":"curl --location-trusted -i -XPUT \"http://192.168.8.109:9090/b1/fileA1?domain=locking.example.com&version=18e9adfcfc2b102e05162fe1633118f1&objectlock=compliance:50d\" -u someuser:caringo","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Check the version’s locking status through a GET request that includes the ","type":"text"},{"text":"?objectlock","type":"text","marks":[{"type":"code"}]},{"text":" argument.","type":"text"}]},{"type":"codeBlock","content":[{"text":"curl --location-trusted -i \"http://192.168.8.109:9090/b1/fileA1?domain=locking.example.com&version=18e9adfcfc2b102e05162fe1633118f1&objectlock\" -u someuser:caringo\nHTTP/1.1 200 OK\nDate: Mon, 25 Oct 2021 11:45:13 GMT\nGateway-Request-Id: 36EC45858BA0A0F5\nServer: CAStor Cluster/14.0.0\nVia: 1.1 192.168.8.109 (Cloud Gateway SCSP/7.6.0)\nGateway-Protocol: scsp\nX-Object-Lock-Meta-Mode: COMPLIANCE\nX-Object-Lock-Meta-Retain-until-date: Tue, 14 Dec 2021 11:45:09 GMT\nContent-Length: 72\n\nObject is locked in COMPLIANCE mode until Tue, 14 Dec 2021 11:45:09 GMT","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Change the bucket’s locking mode to compliance with a retention period that is less than what we’ve set for the object at step 6 (e.g. 30 days).","type":"text"}]},{"type":"codeBlock","content":[{"text":"curl --location-trusted -i -XPUT \"http://192.168.8.109:9090/b1?domain=locking.example.com&objectlock=compliance:30d\" -u someuser:caringo","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Try to change the version’s locking mode to compliance, without specifying the retention (i.e. use this query argument ","type":"text"},{"text":"?objectlock=compliance","type":"text","marks":[{"type":"code"}]},{"text":"), which means that it should inherit the retention set at the bucket level. Since at the bucket level we have set retention of 30 days, which is less than the 50 days that the version currently has, this request should fail:","type":"text"}]},{"type":"codeBlock","content":[{"text":"curl --location-trusted -i -XPUT \"http://192.168.8.109:9090/b1/fileA1?domain=locking.example.com&version=18e9adfcfc2b102e05162fe1633118f1&objectlock=compliance\" -u someuser:caringo\nHTTP/1.1 403 Forbidden\nDate: Mon, 25 Oct 2021 12:07:00 GMT\nGateway-Request-Id: 85349B63D10C25CF\nServer: CAStor Cluster/14.0.0\nVia: 1.1 192.168.8.109 (Cloud Gateway SCSP/7.6.0)\nGateway-Protocol: scsp\nContent-Length: 44\n\nCannot shorten compliance retention period","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Change the bucket’s locking mode to compliance with retention higher than what the object currently has (e.g. 60 days).","type":"text"}]},{"type":"codeBlock","content":[{"text":"curl --location-trusted -i -XPUT \"http://192.168.8.109:9090/b1?domain=locking.example.com&objectlock=compliance:60d\" -u someuser:caringo","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Now change the version’s locking mode to the bucket’s default (use ","type":"text"},{"text":"?objectlock=","type":"text","marks":[{"type":"code"}]},{"text":").","type":"text"}]},{"type":"codeBlock","content":[{"text":"curl --location-trusted -i -XPUT \"http://192.168.8.109:9090/b1/fileA1?domain=locking.example.com&version=18e9adfcfc2b102e05162fe1633118f1&objectlock\" -u someuser:caringo","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Confirm that the object has a retention period that matches the bucket’s (i.e. 60 days).","type":"text"}]},{"type":"codeBlock","content":[{"text":"curl --location-trusted -i \"http://192.168.8.109:9090/b1/fileA1?domain=locking.example.com&version=18e9adfcfc2b102e05162fe1633118f1&objectlock\" -u someuser:caringo\nHTTP/1.1 200 OK\nDate: Mon, 25 Oct 2021 12:16:26 GMT\nGateway-Request-Id: F7D3C75D4223B42F\nServer: CAStor Cluster/14.0.0\nVia: 1.1 192.168.8.109 (Cloud Gateway SCSP/7.6.0)\nGateway-Protocol: scsp\nX-Object-Lock-Meta-Mode: COMPLIANCE\nX-Object-Lock-Meta-Retain-until-date: Fri, 24 Dec 2021 12:14:30 GMT\nContent-Length: 72\n\nObject is locked in COMPLIANCE mode until Fri, 24 Dec 2021 12:14:30 GMT","type":"text"}]}]}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"E. Managing the legal hold settings of an existing object","type":"text","marks":[{"type":"strong"}]}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"In these examples we will use an object for which no object locking was set, stored in a bucket that has object-locking enabled, but not enforced, namely X-Object-Lock-Meta-Retain-until-date is not set on the bucket","type":"text"}]}]},{"type":"paragraph","content":[{"text":"The typical scenario for managing the legal hold settings of existing versions consists of the following steps:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"List the object’s versions.","type":"text"}]},{"type":"codeBlock","content":[{"text":"curl --location-trusted -s \"http://192.168.8.109:9090/b1?domain=locking.example.com&format=json&versions&name=fileB1&sort=tmborn:DESC,etag:DESC\" -u someuser:caringo [\n{\"last_modified\": \"2021-10-25T12:30:35.108000Z\", \"bytes\": 4, \"versioned\": \"true\", \"name\": \"fileB1\", \"hash\": \"fa6665b5a9189306addc007c0c57ad9b\", \"written\": \"2021-10-25T12:30:35.108000Z\", \"accessed\": \"2021-10-25T12:30:35.108000Z\", \"content_type\": \"application/x-www-form-urlencoded\"},\n{\"last_modified\": \"2021-10-25T12:30:32.920000Z\", \"bytes\": 4, \"versioned\": \"true\", \"name\": \"fileB1\", \"hash\": \"386afd4ee45aba359c942c95bea61223\", \"written\": \"2021-10-25T12:30:32.920000Z\", \"accessed\": \"2021-10-25T12:30:32.920000Z\", \"content_type\": \"application/x-www-form-urlencoded\", \"version\": \"386afd4ee45aba359c942c95bea61223\"}","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set legal hold for one of the object’s version using the ","type":"text"},{"text":"?objectlock=legal-hold","type":"text","marks":[{"type":"code"}]},{"text":" query argument on a PUT request.","type":"text"}]},{"type":"codeBlock","content":[{"text":"curl --location-trusted -i -XPUT \"http://192.168.8.109:9090/b1/fileB1?domain=locking.example.com&version=386afd4ee45aba359c942c95bea61223&objectlock=legal-hold\" -u someuser:caringo","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Check the version’s locking status through a GET request that uses the ","type":"text"},{"text":"?objectlock","type":"text","marks":[{"type":"code"}]},{"text":" query argument.","type":"text"}]},{"type":"codeBlock","content":[{"text":"curl --location-trusted -i \"http://192.168.8.109:9090/b1/fileB1?domain=locking.example.com&version=386afd4ee45aba359c942c95bea61223&objectlock\" -u someuser:caringo\nHTTP/1.1 200 OK\nDate: Mon, 25 Oct 2021 12:36:20 GMT\nGateway-Request-Id: 1EB296F696DEBA57\nServer: CAStor Cluster/14.0.0\nVia: 1.1 192.168.8.109 (Cloud Gateway SCSP/7.6.0)\nGateway-Protocol: scsp\nX-Object-Lock-Meta-Legal-Hold: ON\nContent-Length: 31\n\nObject is locked in legal hold","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Remove the version’s legal hold, through a DELETE request that includes the ","type":"text"},{"text":"?objectlock=legal-hold","type":"text","marks":[{"type":"code"}]},{"text":" query argument.","type":"text"}]},{"type":"codeBlock","content":[{"text":"curl --location-trusted -i -XDELETE \"http://192.168.8.109:9090/b1/fileB1?domain=locking.example.com&version=386afd4ee45aba359c942c95bea61223&objectlock=legal-hold\" -u someuser:caringo","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Confirm that the legal hold has been removed.","type":"text"}]},{"type":"codeBlock","content":[{"text":"curl --location-trusted -i \"http://192.168.8.109:9090/b1/fileB1?domain=locking.example.com&version=386afd4ee45aba359c942c95bea61223&objectlock\" -u someuser:caringo\nHTTP/1.1 200 OK\nDate: Mon, 25 Oct 2021 12:43:09 GMT\nGateway-Request-Id: FDC05254168B34A2\nServer: CAStor Cluster/14.0.0\nVia: 1.1 192.168.8.109 (Cloud Gateway SCSP/7.6.0)\nGateway-Protocol: scsp\nContent-Length: 21\n\nObject is not locked","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Configuring Object Locking through the S3 API","type":"text"}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"The following examples are performed using the aws CLI. For details on how to set it up please check ","type":"text"},{"type":"inlineCard","attrs":{"url":"https://caringo.atlassian.net/wiki/spaces/KB/pages/2739666967"}},{"text":" ","type":"text"}]}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"A. Enabling object locking on the bucket and all subsequently created objects","type":"text"}]},{"type":"paragraph","content":[{"text":"If you want to enable object locking on the bucket and have it applied automatically to all objects written afterwards, then the typical usage scenario is the following (","type":"text"},{"text":"NOTE:","type":"text","marks":[{"type":"strong"}]},{"text":" You will still be able to set object-locking on a per-object basis and the Gateway will always use the maximum of either the bucket default retention duration or the duration specified in a per-object request):","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Use the ","type":"text"},{"text":"put-object-lock-configuration","type":"text","marks":[{"type":"code"}]},{"text":" S3 API call for enabling locking using the desired mode and retention period.","type":"text"}]},{"type":"codeBlock","content":[{"text":"aws s3api put-object-lock-configuration --endpoint-url=http://locking.example.com:9091 --bucket=b2 --object-lock-configuration '{ \"ObjectLockEnabled\": \"Enabled\", \"Rule\": { \"DefaultRetention\": { \"Mode\": \"COMPLIANCE\", \"Days\": 50 }}}'","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Check the bucket’s locking status using the ","type":"text"},{"text":"get-object-lock-configuration","type":"text","marks":[{"type":"code"}]},{"text":" S3 API call.","type":"text"}]},{"type":"codeBlock","content":[{"text":"aws s3api get-object-lock-configuration --endpoint-url=http://locking.example.com:9091 --bucket=b2 {\n \"ObjectLockConfiguration\": {\n \"ObjectLockEnabled\": \"Enabled\",\n \"Rule\": {\n \"DefaultRetention\": {\n \"Mode\": \"COMPLIANCE\",\n \"Days\": 50\n }\n }\n }\n}","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create a new object in that bucket using the ","type":"text"},{"text":"put-object","type":"text","marks":[{"type":"code"}]},{"text":" API call.","type":"text"}]},{"type":"codeBlock","content":[{"text":"aws s3api put-object --endpoint-url=http://locking.example.com:9091 --bucket=b2 --key fileA1 --body test.txt","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Check the object’s retention period using the ","type":"text"},{"text":"get-object-retention","type":"text","marks":[{"type":"code"}]},{"text":" S3 API call, making sure it matches the locking settings applied to the bucket. ","type":"text"},{"text":"NOTE:","type":"text","marks":[{"type":"strong"}]},{"text":" This will return the retention settings of the object’s current version. If you need to check the retention settings of a different version, specify that using the ","type":"text"},{"text":"--version-id","type":"text","marks":[{"type":"code"}]},{"text":" CLI option.","type":"text"}]},{"type":"codeBlock","content":[{"text":"aws s3api get-object-retention --endpoint-url=http://locking.example.com:9091 --bucket=b2 --key fileA1\n{\n \"Retention\": {\n \"Mode\": \"COMPLIANCE\",\n \"RetainUntilDate\": \"2021-12-14T13:39:35+00:00\"\n }\n}","type":"text"}]}]}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"B. Enabling object locking on the bucket without automatically setting it on the objects written afterwards","type":"text"}]},{"type":"paragraph","content":[{"text":"If you want to enable object locking on the bucket without having it applied automatically to all objects written afterwards, then your typical usage scenario will look like this:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Use the ","type":"text"},{"text":"put-object-lock-configuration","type":"text","marks":[{"type":"code"}]},{"text":" S3 API call for enabling locking ","type":"text"},{"text":"without","type":"text","marks":[{"type":"strong"}]},{"text":" setting a mode or retention period.","type":"text"}]},{"type":"codeBlock","content":[{"text":"aws s3api put-object-lock-configuration --endpoint-url=http://locking.example.com:9091 --bucket=b2 --object-lock-configuration '{ \"ObjectLockEnabled\": \"Enabled\" }'","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Check the bucket’s locking status using the ","type":"text"},{"text":"get-object-lock-configuration","type":"text","marks":[{"type":"code"}]},{"text":" S3 API call.","type":"text"}]},{"type":"codeBlock","content":[{"text":"aws s3api get-object-lock-configuration --endpoint-url=http://locking.example.com:9091 --bucket=b2\n{\n \"ObjectLockConfiguration\": {\n \"ObjectLockEnabled\": \"Enabled\"\n }\n}\n","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create a new object in that bucket using the ","type":"text"},{"text":"put-object","type":"text","marks":[{"type":"code"}]},{"text":" API call.","type":"text"}]},{"type":"codeBlock","content":[{"text":"aws s3api put-object --endpoint-url=http://locking.example.com:9091 --bucket=b2 --key fileB1 --body test.txt","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Check the object’s retention period using the ","type":"text"},{"text":"get-object-retention","type":"text","marks":[{"type":"code"}]},{"text":" S3 API call, making sure the object has no retention period set.","type":"text"}]},{"type":"codeBlock","content":[{"text":"aws s3api get-object-retention --endpoint-url=http://locking.example.com:9091 --bucket=b2 --key fileB1\n{\n \"Retention\": {}\n}","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set a retention period for the current version of this newly written object using the ","type":"text"},{"text":"put-object-retention","type":"text","marks":[{"type":"code"}]},{"text":" API call.","type":"text"}]},{"type":"codeBlock","content":[{"text":"aws s3api put-object-retention --endpoint-url=http://locking.example.com:9091 --bucket=b2 --key fileB1 --retention '{ \"Mode\": \"Compliance\", \"RetainUntilDate\": \"2022-01-01T00:00:00\" }'","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Using the ","type":"text"},{"text":"get-object-retention","type":"text","marks":[{"type":"code"}]},{"text":" S3 API call, confirm that the new retention period is now in place.","type":"text"}]},{"type":"codeBlock","content":[{"text":"aws s3api get-object-retention --endpoint-url=http://locking.example.com:9091 --bucket=b2 --key fileB1\n{\n \"Retention\": {\n \"Mode\": \"COMPLIANCE\",\n \"RetainUntilDate\": \"2022-01-01T00:00:00+00:00\"\n }\n}","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Alternatively, you can set the object lock mode and retention period at write time, using the ","type":"text"},{"text":"--object-lock-mode","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":"--object-lock-retain-until-date","type":"text","marks":[{"type":"code"}]}]},{"type":"codeBlock","content":[{"text":"aws s3api put-object --endpoint-url=http://locking.example.com:9091 --bucket=b2 --key fileC1 --body test.txt --object-lock-mode GOVERNANCE --object-lock-retain-until-date 2021-11-01T00:00:00+00:00","type":"text"}]}]}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"C. Enabling legal-hold on newly written objects","type":"text"}]},{"type":"paragraph","content":[{"text":"Using the AWS CLI, you can set legal-hold while writing an object by setting the ","type":"text"},{"text":"--object-lock-legal-hold-status","type":"text","marks":[{"type":"code"}]},{"text":" option to ON:","type":"text"}]},{"type":"codeBlock","content":[{"text":"aws s3api put-object --endpoint-url=http://locking.example.com:9091 --bucket=b2 --key fileD1 --body test.txt --object-lock-legal-hold-status ON","type":"text"}]},{"type":"paragraph","content":[{"text":"Checking the legal hold status of the newly written object can be done using the get-object-legal-hold API call:","type":"text"}]},{"type":"codeBlock","content":[{"text":"aws s3api get-object-legal-hold --endpoint-url=http://locking.example.com:9091 --bucket=b2 --key fileD1\n{\n \"LegalHold\": {\n \"Status\": \"ON\"\n }\n}","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"D. Managing the locking settings of existing versions of an object","type":"text"}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"Managing the retention and/or legal-hold settings of an existing object using the S3 API is by default performed on the current version of the object. If you need to perform these actions on a particular version of an object other than the current one, you will need to specify that version using the ","type":"text"},{"text":"--version-id","type":"text","marks":[{"type":"code"}]},{"text":" CLI option. One needs to also take into account the specific permissions and limitations as mentioned in ","type":"text"},{"type":"inlineCard","attrs":{"url":"https://caringo.atlassian.net/wiki/spaces/public/pages/2859925505"}},{"text":" . In the following examples we will set the locking/legal hold parameters of versions other than the current version.","type":"text"}]}]},{"type":"paragraph","content":[{"text":"The typical workflow when managing the locking settings of an object’s version using the AWS CLI is the following:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"List the object’s versions using the ","type":"text"},{"text":"list-object-versions","type":"text","marks":[{"type":"code"}]},{"text":" API call, noting the VersionId of the version for which you want to manage the locking settings.","type":"text"}]},{"type":"codeBlock","content":[{"text":"aws s3api list-object-versions --endpoint-url=http://locking.example.com:9091 --bucket=b2 --prefix fileE1\n{\n \"Versions\": [\n {\n \"ETag\": \"\\\"d8e8fca2dc0f896fd7cb4cb0031ba249\\\"\",\n \"Size\": 5,\n \"StorageClass\": \"STANDARD\",\n \"Key\": \"fileE1\",\n \"VersionId\": \"771c0aa2c1d8e944fa75ac8cbf780c34\",\n \"IsLatest\": true,\n \"LastModified\": \"2021-10-26T08:40:49.448000+00:00\",\n \"Owner\": {\n \"DisplayName\": \"caringoadmin@\",\n \"ID\": \"caringoadmin@\"\n }\n },\n {\n \"ETag\": \"\\\"d8e8fca2dc0f896fd7cb4cb0031ba249\\\"\",\n \"Size\": 5,\n \"StorageClass\": \"STANDARD\",\n \"Key\": \"fileE1\",\n \"VersionId\": \"f59bbbb8a093dde1ed2cceb029a92fa2\",\n \"IsLatest\": false,\n \"LastModified\": \"2021-10-26T08:40:44.064000+00:00\",\n \"Owner\": {\n \"DisplayName\": \"caringoadmin@\",\n \"ID\": \"caringoadmin@\"\n }\n }\n ]\n}","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set a GOVERNANCE locking mode on one of the versions (in this example we will use the 2nd version) with a retention period until 2022-01-01T00:00:00. This can be done using the ","type":"text"},{"text":"put-object-retention","type":"text","marks":[{"type":"code"}]},{"text":" API call.","type":"text"}]},{"type":"codeBlock","content":[{"text":"aws s3api put-object-retention --endpoint-url=http://locking.example.com:9091 --bucket=b2 --key fileE1 --version-id f59bbbb8a093dde1ed2cceb029a92fa2 --retention '{ \"Mode\": \"Governance\", \"RetainUntilDate\": \"2022-01-01T00:00:00\" }'","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Using the ","type":"text"},{"text":"get-object-retention","type":"text","marks":[{"type":"code"}]},{"text":" API call confirms that the new settings are in place.","type":"text"}]},{"type":"codeBlock","content":[{"text":"aws s3api get-object-retention --endpoint-url=http://locking.example.com:9091 --bucket=b2 --key fileE1 --version-id f59bbbb8a093dde1ed2cceb029a92fa2\n{\n \"Retention\": {\n \"Mode\": \"GOVERNANCE\",\n \"RetainUntilDate\": \"2022-01-01T00:00:00+00:00\"\n }\n}","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Remove the Governance lock using the ","type":"text"},{"text":"put-object-retention","type":"text","marks":[{"type":"code"}]},{"text":" call, with the ","type":"text"},{"text":"--bypass-governance-retention","type":"text","marks":[{"type":"code"}]},{"text":" flag set.","type":"text"}]},{"type":"codeBlock","content":[{"text":"aws s3api put-object-retention --endpoint-url=http://locking.example.com:9091 --bucket=b2 --key fileE1 --bypass-governance-retention --version-id f59bbbb8a093dde1ed2cceb029a92fa2 --retention '{ \"Mode\": \"Governance\", \"RetainUntilDate\": 0 }'","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Confirm that the lock has been removed.","type":"text"}]},{"type":"codeBlock","content":[{"text":"aws s3api get-object-retention --endpoint-url=http://locking.example.com:9091 --bucket=b2 --key fileE1 --version-id f59bbbb8a093dde1ed2cceb029a92fa2 {\n \"Retention\": {}\n}","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set a Compliance mode object lock with a retention period of 90 days.","type":"text"}]},{"type":"codeBlock","content":[{"text":"aws s3api put-object-retention --endpoint-url=http://locking.example.com:9091 --bucket=b2 --key fileE1 --bypass-governance-retention --version-id f59bbbb8a093dde1ed2cceb029a92fa2 --retention '{ \"Mode\": \"Compliance\", \"RetainUntilDate\": \"2022-03-01T00:00:00+00:00\" }'","type":"text"}]}]}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"E. Managing the legal-hold settings of existing versions of an object","type":"text"}]},{"type":"paragraph","content":[{"text":"The typical workflow in this case consists of the following steps:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"List the versions of an object and choose the version for which you want to apply the legal hold (in these examples we will use the 2nd most recent version.","type":"text"}]},{"type":"codeBlock","content":[{"text":"aws s3api list-object-versions --endpoint-url=http://locking.example.com:9091 --bucket=b2 --prefix fileE1 | jq '.Versions[].VersionId'\n\"bf427bb54de0520a2b2c5d18e552587e\"\n\"a05ab3dac37bebf45dc269c60df77417\"\n\"771c0aa2c1d8e944fa75ac8cbf780c34\"\n\"f59bbbb8a093dde1ed2cceb029a92fa2\"","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Enable legal hold on that version using the ","type":"text"},{"text":"put-object-legal-hold","type":"text","marks":[{"type":"code"}]},{"text":" API call.","type":"text"}]},{"type":"codeBlock","content":[{"text":"aws s3api put-object-legal-hold --endpoint-url=http://locking.example.com:9091 --bucket=b2 --key fileE1 --version-id a05ab3dac37bebf45dc269c60df77417 --legal-hold Status=ON","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Check the version’s legal hold status using the ","type":"text"},{"text":"get-object-legal-hold","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"codeBlock","content":[{"text":"aws s3api get-object-legal-hold --endpoint-url=http://locking.example.com:9091 --bucket=b2 --key fileE1 --version-id a05ab3dac37bebf45dc269c60df77417\n{\n \"LegalHold\": {\n \"Status\": \"ON\"\n }\n}","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Remove the legal hold lock.","type":"text"}]},{"type":"codeBlock","content":[{"text":"aws s3api put-object-legal-hold --endpoint-url=http://locking.example.com:9091 --bucket=b2 --key fileE1 --version-id a05ab3dac37bebf45dc269c60df77417 --legal-hold Status=OFF","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Confirm that the legal hold lock has been removed.","type":"text"}]},{"type":"codeBlock","content":[{"text":"aws s3api get-object-legal-hold --endpoint-url=http://locking.example.com:9091 --bucket=b2 --key fileE1 --version-id a05ab3dac37bebf45dc269c60df77417 {\n \"LegalHold\": {\n \"Status\": \"OFF\"\n }\n}","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Related articles","type":"text"}]},{"type":"paragraph","content":[{"type":"inlineCard","attrs":{"url":"https://caringo.atlassian.net/wiki/spaces/public/pages/2859925505"}},{"text":" ","type":"text"}]},{"type":"paragraph","content":[{"type":"inlineCard","attrs":{"url":"https://caringo.atlassian.net/wiki/spaces/KB/pages/2739666967"}},{"text":" ","type":"text"}]},{"type":"paragraph"}],"version":1}

Browser not supported