Study guide
13.2 Data Integrity Protection: Object Lock, Vault Lock & Code Signing
AWS Certified Security – Specialty SCS-C03
Track your progress as you read
Finished sections get a check mark.
1 Chapter 0: Getting Started with the SCS-C03 Exam
0.1 SCS-C03 Exam Format, Domains & Study Strategy
2 Chapter 1: Security Monitoring, Alerting & Threat Detection Services
1.1 Workload Monitoring & Health Check Strategies 1.2 Amazon GuardDuty Architecture & Finding Types 1.3 AWS Security Hub & Automated Conformance Assessment 1.4 Amazon Macie & Automated Data Classification
3 Chapter 2: Enterprise Logging Architecture & Analysis
2.1 Multi-Account CloudTrail & Organization Trails 2.2 Amazon Security Lake & OCSF Log Normalization 2.3 Network Telemetry: VPC Flow Logs & Route 53 Resolver Logs 2.4 Troubleshooting Security Telemetry & Log Ingestion 2.5 Analyzing, Normalizing & Correlating Security Logs
4 Chapter 3: Incident Readiness, Response Planning & Automated Runbooks
3.1 Incident Response Planning & Blast Radius Mitigation 3.2 Testing & Validating Incident Response Plans 3.3 Automated Incident Remediation with EventBridge & Step Functions 3.4 Systems Manager OpsCenter & Incident Manager Runbooks
5 Chapter 4: Digital Forensics, Evidence Preservation & Root Cause Analysis
4.1 Forensic Artifact Capture & Chain of Custody 4.2 Threat Containment & Network Quarantine Techniques 4.3 Correlating Events & Root Cause Analysis with Amazon Detective
6 Chapter 5: Edge Protection, WAF & DDoS Mitigation
5.1 CloudFront Security Headers & Origin Access Control 5.2 AWS WAF Architecture & Advanced Rule Sets 5.3 AWS Shield Advanced & DDoS Defense Architectures 5.4 Edge Integrations: Managed Rule Groups, OCSF Ingestion, IoT Policies & CORS
7 Chapter 6: Compute Workload Hardening, Vulnerability Management & GenAI Security
6.1 Golden AMIs & Container Image Hardening Pipelines 6.2 Amazon Inspector Vulnerability Management & Patch Automation 6.3 Generative AI Security: Amazon Bedrock Guardrails & Model Protection 6.4 Instance Profiles, Service Roles & Execution Roles for Compute 6.5 Secure Administrative Access: Session Manager & EC2 Instance Connect
8 Chapter 7: Network Security, Segmentation, Private Connectivity & Encryption in Transit
7.1 Layered Traffic Filtering: SGs, NACLs & AWS Network Firewall 7.2 Hybrid Connectivity Security: VPN, Direct Connect & MACsec 7.3 Zero-Trust Access & Network Access Analysis 7.4 Enforcing Encryption in Transit: ELB Security Policies, TLS & HTTPS-Only Access 7.5 Private Access: VPC Endpoints, PrivateLink, Client VPN & Verified Access 7.6 Inter-Resource Encryption in Transit: Nitro, EMR, EKS & SageMaker AI
9 Chapter 8: Enterprise Authentication, Federation & Directory Services
8.1 AWS IAM Identity Center & Enterprise IdP Integration 8.2 Amazon Cognito User Pools & Identity Pools 8.3 AWS Security Token Service (STS) & Temporary Credential Workflows 8.4 Troubleshooting Identity & Authentication Failures
10 Chapter 9: Advanced Authorization Architecture & Policy Evaluation
9.1 Complete AWS Policy Evaluation Logic & Decision Flow 9.2 Permission Boundaries & Safe Admin Delegation 9.3 Attribute-Based Access Control (ABAC) with IAM Tags
11 Chapter 10: Least Privilege, Policy Validation & External Access Auditing
10.1 IAM Roles Anywhere & Amazon Verified Permissions 10.2 Auditing External & Unused Access with IAM Access Analyzer 10.3 Analyzing Authorization Failures & Policy Simulation
12 Chapter 11: Cryptographic Services: KMS Architecture & Key Governance
11.1 AWS KMS Architecture, Key Policies & Key Types 11.2 KMS Grants, Encryption Context & Multi-Region Keys 11.3 Imported Key Material (BYOK) & CloudHSM Key Stores
13 Chapter 12: Secrets Management, Sensitive Data Masking & PKI
12.1 AWS Secrets Manager & Systems Manager Parameter Store 12.2 Sensitive Data Masking in Telemetry & Messaging 12.3 AWS Certificate Manager (ACM) & Private CA Architecture
14 Chapter 13: Storage Encryption, Integrity, Lifecycle & Backup Protection
13.1 S3 Encryption Modes & S3 Bucket Keys 13.2 Data Integrity Protection: Object Lock, Vault Lock & Code Signing 13.3 Secure Data Lifecycle, Cross-Account Replication & Backup Vault Lock 13.4 Lifecycle, Backup & Secure Replication Beyond S3: EFS, FSx, DLM, DataSync & Air-Gapped Vaults
15 Chapter 14: Multi-Account Architecture, Organizations & Control Tower Governance
14.1 AWS Organizations Structure, Hierarchy & Resource Control 14.2 AWS Control Tower Landing Zone & Guardrail Framework 14.3 Delegated Administrator Architecture & Root User Governance 14.4 Centralized Resource Sharing with RAM & Service Catalog
16 Chapter 15: Compliance Automation, Infrastructure as Code Security & Auditing
15.1 Infrastructure as Code Security & Multi-Account Deployment 15.2 AWS Config, Conformance Packs & Automated Remediation 15.3 Audit Evidence Collection & Well-Architected Security Reviews
13.2 Data Integrity Protection: Object Lock, Vault Lock & Code Signing
Key Takeaways Explain This Topic AI
S3 Object Lock enforces Write Once, Read Many (WORM) storage at the individual object version level, requiring S3 Versioning and preventing deletion or modification under Governance Mode or Compliance Mode.
Governance Mode permits privileged IAM principals with s3:BypassGovernanceRetention and the bypass header to alter retention periods or delete locked object versions, whereas Compliance Mode strictly prohibits alteration or deletion by any principal—including the AWS account root user—until retention expires.
S3 Legal Holds apply an indefinite, non-expiring lock on specific object versions independently of retention dates, requiring the s3:PutObjectLegalHold permission to place or remove.
Glacier Vault Lock (in the original vault-based Amazon Glacier service, closed to new customers since December 15, 2025) locks a vault policy through a two-step process with a 24-hour test window, after which it is irreversible.
AWS Signer provides managed cryptographic signing for Lambda functions and container images; Lambda Code Signing Configurations enforce supply chain integrity by warning or blocking deployment of unsigned or untrusted code.
Last updated: September 2026
13.2 Data Integrity Protection: Object Lock, Vault Lock & Code Signing
In mission-critical enterprise environments, preventing unauthorized data modification, tampering, and deletion is just as critical as enforcing confidentiality. Regulated sectors—such as financial institutions governed by SEC Rule 17a-4(f), FINRA Rule 4511, and CFTC 1.31, healthcare systems governed by HIPAA, and government organizations following NIST SP 800-53—mandate Write Once, Read Many (WORM) storage guarantees. Under WORM compliance, records committed to storage must remain strictly immutable, tamper-evident, and protected against deletion for mandated retention periods.
AWS provides native, certifiable WORM storage across hot and cold storage tiers through Amazon S3 Object Lock and Amazon S3 Glacier Vault Lock . Furthermore, to extend cryptographic integrity guarantees into the application execution tier, AWS Signer coordinates with AWS Lambda Code Signing Configurations (CSC) and container registries to ensure that only verified, cryptographically signed binaries execute in production.
Amazon S3 Object Lock Architecture & WORM Storage
Amazon S3 Object Lock implements immutable WORM storage for objects residing within standard S3 storage classes. It prevents objects from being deleted or overwritten for a fixed retention period or indefinitely via legal holds.
Loading diagram...
Mandatory Architectural Prerequisites
S3 Versioning Mandatory : S3 Object Lock operates exclusively on object versions . S3 Versioning is automatically enabled and permanently locked when Object Lock is enabled on a bucket. S3 Versioning cannot be suspended on an Object Lock-enabled bucket.
Bucket-Level Activation : Object Lock can be enabled when a bucket is created or, for an existing bucket, with PutObjectLockConfiguration (console, CLI, or API) once Versioning is enabled; no AWS Support request is needed. Objects already in the bucket are not locked automatically, so apply retention to them with S3 Batch Operations if required. Once enabled on a bucket, Object Lock cannot be disabled .
Granular Version Locking : When an application writes an object to an Object Lock-enabled bucket, the lock configuration applies to that specific version ID . If a client uploads a new object with the identical key name, S3 does not overwrite the locked version; it simply creates a newer, distinct version ID, keeping the older locked version completely intact.
Retention Modes: Governance Mode vs. Compliance Mode
S3 Object Lock provides two distinct retention modes that establish the operational strength of the WORM boundary:
1. Governance Mode
In Governance Mode , object versions are shielded against deletion, overwriting, and retention period truncation by standard IAM users and roles.
Privileged Override ( s3:BypassGovernanceRetention ) : A user possessing the specific IAM permission s3:BypassGovernanceRetention can override Governance Mode. To delete a locked version or reduce its retention period, the caller must explicitly pass the request header x-amz-bypass-governance-retention: true in their API request.
Use Case : Protecting critical records against accidental deletion or rogue user actions while preserving administrative flexibility for authorized compliance officers to purge data if business requirements change.
2. Compliance Mode
In Compliance Mode , object versions are protected by an absolute, non-negotiable cryptographic lock.
Inviolable by Any Principal : Nobody —including the AWS account root user, organization administrators, or AWS Support engineers—can overwrite or delete a locked object version during its retention period.
Unshortenable Retention Period : The retention period cannot be decreased under any circumstances. It can only be extended to a later date.
Bucket Deletion Barrier : An S3 bucket containing objects locked under active Compliance Mode cannot be deleted , even by the root user, until all retention periods on all object versions have fully expired.
Regulatory Adherence : Fully vetted and certified for SEC 17a-4(f), FINRA 4511, and CFTC 1.31 compliance.
Comparison: Governance Mode vs. Compliance Mode
- Operational Characteristic Governance Mode Compliance Mode
- Root User Can Delete? Yes (If passing bypass header) NO (Strictly blocked)
- IAM Administrator Can Delete? Yes (Requires s3:BypassGovernanceRetention ) NO (Strictly blocked)
- Can Retention Period Be Shortened? Yes (With bypass permission) NO (Can only be extended)
- Can Mode Be Converted? Can convert to Compliance Mode Cannot convert to Governance Mode
- Primary Threat Model Accidental internal deletion / Operator error Ransomware / Rogue admin / Legal discovery
- Regulatory Certification Internal organizational governance SEC Rule 17a-4(f), FINRA, CFTC
- S3 Legal Holds: Mechanics & Operational Governance
While retention periods enforce immutability based on deterministic calendar timestamps (e.g., retain for 7 years), legal discovery and regulatory audits frequently demand immediate, open-ended data preservation pending the resolution of litigation or investigations.
Indefinite Duration : An S3 Legal Hold does not have an expiration timestamp. Once placed on an object version, it remains locked until explicitly removed.
Binary Status : A Legal Hold is either ON or OFF . It is applied via the PutObjectLegalHold API.
Decoupled from Retention Periods : Legal Holds operate independently of Governance and Compliance retention modes. An object version can have both a retention period and a Legal Hold simultaneously. If a 3-year Compliance retention period expires but a Legal Hold remains ON , the object remains strictly undeletable.
IAM Authorization : Placing or removing a legal hold requires the explicit IAM permission s3:PutObjectLegalHold . Organizations typically restrict this action to legal and corporate compliance roles. {
- "Version": "2012-10-17",
- "Statement": [
- {
- "Sid": "RestrictLegalHoldManagementToComplianceOfficer",
- "Effect": "Allow",
- "Principal": {
- "AWS": "arn:aws:iam::123456789012:role/ChiefComplianceOfficer"
- },
- "Action": [
- "s3:PutObjectLegalHold",
- "s3:GetObjectLegalHold"
- ],
- "Resource": "arn:aws:s3:::litigation-hold-records/*"
- }
- ]
- }
- Amazon S3 Glacier Vault Lock Architecture
Note
The original vault-based Amazon Glacier service (separate from the S3 Glacier storage classes) stopped accepting new customers on December 15, 2025. Existing vault users keep full access, including Vault Lock. For new archives, use the S3 Glacier storage classes with S3 Object Lock, or AWS Backup Vault Lock.
For long-term archival storage, Amazon S3 Glacier Vault Lock allows security engineers to deploy and lock compliance policies directly on individual S3 Glacier vaults. Vault Lock enforces compliance controls (such as denying deletion of archives before a mandatory 10-year holding period) that cannot be altered or overwritten once locked.
Loading diagram...
The Two-Step Locking Workflow & 24-Hour Window
To prevent administrative lockouts caused by syntax errors or accidental policy misconfigurations, Glacier Vault Lock implements an ironclad two-step workflow:
Step 1: InitiateVaultLock :
The administrator attaches a proposed Vault Lock policy document to the target vault.
Glacier places the policy in an InProgress state and generates a unique LockId .
Glacier initiates a mandatory 24-hour testing countdown .
Step 2: Testing & Validation :
During the 24-hour window, the policy is enforced, allowing the administrator to test compliance rules against test archives.
If the policy contains an error, the administrator can call AbortVaultLock using the LockId , which immediately terminates the lock process and purges the in-progress policy.
Step 3: CompleteVaultLock :
Within 24 hours of initiation, the administrator must call CompleteVaultLock specifying the exact LockId .
Once completed, the vault lock transitions to the Locked state.
Permanent Immutability : Once in the Locked state, the Vault Lock policy cannot be modified, deleted, or overridden by anyone—including the AWS account root user .
Timeout Expiration : If 24 hours elapse without calling CompleteVaultLock , the lock state expires automatically, and the in-progress policy is purged.
Glacier Vault Lock Policy Example
The following policy locks an Amazon S3 Glacier vault to deny the deletion of any archive that has been stored for less than 3,650 days (10 years): {
- "Version": "2012-10-17",
- "Statement": [
- {
- "Sid": "DenyPrematureArchiveDeletion",
- "Effect": "Deny",
- "Principal": "*",
- "Action": "glacier:DeleteArchive",
- "Resource": "arn:aws:glacier:us-east-1:123456789012:vaults/legal-archive-vault",
- "Condition": {
- "NumericLessThan": {
- "glacier:ArchiveAgeInDays": "3650"
- }
- }
- }
- ]
- }
- AWS Signer: Code Signing, Container Integrity & Platform Enforcement
Data integrity extends beyond static storage into the software supply chain. Malicious actors frequently attempt to inject tampered code into continuous integration/continuous deployment (CI/CD) pipelines or deploy backdoored container images. AWS Signer is a fully managed code-signing service that establishes cryptographic authenticity, integrity, and non-repudiation for code artifacts.
Loading diagram...
Key Concepts of AWS Signer
Signing Profile : A template that defines cryptographic parameters, including the target platform (e.g., AWSLambda-SHA384-ECDSA , Notation-OCI-SHA384-ECDSA ), signing key validity period, and signature validity period (default 135 months or custom).
Signing Job : The automated operation where AWS Signer takes an unsigned payload from Amazon S3 or a container registry, applies a digital signature using the managed private key associated with the signing profile, and writes the signed artifact and signature metadata to the target destination.
Revocation : If a signing profile's integrity is questioned, administrators can revoke the profile. AWS Signer supports setting an effective revocation date , allowing signatures created before a specific timestamp to remain valid while immediately invalidating signatures generated after the compromise.
AWS Lambda Code Signing Configurations (CSC)
To enforce that only verified code runs in AWS Lambda, security teams attach a Code Signing Configuration (CSC) to the Lambda function. The CSC specifies two critical parameters:
Allowed Signing Profiles : A list of up to 20 AWS Signer signing profile ARNs that are authorized to sign code for the function.
Signature Validation Policy (Untrusted Artifact Action) :
Warn : If a deployment package is unsigned, has an invalid signature, or was signed by an unauthorized profile, Lambda logs a warning metric to Amazon CloudWatch and allows the deployment to proceed. (Primarily used for testing/auditing).
Enforce : If the deployment package fails signature verification or lacks a valid signature from an allowed profile, Lambda blocks the deployment immediately , returning an InvalidCodeSignatureException . {
- "CodeSigningConfig": {
- "CodeSigningConfigArn": "arn:aws:lambda:us-east-1:123456789012:code-signing-config:csc-0123456789abcdef0",
- "CodeSigningConfigId": "csc-0123456789abcdef0",
- "AllowedPublishers": {
- "SigningProfileVersionArns": [
- "arn:aws:signer:us-east-1:123456789012:/signing-profiles/ProductionReleaseProfile/v1"
- ]
- },
- "CodeSigningPolicies": {
- "UntrustedArtifactOnDeployment": "Enforce"
- }
- }
- }
- Comparison: S3 Object Lock vs. Glacier Vault Lock vs. AWS Backup Vault Lock
Capability S3 Object Lock S3 Glacier Vault Lock AWS Backup Vault Lock
Target Resource S3 Object Versions (Hot/Warm) Glacier Vault Archives (Cold) AWS Backup Recovery Points (EBS, RDS, EFS, S3, etc.)
- Prerequisites S3 Versioning must be enabled S3 Glacier Vault creation AWS Backup Vault creation
- Modes Supported Governance & Compliance Compliance (Once locked) Governance & Compliance
Test / Abort Window None (Direct application) 24-hour test window Min 3-day (72h) grace period (Compliance mode)
- Root User Inviolability Yes (Under Compliance Mode) Yes (Under Locked state) Yes (Under Compliance Mode)
- Legal Hold Support Yes (Indefinite binary flag) No (Handled via policy dates) No (Handled via retention dates)
- Retention Limits Days or Years Days or Years Min and Max Retention Days
- Specialty Exam Pitfalls & Architectural Traps
Attempting Object Lock on Suspended Versioning : Assuming Object Lock can function on an S3 bucket with versioning suspended or disabled. S3 Object Lock binds cryptographic immutability directly to specific object version IDs. Enabling Object Lock permanently enforces Versioning.
The Root User Compliance Override Myth : Believing that the AWS account root user or a support ticket to AWS Support can delete an object locked under S3 Object Lock Compliance Mode or an archive under a locked Glacier Vault Lock. Neither the root user nor AWS engineering possesses a backdoor mechanism to bypass Compliance mode locks.
Glacier Vault Lock 24-Hour Expiration : Forgetting to call CompleteVaultLock within 24 hours of calling InitiateVaultLock . If the 24-hour window lapses without completion, the lock state expires, and the proposed compliance policy is discarded completely.
Lambda Code Signing Configured with Warn : Assuming that creating a Code Signing Configuration automatically prevents unsigned code from deploying. If the untrusted artifact action is set to Warn , untrusted or tampered code will still deploy and execute in production. High-security environments must explicitly configure Enforce .