From my understanding, you can't delete a bucket that has objects and I assume you can't empty a bucket that has locked objects, but what happens if you close the entire account? AWS recommends to use accounts for segmentation, and has APIs to manage accounts ( https://docs.aws.amazon.com/wellarchitected/latest/security-... , https://docs.aws.amazon.com/cli/latest/reference/organizatio... ). There is a 90 day recover…
It's much harder to hide the fact that you have closed an account completely and much easier to put in a periodic check that the account still exists. The difficulty with ransomware is that—without object lock—you would need to check that all data is still valid. That is usually going to be very difficult to do and any heuristic checks are liable to miss some cases. On the other hand, checking that an account is stil…
Re: Protect your data from ransomware with S3 Object Lock
#21Oh, I totally agree that this solves at least 99% of the problem. I'm just wondering if this is an edge case that remains.