Help Center/ Object Storage Service/ SDK Reference/ Python/ Bucket-Related APIs (SDK for Python)/ Write-Once-Read-Many (WORM) (SDK for Python)/ Configuring a Default WORM Policy for a Bucket (SDK for Python)

Updated on 2026-07-31 GMT+08:00

Configuring a Default WORM Policy for a Bucket (SDK for Python)

Function

This API is used to configure a default WORM policy and retention period for a bucket.

With a bucket's default WORM policy, if you do not specify a protection policy or retention period when you upload an object to the bucket, the default policy will be automatically applied to the newly uploaded object. An object-level WORM policy requires configuring a specific date, which indicates an object will be protected until that date. For a default bucket-level WORM policy, a retention period is required, and the protection for an object starts when the object is uploaded to the bucket.

You can modify or even delete the default WORM policy of a bucket. The change applies only to the objects uploaded after the change, but not to those uploaded before.
During a multipart upload, the object parts uploaded are not protected before they are assembled. After object parts are assembled, the new object is protected by the default bucket-level WORM policy. You can also configure an object-level WORM policy for the new object.

Restrictions

To configure a default WORM policy for a bucket, you must be the bucket owner or have the required permission (obs:bucket:PutBucketObjectLockConfiguration granted using IAM or PutBucketObjectLockConfiguration granted using a bucket policy). For details, see Introduction to OBS Access Control, IAM Custom Policies, and Creating a Custom Bucket Policy.

The WORM mode can only be COMPLIANCE.
The retention period can be set to 1 to 36500 days or 1 to 100 years.

The mapping between OBS regions and endpoints must comply with what is listed in Regions and Endpoints.

Method

ObsClient.setBucketObjectLock(bucketName, objectLockConfiguration, extensionHeaders)

Request Parameters

Parameter	Type	Mandatory (Yes/No)	Description
bucketName	str	Yes	Explanation: Bucket name Restrictions: A bucket name must be unique across all accounts and regions. A bucket name: Must be 3 to 63 characters long and start with a digit or letter. Lowercase letters, digits, hyphens (-), and periods (.) are allowed. Cannot be formatted as an IP address. Cannot start or end with a hyphen (-) or period (.). Cannot contain two consecutive periods (..), for example, my..bucket. Cannot contain a period (.) and a hyphen (-) adjacent to each other, for example, my-.bucket or my.-bucket. If you repeatedly create buckets with the same name in the same region, no error will be reported and the bucket properties comply with those set in the first creation request. Default value: None
objectLockConfiguration	Table 1	Yes	Explanation: Bucket-level WORM configuration. For details, see Table 1.
extensionHeaders	dict	No	Explanation: Extension headers Value range: See User-defined Headers (SDK for Python). Default value: None

Parameter

Type

Mandatory (Yes/No)

Description

bucketName

str

Yes

Explanation:

Bucket name

Restrictions:

A bucket name must be unique across all accounts and regions.
A bucket name:
- Must be 3 to 63 characters long and start with a digit or letter. Lowercase letters, digits, hyphens (-), and periods (.) are allowed.
- Cannot be formatted as an IP address.
- Cannot start or end with a hyphen (-) or period (.).
- Cannot contain two consecutive periods (..), for example, my..bucket.
- Cannot contain a period (.) and a hyphen (-) adjacent to each other, for example, my-.bucket or my.-bucket.
If you repeatedly create buckets with the same name in the same region, no error will be reported and the bucket properties comply with those set in the first creation request.

Default value:

None

objectLockConfiguration

Table 1

Yes

Explanation:

Bucket-level WORM configuration. For details, see Table 1.

extensionHeaders

dict

Explanation:

Extension headers

Value range:

See User-defined Headers (SDK for Python).

Default value:

None

**Table 1** ObjectLockConfiguration
Parameter	Type	Mandatory (Yes/No)	Description
objectLockEnabled	str	No	Explanation: Bucket-level WORM status Restrictions: N/A Value range: Enabled: Bucket-level WORM is enabled. Default value: N/A
rule	Table 2	Yes when ObjectLockEnabled is set to Enabled. If this parameter is not specified, the default bucket-level WORM policy will be cleared.	Explanation: Rule of a bucket-level WORM policy Restrictions: If this parameter is not specified, the default bucket-level WORM policy will be cleared. Value range: For details, see Table 2. Default value: N/A

**Table 2** ObjectLockRule
Parameter	Type	Mandatory (Yes/No)	Description
days	int	Either days or years must be specified, but they cannot be specified at the same time.	Explanation: Retention period, in days Restrictions: Only one of days and years can be set to a value other than 0. The value must be within the allowed range. Value range: 1 to 36500 Default value: N/A
years	int	Either days or years must be specified, but they cannot be specified at the same time.	Explanation: Default retention period, in years Restrictions: One year is considered as 365 days, regardless of the leap year. Only one of days and years can be set to a value other than 0. The value must be within the allowed range. Value range: 1 to 100 Default value: N/A
mode	str	No	Explanation: WORM retention policy of a bucket Restrictions: N/A Value range: COMPLIANCE: compliance mode Default value: COMPLIANCE

Responses

Type	Description
GetResult	Explanation: SDK common results

Type

Description

GetResult

Explanation:

SDK common results

**Table 3** GetResult
Parameter	Type	Description
status	int	Explanation: HTTP status code Value range: A status code is a group of digits indicating the status of a response. It ranges from 2xx (indicating successes) to 4xx or 5xx (indicating errors). For more information, see Status Code. Default value: None
reason	str	Explanation: Reason description Default value: None
errorCode	str	Explanation: Error code returned by the OBS server. If the value of status is less than 300, this parameter is left blank. Default value: None
errorMessage	str	Explanation: Error message returned by the OBS server. If the value of status is less than 300, this parameter is left blank. Default value: None
requestId	str	Explanation: Request ID returned by the OBS server Default value: None
indicator	str	Explanation: Error indicator returned by the OBS server Default value: None
hostId	str	Explanation: Requested server ID. If the value of status is less than 300, this parameter is left blank. Default value: None
resource	str	Explanation: Error source (a bucket or an object). If the value of status is less than 300, this parameter is left blank. Default value: None
header	list	Explanation: Response header list, composed of tuples. Each tuple consists of two elements, respectively corresponding to the key and value of a response header. Default value: None
body	object	Explanation: Result content returned after the operation is successful. If the value of status is larger than 300, this parameter is left blank. The value varies with the API being called. For details, see the sections "Bucket-Related APIs" and "Object-Related APIs". Default value: None

Sample Code

This example configures a default WORM policy for bucket examplebucket.

     from obs import ObsClient, ObjectLockRule, ObjectLockConfiguration
import os
import traceback

# Obtain an AK/SK pair using environment variables (recommended) or import it in other ways. Using hard coding may result in leakage.
# Obtain an AK and SK pair on the management console. For details, see https://support.huaweicloud.com/intl/en-us/usermanual-ca/ca_01_0003.html.
ak = os.getenv("AccessKeyID")
sk = os.getenv("SecretAccessKey")
# If you use a temporary AK/SK pair and a security token to access OBS, obtain them from environment variables.
# security_token = os.getenv("SecurityToken")
# Set server to the endpoint corresponding to the bucket. CN-Hong Kong is used here as an example. Replace it with the one currently in use.
server = "https://obs.ap-southeast-1.myhuaweicloud.com" 

# Create an obsClient instance.
# If you use a temporary AK/SK pair and a security token to access OBS, you must specify security_token when creating an instance.
obsClient = ObsClient(access_key_id=ak, secret_access_key=sk, server=server)
try:
    bucket_name = 'examplebucket'

    rule = ObjectLockRule(
        # Number of retention days or years. Only one of Days and Years can be set to a value other than 0.
        days=60
        # years=1
    )
    config = ObjectLockConfiguration(objectLockEnabled="Enabled", rule=rule)
    # Configure a default WORM policy for the bucket.
    resp = obsClient.setBucketObjectLock(bucket_name, config)
    # Calling the setBucketObjectLock API without including config indicates deleting the configuration of the default bucket-level WORM policy.
    # resp = obsClient.setBucketObjectLock(bucket_name)

    # If status code 2xx is returned, the API call succeeds. Otherwise, the API call fails.
    if resp.status < 300:
        print('Set Bucket ObjectLock Succeeded')
        print('requestId:', resp.requestId)
    else:
        print('Set Bucket ObjectLock Failed')
        print('requestId:', resp.requestId)
        print('errorCode:', resp.errorCode)
        print('errorMessage:', resp.errorMessage)
except Exception:
    print('Set Bucket ObjectLock Failed')
    print(traceback.format_exc())
 
 
  

Parent topic: Write-Once-Read-Many (WORM) (SDK for Python)

Previous topic: Write-Once-Read-Many (WORM) (SDK for Python)

Next topic: Obtaining the Default WORM Policy of a Bucket (SDK for Python)

Feedback

Was this page helpful?

Helpful Not helpful

Provide feedback

Thank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.

The system is busy. Please try again later.

For any further questions, feel free to contact us through the chatbot.

Chatbot