Help Center/ Object Storage Service/ User Guide/ Data Security/ Configuring WORM to Prevent Objects from Being Overwritten or Deleted/ Configuring WORM for a Bucket
Updated on 2026-08-21 GMT+08:00
View PDF
Share

Configuring WORM for a Bucket

If you want to prevent any user (including the bucket or object owner) from modifying or deleting all objects in an OBS bucket for a specified period, you can configure bucket-level WORM.

This section describes how to configure WORM when creating a bucket, after a bucket is created, and how to cancel or modify the default retention period of bucket-level WORM.

Constraints

  • Once WORM is enabled for a bucket, it cannot be disabled. However, you can disable the bucket's default retention period.
  • Once WORM is enabled for a bucket, versioning cannot be suspended for that bucket.
  • Buckets with WORM enabled do not support cross-region replication.
  • A bucket-level WORM policy applies only to objects uploaded after the policy is configured. To protect existing objects, configure object-level WORM separately.
  • WORM-protected objects cannot be migrated.
  • The metadata of a WORM-protected object can still be modified.
  • Parallel file systems do not support WORM.

Important Notes

  • Before configuring object-level WORM, you must enable bucket-level WORM. If an object is protected by both bucket-level and object-level WORM, the object-level WORM policy takes precedence.
  • The retention period of object-level WORM can only be extended but cannot be shortened.
  • If you have deregistered your account or your account has been frozen, the WORM-protected objects will be permanently deleted.
  • WORM does not protect parts generated during multipart uploads.
  • When configuring bucket logging, do not store logs in a bucket with an active WORM retention policy. Because old files cannot be deleted, storage cost will continue to increase.
  • If a bucket has WORM enabled, an append upload on this bucket will fail, with a 403 error returned.
  • Only the compliance mode is supported.

Access Control

To configure a bucket-level WORM policy, you must be the bucket owner or have the required permission. For authorization details, see Configuring a Default WORM Policy for a Bucket.

Configuring WORM When Creating a Bucket

You can use OBS Console or APIs to configure bucket-level WORM.

Using OBS Console

  1. In the navigation pane of OBS Console, choose Buckets.
  2. In the upper right corner, click Create Bucket.
  3. Under Properties, enable WORM and configure the default retention period.

    For other parameters about creating a bucket, see Using OBS Console.

    After WORM is enabled, you must configure the default retention period to apply the retention policy. During this period, OBS prevents protected object versions from being deleted. You can configure a retention period in either days (from 1 to 36500) or years (from 1 to 100). The upper limit is 100 years.

    After WORM is enabled, the following constraints apply:

    • WORM cannot be disabled once enabled. However, you can choose whether to configure the default retention period to control whether objects can be written or deleted.
    • Enabling WORM automatically enables versioning, and versioning cannot be disabled later.
    • A bucket with WORM enabled does not support cross-region replication, and any existing replication rules applied to the bucket become invalid.
    • When you upload an object to a WORM-protected bucket, the object inherits the bucket's WORM retention settings by default. You can also configure a different retention period for the object under advanced settings. Object-level WORM takes precedence over bucket-level WORM.

Using APIs

Creating a Bucket

Configuring WORM After a Bucket Is Created

You can use OBS Console or APIs to configure bucket-level WORM.

Using OBS Console

  1. In the navigation pane of OBS Console, choose Buckets.
  2. In the bucket list, click the desired bucket. The Objects page is displayed.
  3. In the navigation pane, choose Overview.
  4. In the Basic Configurations area, click WORM. The WORM dialog box is displayed.
  5. Choose Configure and specify a default retention period. The default retention mode is Compliance.

    • Only the compliance retention mode is currently supported. In this mode, no users can delete protected object versions or change their retention mode during the specified retention period.
    • During the specified default retention period, OBS prevents WORM-protected object versions from being deleted. You can configure a retention period in either days (from 1 to 36500) or years (from 1 to 100). The upper limit is 100 years.
    • When you upload an object to a WORM-protected bucket, the object inherits the WORM retention from the bucket by default. You can also configure a different WORM retention for the object under advanced settings. If both bucket-level and object-level WORM retention policies are applied to an object, the object-level retention policy will be used.
    Figure 1 Configuring a WORM retention policy

  6. Enable WORM and select and specify the default retention period.

    After WORM is enabled, you must configure the default retention period to apply the retention policy. During this period, OBS prevents protected object versions from being deleted. You can configure a retention period in either days (from 1 to 36500) or years (from 1 to 100). The upper limit is 100 years.

    After WORM is enabled, the following constraints apply:

    • WORM cannot be disabled once enabled. However, you can choose whether to configure the default retention period to control whether objects can be written or deleted.
    • Enabling WORM automatically enables versioning, and versioning cannot be disabled later.
    • A bucket with WORM enabled does not support cross-region replication, and any existing replication rules applied to the bucket become invalid.
    • When you upload an object to a WORM-protected bucket, the object inherits the bucket's WORM retention settings by default. You can also configure a different retention period for the object under advanced settings. Object-level WORM takes precedence over bucket-level WORM.

  7. Click OK.

Using APIs

Configuring a Default WORM Policy for a Bucket

You can use the following API to view the configured bucket-level WORM policy:

Obtaining the Default WORM Policy of a Bucket

Canceling or Modifying the Default Retention Period

You can use OBS Console or APIs to cancel or modify the default retention period.

Using OBS Console

  1. In the navigation pane of OBS Console, choose Buckets.
  2. In the bucket list, click the desired bucket. The Objects page is displayed.
  3. In the navigation pane, choose Overview.
  4. In the Basic Configurations area, click WORM. The WORM dialog box is displayed.
  5. Cancel or modify the default retention period.

    • To cancel the default retention period, clear the Default Retention Period (Optional) check box.

    • To modify the default retention period, enter a new value in the text box.

  6. Click OK.

Using APIs

To cancel or modify the default retention period, leave the parameters in the Rule element blank or update their values using the API described in Configuring a Default WORM Policy for a Bucket.

References

Object Deletion When Both WORM and Versioning Are Enabled

  • Delete markers are not protected by WORM and can be deleted normally.
  • All object versions cannot be deleted during the WORM retention period.
  • Lifecycle rules can remove expired delete markers but cannot delete object versions that are still within the WORM retention period.

Does Using Both WORM and Versioning Increase Storage Costs?

Yes. Storage costs will increase.

After WORM takes effect, all object versions in the bucket are retained. During the retention period, objects cannot be deleted manually or through lifecycle rules. Frequent object updates generate many versions, and old versions cannot be deleted promptly, which increases storage costs.

You are advised to set an appropriate retention period. You can also configure lifecycle rules to transition objects between storage classes to reduce costs.

When Is WORM Needed?

Enable WORM when important files must be retained for a long time and cannot be modified or deleted. Set a retention period that meets your compliance or business requirements. The important files include registered customer data, contract documents, technical documents, and medical records.

Parent Topic: Configuring WORM to Prevent Objects from Being Overwritten or Deleted