WORM

Updated on 2024-10-24 GMT+08:00

View PDF

OBS provides write-once-read-many (WORM) to protect objects from being deleted or tampered with within a specified period. WORM works at both the bucket and object levels in compliance mode.

Scenarios

In compliance mode, a WORM-protected object version cannot be overwritten or deleted by anyone, including the root user in your account.

When WORM is configured for a bucket, the protection applies to all objects in the bucket. When WORM is configured for an object version, the protection applies to the current object version only. No matter which type of WORM protection you want to use, you must enable WORM for the bucket first. A bucket-level WORM retention policy takes effect only for objects uploaded after the policy was configured. If an object is protected by a bucket-level WORM policy and an object-level WORM policy at the same time, the object-level WORM policy takes precedence.

Precautions

When you enable WORM for a bucket, OBS automatically enables versioning and versioning cannot be suspended later for that bucket. WORM protects objects based on the object version IDs. Only object versions with any WORM retention policy configured can be protected. Assume that object test.txt 001 is protected by WORM. If another file with the same name is uploaded, a new object version test.txt 002 with no WORM policy configured will be generated. In such case, test.txt 002 is not protected and can be deleted. When you download an object without specifying a version ID, the current object version (test.txt 002) will be downloaded.
A lifecycle rule cannot delete WORM-protected objects, but can transition their storage class. After an object is no longer protected, it will be deleted when meeting the expiration rule in a lifecycle configuration.
If you do not enable WORM when creating a bucket, you cannot enable or configure it for that bucket later. If you cannot configure WORM for a bucket, it may be because you did not enable WORM when you created the bucket or your bucket was created before this feature was released. In such case, to use WORM, you need to create a new bucket and enable WORM for it.
Once you enable WORM for a bucket, you cannot disable it or suspend versioning for the bucket, but you can disable the default WORM policy for the bucket.
Buckets with WORM enabled do not support cross-region replication.
If you have deregistered your account or your account has been frozen, the WORM-protected objects will be permanently deleted.
WORM-based protection is not available for migration.
The metadata of a WORM-protected object can still be modified.

How to Use

You can perform WORM-related operations using OBS Console and OBS API.

Tool	Reference
OBS Console	Creating a Bucket Uploading an Object Configuring WORM Retention
API	Creating a Bucket Configuring a Default WORM Policy for a Bucket Obtaining the Default WORM Policy of a Bucket Configuring WORM Retention for an Object Obtain the object-level WORM retention configuration by referring to Querying Object Metadata.

Tool

Reference

OBS Console

Creating a Bucket

Uploading an Object

Configuring WORM Retention

API

Creating a Bucket

Configuring a Default WORM Policy for a Bucket

Obtaining the Default WORM Policy of a Bucket

Configuring WORM Retention for an Object

Obtain the object-level WORM retention configuration by referring to Querying Object Metadata.

Parent topic: Data Security

Previous topic: Server-Side Encryption

Next topic: CORS

Feedback

Was this page helpful?

Helpful Not helpful

Provide feedback

Thank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.

The system is busy. Please try again later.

Which of the following issues have you encountered?

Content is inconsistent with the product UI

Unclear descriptions

Lack of examples or code

Incorrect steps

Can't find what I need

Lack of best practices

Feedback (optional)

0/500

Select at least one type of issue, and enter your comments or suggestions.

Enter a maximum of 500 characters.

Submit Cancel

For any further questions, feel free to contact us through the chatbot.

Chatbot