Versions, retention, and holds | CCSP: cloud security, data, and operations

Concept and mechanism

In an S3 bucket with versioning enabled, a DELETE without versionId normally creates a delete marker as the current version. Reading without versionId can return 404 and identify that marker while earlier versions still exist. Complete-deletion conclusions require inventory and treatment of relevant copies. ListObjectVersions supports examining versions and markers; current-object listing does not replace that inventory. Keep scope explicit because versioning states and operations with versionId behave differently. The application interface can show a missing document without establishing that every byte was removed from storage or replicas.

Guided application

In a fictional archive, Object Lock protects a specific version. A new PUT under the same key can create another version without changing the protected earlier one. Distinguish retention from legal hold: a fixed period can expire while the hold remains until authorized removal. Current documentation also includes variable retention; do not generalize every case as a fixed date. In governance mode, technical bypass requires permission and request indication; this does not replace organizational authority or automatically remove a hold. To reduce costs, FinOps should coordinate with preservation owners. Cleanup reporting should identify versions, retention, copies, and pending decisions. Replicating data also does not mean lifecycle configuration and every deletion form propagate identically.

IN PRACTICE

404 with a delete marker does not prove version destruction; an active hold does not end when fixed retention expires.

Common pitfalls

GET as inventory; lock as blocking new versions; bypass as authority; replication as uniform deletion.

Related topics: Architecture, responsibilities, and portability · Data protection, location, and classification · Infrastructure, isolation, and recovery

Take this idea with you

Decide on concrete versions and protections with authority and evidence.

Create account

Reference: S3 Object Lock per-version retention and legal holds · CCSP examination outline effective 2026-08-01; January2026 V2 PDF