S3 audit/compliance bucket has no object-lock configuration

What it checks

S3 audit/compliance bucket has no object-lock configuration

Where it applies

Terraform: aws_s3_bucket

CloudFormation: AWS::S3::Bucket

How to fix it

1. Enable versioning on the bucket, then add an aws_s3_bucket_object_lock_configuration with rule.default_retention { mode = "COMPLIANCE" days = <retention-days> } referencing it. Object Lock can be enabled on an existing bucket; it needs versioning, and once it is on neither Object Lock nor versioning can be turned off.

Frameworks

• AWS FSBP S3.15
• PCI-DSS v4.0.1/10.5.1
• SOC 2 CC6.1

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules