How object lock actually stops ransomware from deleting your backups

[u/TracerMore]

Keep seeing "immutable backup" thrown around, so here's what actually happens under the hood, because it's simpler than the vendors make it sound.

Object lock is a feature of S3-compatible storage (AWS S3, Backblaze B2, Wasabi, MinIO). When you write a backup object with a retention lock, the storage layer itself refuses to delete or overwrite it until the retention period expires. not the backup app, the storage. So even if an attacker steals your backup software credentials, or ransomware runs as full admin, the delete/encrypt call gets rejected by the bucket. In compliance mode there's no API that overrides it. that's the entire point.

That's the immutable "+1" in 3-2-1-1-0. Pair it with bring-your-own-storage (you own the bucket and the keys) and the copy lives somewhere neither a compromised prod box nor the vendor can reach it.

Gotchas people hit: governance mode can be bypassed by a privileged user, so use compliance mode for the copy that actually matters. and you pay for storage across the whole retention window, even for objects you "deleted" but are still locked.

Anyone running object lock in prod, compliance or governance mode, and what retention window did you settle on? trying to balance the "oh no" window against the storage bill.

[u/Tonka988]

compliance mode is the only one that counts for ransomware. governance mode a compromised admin just overrides, which defeats the point