You can create an S3 bucket on ECS with Object Lock enabled by using one of many utilities. You cannot use the ECS management UI to create a bucket with Object Lock or enable Object Lock on an existing bucket.

Using the AWS CLI

Install and configure the AWS CLI, and then create the Object Lock enabled bucket.

Install and configure the AWS CLI

To install the AWS CLI on your Windows, Mac, or Linux client, see the following AWS documentation: Installing or updating the latest version of the AWS CLI.

Create an AWS CLI local profile, which allows you to specify the access key ID and secret that you will use. This example creates the local AWS CLI user iamuser1:

Create an Object Lock enabled bucket

To create a bucket with the Object Lock feature enabled, run the following command:

To check that the bucket has been created with Object Lock enabled, run this command:

You cannot use the AWS CLI to create a bucket in an ADO enabled namespace. Therefore, if you try to create a bucket with Object Lock enabled and using an access key that is in an ECS namespace with ADO enabled, you will get the following error:

Using s3curl

The s3curl tool is a wrapper around curl that allows the Amazon S3 API to interact with ECS (create buckets; write, read, or delete objects; and so on). To use s3curl with ECS and its x-emc headers, minor modifications must be made to the s3curl Perl script. You can obtain the modified, ECS specific version of s3curl from the ECS GitHub repository.

Configure ss3curl

S3curl uses a configuration file .s3curl to hold account details.

Each of the imm => entries store the access ID and the secret key that you will be using.

The @endpoint=(‘…’) is a list of HTTP endpoints that will be used,

Note: All user access accounts being used must be IAM based to use Object Lock functionality.

Create an Object Lock enabled bucket

To create a bucket with Object Lock enabled, run the following command:

The use of -H "x-emc-is-stale-allowed: false" ensures that the bucket being created does not have ADO enabled even if it is the default setting for the namespace in which the IAM user has been created.

You can also enable Object Lock on a previously created bucket:

You can also set the retention mode and default retention period for a bucket. For example:

You can query for the bucket Object Lock status as follows:

Note: Veeam Backup & Replication does not support the setting of the default retention mode or retention period on a bucket. You are only required to enable Object Lock on the bucket.

Using Postman

Postman is a commonly used UI-based utility that allows you to use S3 API methods. Postman is available for download at https://www.postman.com/downloads/.

You must create an account with Postman.

Create an Object Lock enabled bucket

Using Postman, create a Postman Collection (to group your requests). Then create a request to create a bucket with Object Lock enabled and the x-emc-is-stale-allowed flag. These settings ensure that the bucket will not be created with ADO enabled (which would fail if the namespace had ADO enabled by default).

On the Authorization tab, include the IAM user key and secret:

You can get the Object Lock status of the bucket as follows:

You can set the default bucket retention mode and retention period. In this example, the Body section is used to pass the XML in the request:

View the object status of the bucket:

Note: Veeam Backup & Replication does not support setting the bucket retention mode or default retention period. Veeam Backup & Replication requires that the bucket only has Object Lock enabled.