[jira] [Commented] (HDDS-15945) Support S3 WORM (Object Lock)

["Sammi Chen (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/HDDS-15945?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18103902#comment-18103902 ] 

Sammi Chen commented on HDDS-15945:
-----------------------------------

Thanks [~chungen] for focusing on this important S3 feature. If there is a design doc for this, we can have it reviewed by broader community members. 

> Support S3 WORM (Object Lock)
> -----------------------------
>
>                 Key: HDDS-15945
>                 URL: https://issues.apache.org/jira/browse/HDDS-15945
>             Project: Apache Ozone
>          Issue Type: New Feature
>            Reporter: Chung-En Lee
>            Assignee: Chung-En Lee
>            Priority: Major
>
> Currently, Ozone does not support per-bucket and per-object S3 WORM (Object Lock) configuration. This means objects can be overwritten or deleted at any time, which does not meet compliance requirements (e.g. SEC Rule 17a-4).
> We can implement S3 Object Lock configuration ([https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock.html]) by adding Object Lock and Retention metadata to {{OmBucketInfo}} and {{OmKeyInfo}} in OM DB.
> The flow looks something like:
>  # User uses S3 API to enable Object Lock on a bucket, set default retention, or configure retention/legal hold on a specific object ([https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-overview.html]).
>  # S3G parses the XML payload and sends the corresponding request ({{{}SetBucketObjectLockConfiguration{}}}, {{{}PutObjectRetention{}}}, {{{}PutObjectLegalHold{}}}) to OM.
>  # OM updates {{OmBucketInfo}} or {{OmKeyInfo}} with the Object Lock/Retention/LegalHold policy.
>  # During delete ({{{}DeleteKey{}}}) or overwrite operations, OM validates the active retention period and legal hold status against {{{}OmKeyInfo{}}}. If the object is under active lock, OM rejects the deletion/overwrite request unless bypassed with proper governance permissions.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org