Chung-En Lee created HDDS-15945:
-----------------------------------
Summary: Support S3 WORM (Object Lock)
Key: HDDS-15945
URL: https://issues.apache.org/jira/browse/HDDS-15945
Project: Apache Ozone
Issue Type: New Feature
Reporter: Chung-En Lee
Assignee: Chung-En Lee
Currently, Ozone does not support per-bucket and per-object S3 WORM (Object
Lock) configuration. This means objects can be overwritten or deleted at any
time, which does not meet compliance requirements (e.g. SEC Rule 17a-4).
We can implement S3 Object Lock configuration
([https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock.html]) by
adding Object Lock and Retention metadata to {{OmBucketInfo}} and {{OmKeyInfo}}
in OM DB.
The flow looks something like:
# User uses S3 API to enable Object Lock on a bucket, set default retention,
or configure retention/legal hold on a specific object
([https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-overview.html]).
# S3G parses the XML payload and sends the corresponding request
({{{}SetBucketObjectLockConfiguration{}}}, {{{}PutObjectRetention{}}},
{{{}PutObjectLegalHold{}}}) to OM.
# OM updates {{OmBucketInfo}} or {{OmKeyInfo}} with the Object
Lock/Retention/LegalHold policy.
# During delete ({{{}DeleteKey{}}}) or overwrite operations, OM validates the
active retention period and legal hold status against {{{}OmKeyInfo{}}}. If the
object is under active lock, OM rejects the deletion/overwrite request unless
bypassed with proper governance permissions.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
