View a markdown version of this page

AWS::S3::Bucket DefaultEventHold - Amazon CloudFormation
SyntaxPropertiesExamples
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

This is the new Amazon CloudFormation Template Reference Guide. Please update your bookmarks and links. For help getting started with CloudFormation, see the Amazon CloudFormation User Guide.

AWS::S3::Bucket DefaultEventHold

The default Object Lock event hold duration that you want to apply to new objects placed in the specified bucket, unless an object's upload request specifies its own Object Lock settings. New object versions are placed under an event hold and remain protected while the hold is active. When the event hold is released, Amazon S3 retains the object version for this duration, measured from the time the hold is released.

Note

The DefaultEventHold duration can be specified in either Days or Years, but you must select one. You can't specify Days and Years at the same time.

Syntax

To declare this entity in your Amazon CloudFormation template, use the following syntax:

JSON

{
  "Days" : Integer,
  "Years" : Integer
}

YAML

  Days: Integer
  Years: Integer

Properties

Days

The number of days that you want to specify for the default event hold duration. Valid values are 1 to 36500 days. You must specify either Days or Years, but not both.

Required: Conditional

Type: Integer

Update requires: No interruption

Years

The number of years that you want to specify for the default event hold duration. Valid values are 1 to 100 years. You must specify either Days or Years, but not both.

Required: Conditional

Type: Integer

Update requires: No interruption

Examples

Set a bucket default event hold

The following example enables Object Lock on a bucket and configures a default retention that places an event hold with a 365-day duration on every new object. While the event hold is active, the object version is protected; when the hold is released, Amazon retains the object version for 365 days from the release time. A default event hold is useful as a ransomware recovery window or to start the retention countdown from a business event.

JSON


{
  "Resources": {
    "S3Bucket": {
      "Type": "AWS::S3::Bucket",
      "DeletionPolicy": "Retain",
      "Properties": {
        "BucketName": "amzn-s3-demo-bucket1",
        "ObjectLockEnabled": true,
        "ObjectLockConfiguration": {
          "ObjectLockEnabled": "Enabled",
          "Rule": {
            "DefaultRetention": {
              "Mode": "COMPLIANCE",
              "DefaultEventHold": {
                "Days": 365
              }
            }
          }
        }
      }
    }
  }
}

YAML


Resources:
  S3Bucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain
    Properties:
      BucketName: amzn-s3-demo-bucket1
      ObjectLockEnabled: true
      ObjectLockConfiguration:
        ObjectLockEnabled: Enabled
        Rule:
          DefaultRetention:
            Mode: COMPLIANCE
            DefaultEventHold:
              Days: 365

Combine a default retention period with an event hold

The following example configures a bucket default that combines a fixed retention period with an event hold. The event hold duration can't exceed the default retention period, so a 1-year event hold is valid alongside a 2-year retention period.

JSON


{
  "Resources": {
    "S3Bucket": {
      "Type": "AWS::S3::Bucket",
      "DeletionPolicy": "Retain",
      "Properties": {
        "BucketName": "amzn-s3-demo-bucket1",
        "ObjectLockEnabled": true,
        "ObjectLockConfiguration": {
          "ObjectLockEnabled": "Enabled",
          "Rule": {
            "DefaultRetention": {
              "Mode": "GOVERNANCE",
              "Years": 2,
              "DefaultEventHold": {
                "Years": 1
              }
            }
          }
        }
      }
    }
  }
}

YAML


Resources:
  S3Bucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain
    Properties:
      BucketName: amzn-s3-demo-bucket1
      ObjectLockEnabled: true
      ObjectLockConfiguration:
        ObjectLockEnabled: Enabled
        Rule:
          DefaultRetention:
            Mode: GOVERNANCE
            Years: 2
            DefaultEventHold:
              Years: 1