Legal Holds

A legal hold prevents the routine disposal of information that must remain available for a legal matter or investigation. Unlike a retention policy that preserves records for a defined period, a legal hold generally continues until explicitly released. Legal or records-management teams determine the preservation obligation, while engineers implement controls that protect the relevant data and demonstrate that those controls remain effective.

Start by defining the scope of preservation. Relevant information might include customer transactions, application logs, previous object versions, file-system data, or database recovery points. Record identifiers, timestamps, ownership, case references, and the systems containing additional copies. A tag or case label can help locate evidence, but it does not itself prevent deletion. A one-time snapshot also does not automatically preserve relevant information created after that snapshot.

Cloud object storage can enforce preservation on individual object versions. For example, Amazon S3 Object Lock supports legal holds on object versions in an Object Lock-enabled bucket. A legal hold has an ON or OFF state and no automatic expiration date. While the hold is active, the protected version cannot be permanently deleted. Applications can still create newer versions, and a delete marker can hide the object from ordinary reads. Preservation therefore protects the underlying evidence without necessarily freezing the application's current view.

Legal holds and time-based retention are independent controls. In S3, a legal hold can coexist with governance-mode or compliance-mode retention. Expiration of a retention period does not release an active legal hold, and removing a hold does not cancel an unexpired retention requirement. Permission to bypass governance retention does not bypass a legal hold. However, a principal authorized to change the legal-hold state can remove it, making restricted administration and monitored release procedures essential.

Automatic lifecycle management must distinguish storage optimization from disposal. S3 Lifecycle can transition protected versions between storage classes, but it cannot permanently delete a version while Object Lock protection applies. Archiving can reduce storage costs while adding retrieval delays and charges. After a hold is released, data that already meets lifecycle expiration conditions can become eligible for deletion if no other protection remains. Release workflows should therefore evaluate disposal consequences before changing protection.

Backup preservation applies the same principle to recovery points. AWS Backup legal holds protect selected supported recovery points against deletion independently of their scheduled retention expiration. They are distinct from AWS Backup Vault Lock, which enforces retention constraints. An ordinary backup schedule does not by itself establish a legal hold, and preserving a backup does not freeze changes in the source application.

File-system lifecycle and backup policies also require careful interpretation. Amazon EFS Lifecycle policies move eligible files between storage classes; they do not establish legal holds. Amazon FSx for Lustre supports native backups for eligible persistent file systems, but not for scratch file systems or file systems linked to S3 data repositories. Select a supported preservation approach for the actual configuration. Exporting relevant data to S3 and protecting the resulting object versions is one option, not a universal requirement; verify that the capture includes the required content and metadata.

A practical preservation design separates application permissions from hold administration, records hold changes, verifies coverage, and periodically tests retrieval. Protect encryption keys and supporting metadata because undeletable ciphertext can still become unusable if its key is destroyed. Preserve integrity information and provenance needed for evidentiary review. Budget for indefinite storage, backup granularity, and archive retrieval costs. Encryption, versioning, ordinary backups, and access policies support preservation, but none alone establishes a complete legal-hold process.