Write Once, Read Many (WORM) storage makes retained data immutable: once a record is protected, its contents cannot be changed or deleted until the applicable retention restriction ends. Applications can read the record repeatedly, subject to access permissions and storage-tier retrieval requirements. Typical uses include financial records, security logs, legal evidence, and backup recovery points that must survive accidental deletion or compromised administrator credentials.
Cloud implementations usually enforce immutability through storage-service controls rather than physically write-once media. Retention can apply to individual object versions, archives, containers, or backup recovery points, depending on the service. A time-based retention rule prevents deletion until a specified date. A legal hold preserves records without a fixed expiration and remains effective until an authorized user removes it. Where both apply, removing a hold does not cancel an unexpired retention period.
Administrative bypass behavior is critical. A governance-style mode permits specifically authorized administrators to bypass retention, which supports testing and operational exceptions but provides weaker protection against privileged compromise. A compliance-style mode prevents customers, including their highest-privilege administrators, from shortening or bypassing active retention after the relevant lock becomes irreversible. Engineers should test policies before making irreversible commitments and verify precisely which data and administrative operations the mechanism protects.
Amazon S3 Object Lock illustrates version-level WORM protection. It requires S3 Versioning and protects specific object versions using retention settings, legal holds, or both. Uploading another object under the same key creates a new version rather than changing the protected version. A delete marker can hide the object from ordinary current-version requests without deleting its protected versions. Applications and investigations must therefore distinguish an object's current view from its retained version history.
Versioning alone is not WORM: sufficiently privileged users can permanently delete unprotected versions. Likewise, an access policy denying deletion is not equivalent to an irreversible retention lock if administrators can change that policy. For existing vault-based Amazon S3 Glacier archives, Vault Lock locks a vault policy that can enforce retention restrictions. This mechanism is distinct from S3 Object Lock applied to objects stored in S3 Glacier storage classes.
WORM prevents prohibited changes; it does not prove that the original data was correct or authentic. Checksums and file validation detect changes when compared with trusted reference values. Digital code signing adds publisher authentication and integrity verification when the signing key and trust chain are protected. For example, CloudTrail log file integrity validation uses signed digest files to help detect log modification or deletion, while WORM retention separately prevents protected log versions from being deleted. Encryption protects confidentiality, not immutability.
Consider a team retaining audit logs for seven years. It can apply default retention to new log objects, restrict who can change retention settings, and verify that previously stored objects are also protected. The design should preserve decryption keys, separate storage administration from security administration, and regularly test retrieval and integrity validation. WORM does not prevent loss of access caused by destroyed encryption keys, nor does it replace independent backups or disaster recovery.
The main trade-offs are storage cost, limited correction and deletion options, and possible conflict with data-minimization requirements. Incorrect or sensitive records cannot simply be removed during enforced retention; corrections generally require additional records or versions. Lifecycle expiration cannot remove protected versions before retention permits deletion, and expiration of retention merely makes deletion possible rather than automatically deleting the data. Select retention periods through documented business and legal requirements rather than treating indefinite retention as inherently safer.
Amazon S3
AWS Backup