All backup guides

Back up files with S3 Object Lock

S3 Object Lock can stop a retained backup object from being deleted or overwritten. The storage provider enforces the lock; MomentBackup does not switch it on for you.

1. Create the bucket first

Use a provider that supports S3 Versioning and Object Lock. The exact screens vary. For Amazon S3, enable Bucket Versioning and Object Lock when you create the bucket, then set a default retention period under the bucket’s Properties tab. AWS documents the full setup.

Keep public access blocked. Create least-privilege credentials for an IAM user, scoped to this bucket and the prefix MomentBackup will use. Do not use an administrator key.

On Amazon S3, choose the retention mode carefully:

• Governance: a specially allowed account can bypass the lock.
• Compliance: the retention period cannot be shortened through normal S3 controls.

Other S3-compatible providers may use different modes and rules. Read their own Object Lock documentation. Locked versions use storage until their retention dates pass, so a longer period costs more. If you are unsure, start with a short Amazon S3 governance period and run the checks below before choosing a stricter policy.

2. Connect the bucket

In MomentBackup, open Destinations, choose Add a place, then choose Object storage. Enter the endpoint, region, bucket, optional folder prefix, access key ID, and secret key supplied by the provider.

An S3 backup copy keeps the primary repository’s encryption state. If the primary is encrypted, save its recovery key somewhere separate. S3 destinations hold File History, not whole-computer images.

3. Check the provider applied the lock

Run a backup and wait for it to finish. If S3 is a second copy, also wait for Backup health to report that the copy succeeded. In the provider’s console, inspect one new object version. It should show a retention mode and a future retain-until date.

If it does not, stop: versioning alone keeps old versions, but it does not make them undeletable. Fix the bucket policy before relying on it. Use a disposable test object and the same scoped permission policy to confirm that all versions can be listed, deletion is refused, and the retained version can still be read. Do not run a deletion test against the only copy of a real backup.

Finally, restore one small file through Backup Explorer and open it.

Need a hand? Email [email protected]. Ready to start? Download MomentBackup.