Object Lock: Limit retention to a maximum number of days and add an option to disable COMPLIANCE lock on a bucket

Add configuration on bucket or container vault or both that limits the maximum number of days allowed when using object lock. Configuration can be made using service API or GUI as this is not something supported on s3api.

Another option that might be useful is to disable COMPLIANCE lock on a bucket and only allow GOVERNANCE lock.

When a client requests a protection that is not allowed, the request should fail with some kind of unsupported message similar to before GOVERNANCE mode was implemented.

Use case

We sell capacity on our shared COS environment to our customers and see the need to provide immutability as an option. If the bucket is placed on a container vault with object lock enabled, the customer can activate object lock if required.

At the point when object lock on a bucket is enabled, there are no real limit to the number of days a customer can lock an object. This can pin data on our COS for years by mistake or misunderstanding how object lock works. If the user has requested a 10 years lock on an object, we must wait 10 years before we can delete the data.

Our contracts with our customers typically lasts for 3-5 years before they are renegotiated. If the customer decides to end the the contract, we are obligated to delete the data we store for the customer within reasonable time due to GDPR. 

I would recommend our customer to limit object lock to maximum 1 year and make a process to extend the lock every 6 months if needed.
(A lifecycle rule to extend object lock retention would be a great feature enhancement).