Strict compliance requirements in industries such as healthcare and finance prohibit the deletion or overwriting of certain files within a specified timeframe. These requirements help ensure data integrity and auditability. TOS offers a retention policy feature that helps meet these requirements by preventing objects from being deleted or overwritten for a set period of time. This feature enables write-once, read-many (WORM) storage. This topic explains the use cases, notes, and steps for configuring a retention policy.

Introduction

First, enable object locking on the bucket in order to use the retention policy feature. Once enabled, you can set a retention period for the entire bucket or a specific object. The details are as follows:

Bucket retention period: TOS allows you to set a retention period for a bucket. Newly uploaded objects without a specific retention period automatically inherit the bucket's retention period and are locked. This means these objects cannot be deleted or overwritten until the retention period ends. However, objects uploaded before the bucket's retention period was established do not automatically inherit this retention period.

Object retention period: TOS allows you to set a retention period for individual objects. You can configure a retention period for both existing and newly uploaded objects. Object retention periods take precedence over bucket retention periods. If both are configured, the object will use the object retention period.

If object locking is enabled but no retention period is set, objects will not enter a locked state and will not be protected against deletion or overwriting.

Use cases

The retention policy feature supports WORM, enabling customers to store electronic records in an unerasable and indelible format that meets specific industry regulatory requirements. This feature is ideal for scenarios requiring compliance, tamper resistance, and deletion protection.

Machine learning: Data obtained from long-term model training is a valuable asset. Accidentally overwriting or deleting these data sources or the model data during training can disrupt the process and waste GPU resources. A retention policy can protect this data from being overwritten or deleted arbitrarily.

Intelligent driving: To protect critical data, such as sensor data, model training sets, and log files, and to comply with stringent regulatory requirements, intelligent driving systems can use a retention policy. This policy ensures that once data is written, it cannot be deleted or overwritten. This enhances the system's overall security and credibility.

Compliance: Institutions in finance, insurance, and healthcare must comply with strict laws and regulations that require rigorous management and protection of sensitive information, such as imaging data and customer records. Retention policies can prevent data from being overwritten or deleted during the specified period, thus meeting compliance and audit requirements.

Notes

Retention period

Once you enable object locking, you cannot disable it. However, you can disable the retention period.

Bucket retention periods can be adjusted to be longer or shorter. However, object retention periods can only be extended, not reduced.

Object retention periods cannot be canceled and will only expire automatically once the designated period ends. Therefore, once an object retention period is set, neither the object owner nor anyone else can delete or overwrite the object before the period ends.

Data will be deleted in cases of account closure or overdue payments, even if the retention period has not yet expired.

You cannot perform append operations on a locked appendable object until the retention period expires. After the retention period ends, you can resume appending normally.

Even if you set a retention period for a bucket, incomplete multipart uploads or parts within that bucket are unaffected by the period and can be deleted.

Cross-bucket replication

The object lock status of the source and destination buckets must be consistent—either both are enabled or both are disabled. Otherwise, creation of same-region or cross-region replication rules will fail.

Follow this order to enable replication rules and retention policies for a bucket: First, create the retention policy for the bucket. Then, establish the replication rules. Note that you cannot create a retention policy if replication rules have already been created for a bucket.

Lifecycle rule

A locked object cannot be deleted via a lifecycle rule until its retention period has expired. However, a lifecycle rule can be used to transition it to other storage types.

Lifecycle rule	Object retention period	Execution result
Transition after 10 days	20 days	The object is transitioned on day 10 after upload.
Deletion after 10 days	20 days	The object is not deleted on day 10 after upload. Rather, it is deleted on day 21.
Transition after 30 days	20 days	The object is transitioned on day 30 after upload.
Deletion after 30 days	20 days	The object is deleted on day 30 after upload.

Versioning

TOS allows you to set a retention period for each version of an object. The outcome of delete or overwrite operations on a locked object depends on its versioning state. See below for details.

Versioning state	When you delete a locked object	When you overwrite a locked object or upload an object with the same name
Unversioned	Deletion fails.	Upload fails.
Versioning-enabled	The deletion operation only adds a deletion mark to the locked object rather than permanently deleting it. tip You cannot set retention periods for deletion marks.	A new version is generated and the locked object becomes a historical version.
Versioning-suspended	Deletion fails if the object's version ID is null.	Upload fails if the object's version ID is null.

Configuring retention policies

Applying a retention period to a bucket

Set a retention period when creating a bucket

Set a retention period for an existing bucket

Log in to the TOS console.

In the left navigation pane, click Buckets.

On the Buckets page, click Create bucket.

On the Create bucket page, click Advanced settings. Then, enable Retention policy.

tip

For more information on other parameters when creating a bucket, see Creating buckets.

Once you have finished configuring, click Create.

In the left navigation pane, select Security > Retention policy.

On the Retention policy page, click Edit. Then, enable Default retention period and set the Default retention time.

tip

Currently, only compliance mode is supported, which means that no user can delete or overwrite the locked object during the retention period.

You can specify the duration for how long to protect the objects in the bucket. The duration can range from 1 to 36,500 days or 1 to 100 years.

The default retention time is relative. It begins when an object is uploaded and ends after the specified duration. At that point, the object is unlocked. For incomplete multipart uploads, note that the retention period is calculated from when the task is initiated.

Once you have finished configuring, click Select.

Applying a retention period to an object

Enable object locking.

Log in to the TOS console.

In the left navigation pane, click Buckets. In the Buckets list, click the bucket you want to manage.

In the left navigation pane, select Security > Retention policy.

On the Retention policy page, enable Object locking. Then, click Select.

Apply a retention period to the object.

Set a retention period when uploading an object
Set a retention period for an existing object
You can set a retention period for an object by configuring the x-tos-object-lock-mode and x-tos-object-lock-retain-until-date parameters via the following APIs:
PutObject
PostObject
CreateMultipartUpload
CopyObject
AppendObject
Log in to the TOS console.
In the left navigation pane, click Buckets. In the Buckets list, click the bucket you want to manage.
On the Objects page, click ... > Set retention date in the Actions column of the object you want to manage.
In the Set object retain date dialog, select the date on which you want the retention period to end, and then click OK.
tip
A retention date specifies an absolute time before which an object cannot be deleted or overwritten. Once set, the object remains locked until 11:59:59 p.m. on the specified date. After that time, the lock state ends.
You can also use the PutObjectRetention API to place a retention period on an existing object. For more information, see PutObjectRetention.

Extending retention periods

Bucket retention periods can be adjusted to be longer or shorter. However, object retention periods can only be extended, not reduced.

Extend bucket retention periods

Extend object retention periods

Log in to the TOS console.

In the left navigation pane, click Buckets. In the Buckets list, click the bucket you want to manage.

In the left navigation pane, select Security > Retention policy.

On the Retention policy page, click Edit. Then, change the default retention period to a longer one, and click Select.

Viewing object retention information

Log in to the TOS console.

In the left navigation pane, click Buckets. In the Buckets list, click the bucket you want to manage.

On the Objects page, click Details in the Actions column of the object you want to check.

In the object details panel, view the object's Retention mode and Retention expiration date.

Disabling bucket retention periods

You can only disable bucket retention periods. You cannot cancel existing object retention periods. Once a bucket retention period is disabled, newly uploaded objects will not automatically become locked. Retention periods for existing objects will remain unchanged.

Log in to the TOS console.

In the left navigation pane, click Buckets. In the Buckets list, click the bucket you want to manage.

In the left navigation pane, select Security > Retention policy.

On the Retention policy page, click Edit. Then, disable Default retention period, and click Select.

Torch Object Storage