All Products
Search
Document Center

Object Storage Service:Retention policies

Last Updated:Aug 08, 2023

Object Storage Service (OSS) provides the Write Once Read Many (WORM) feature that you can use to protect objects from being deleted or overwritten within a specific period of time. This feature helps enterprises meet regulatory and compliance requirements of the U.S. Securities and Exchange Commission (SEC) and Financial Industry Regulatory Authority (FINRA).

Prerequisites

  • The bucket for which you want to configure retention policies is located in one of the following regions: China (Hangzhou), China (Shanghai), China (Fuzhou-Local Region), China (Qingdao), China (Beijing), China (Zhangjiakou), China (Hohhot), China (Ulanqab), China (Shenzhen), China (Heyuan), China (Guangzhou), China (Chengdu), China (Hong Kong), US (Silicon Valley), Japan (Tokyo), South Korea (Seoul), Singapore, Australia (Sydney), Malaysia (Kuala Lumpur), Indonesia (Jakarta), Philippines (Manila), Thailand (Bangkok), India (Mumbai), Germany (Frankfurt), UK (London), and UAE (Dubai).

  • Versioning is not enabled for the bucket for which you want to configure retention policies. For more information about versioning, see Overview.

Scenarios

OSS provides strong compliance policies. You can configure time-based retention policies for OSS buckets. After you configure and lock a retention policy for a bucket, you can still upload objects to or read objects from the bucket. However, you cannot delete objects from the bucket or the retention policy within the retention period. You can delete the objects only after the retention period ends. The WORM feature can be used to meet regulatory and compliance requirements for various sectors, such as finance, insurance, health care, and securities, and scenarios such as Multi-Layer Protection Scheme (MLPS) audit of log data. The WORM feature helps you meet your bucket compliance requirements.

Note

OSS is accredited and audited by Cohasset Associates and meets the stringent requirements for retention of electronic records. OSS buckets for which retention policies are configured comply with regulatory regulations, such as SEC Rule 17a-4(f), CFTC Rule 1.31(c)-(d), and FINRA Rule 4511(c). For more information, see OSS Cohasset Assessment Report.

Limits

  • You can configure retention policies only for buckets in OSS.

  • We recommend that you do not enable the OSS-HDFS service and configure retention policies for a bucket.

    If you enable the OSS-HDFS service, configure a retention policy for a bucket, and then delete data from the .dlsdata/ directory by using the methods that are supported by the OSS-HDFS service, a message that indicates that the data is successfully deleted is displayed. However, OSS still retains the deleted data during the retention period that is specified for the retention policy and OSS cannot recognize and delete the data after the retention period expires.

  • During the retention period, you can configure lifecycle rules to convert the storage classes of objects in the bucket. This way, you can reduce costs and ensure compliance. For more information, see Lifecycle rules based on the last modified time.

Retention policy description

  • Implementation

    By default, a time-based retention policy is in the IN_PROGRESS state after the policy is created for a bucket. The retention policy remains in the IN_PROGRESS state for 24 hours. The retention policy protects the specified resources in the bucket within 24 hours after the policy is created.

    • In the 24-hour window after the retention policy is created

      • If the retention policy is not locked, the bucket owner and authorized users can delete the policy.

      • If the retention policy is locked, the retention period of the policy cannot be shortened and the policy cannot be deleted. The retention period can only be extended.

      • If the retention policy is locked, data in the bucket is protected by the retention policy. If you attempt to delete or modify data in the bucket, the 409 FileImmutable error is returned.

    • 24 hours after the retention policy is created

      If the retention policy is not locked 24 hours after the retention policy is created, the policy becomes invalid. You can delete the policy.

  • Deletion

    • A time-based retention policy is a metadata attribute of a bucket. If a bucket is deleted, the retention policy of the bucket is also deleted.

    • If the retention policy is not locked within 24 hours after the policy is created, the bucket owner and authorized users can delete the policy.

    • If a bucket contains objects that are protected within the retention period, you cannot delete the bucket or the retention policy.

  • Examples

    For example, you created a retention policy that has a retention period of 30 days for a bucket on June 1, 2022, and immediately locked the policy. You uploaded the file1.txt, file2.txt, and file3.txt objects to the bucket at different points in time. The following table describes the upload date and expiration date of the objects.

    Object

    Upload date

    Expiration date

    file1.txt

    April 1, 2022

    April 30, 2022

    file2.txt

    June 1, 2022

    June 30, 2022

    file3.txt

    September 1, 2022

    September 30, 2022

Use the OSS console

  1. Create a retention policy.

    1. Log on to the OSS console.

    2. In the left-side navigation tree, choose Content Security > Retention Policy.

    3. On the Retention Policy page, click Create Policy.

    4. In the Create Policy dialog box, specify a retention period in the Retention Period field.

      Note

      The valid retention period ranges from 1 to 25550 days.

    5. Click OK.

      Note

      The retention policy is in the IN_PROGRESS state. If you do not lock or delete the retention policy, the retention policy remains in the IN_PROGRESS state for 24 hours. The retention policy protects the resources in the bucket within 24 hours after the policy is created. If you do not need the retention policy, you can delete the policy within 24 hours after it is created.

  2. Lock the retention policy.

    1. On the Retention Policy page, click Lock.

    2. In the message that appears, click OK.

      Important

      After a time-based retention policy is locked, you cannot shorten the retention period or delete the retention policy. Furthermore, you cannot modify or delete data in the bucket during the retention period.

  3. (Optional) Modify the retention period of the retention policy.

    1. On the Retention Policy page, click Edit.

    2. In the Edit dialog box, modify the retention period.

      Important

      You can extend the retention period, but you cannot shorten the retention period.

Use OSS SDKs

The following code provides examples on how to configure retention policies by using OSS SDKs for common programming languages. For more information about the sample code for configuring retention policies by using OSS SDKs for other programming languages, see Overview.

import com.aliyun.oss.ClientException;
import com.aliyun.oss.OSS;
import com.aliyun.oss.common.auth.*;
import com.aliyun.oss.OSSClientBuilder;
import com.aliyun.oss.OSSException;
import com.aliyun.oss.model.InitiateBucketWormRequest;
import com.aliyun.oss.model.InitiateBucketWormResult;

public class Demo {

    public static void main(String[] args) throws Exception {
        // In this example, the endpoint of the China (Hangzhou) region is used. Specify your actual endpoint. 
        String endpoint = "https://oss-cn-hangzhou.aliyuncs.com";
        // We recommend that you do not save access credentials in the project code. Otherwise, access credentials may be leaked. As a result, the security of all resources in your account is compromised. In this example, access credentials are obtained from environment variables. You need to configure environment variables before you run the sample code. 
        EnvironmentVariableCredentialsProvider credentialsProvider = CredentialsProviderFactory.newEnvironmentVariableCredentialsProvider();
        // Specify the name of the bucket. Example: examplebucket. 
        String bucketName = "examplebucket";

        // Create an OSSClient instance. 
        OSS ossClient = new OSSClientBuilder().build(endpoint, credentialsProvider);

        try {
            // Create an InitiateBucketWormRequest object. 
            InitiateBucketWormRequest initiateBucketWormRequest = new InitiateBucketWormRequest(bucketName);
            // Set the retention period to one day. 
            initiateBucketWormRequest.setRetentionPeriodInDays(1);

            // Create a retention policy for the bucket. 
            InitiateBucketWormResult initiateBucketWormResult = ossClient.initiateBucketWorm(initiateBucketWormRequest);

            // Query the ID of the retention policy. 
            String wormId = initiateBucketWormResult.getWormId();
            System.out.println(wormId);
        } catch (OSSException oe) {
            System.out.println("Caught an OSSException, which means your request made it to OSS, "
                    + "but was rejected with an error response for some reason.");
            System.out.println("Error Message:" + oe.getErrorMessage());
            System.out.println("Error Code:" + oe.getErrorCode());
            System.out.println("Request ID:" + oe.getRequestId());
            System.out.println("Host ID:" + oe.getHostId());
        } catch (ClientException ce) {
            System.out.println("Caught an ClientException, which means the client encountered "
                    + "a serious internal problem while trying to communicate with OSS, "
                    + "such as not being able to access the network.");
            System.out.println("Error Message:" + ce.getMessage());
        } finally {
            if (ossClient != null) {
                ossClient.shutdown();
            }
        }
    }
}
<?php
if (is_file(__DIR__ . '/../autoload.php')) {
    require_once __DIR__ . '/../autoload.php';
}
if (is_file(__DIR__ . '/../vendor/autoload.php')) {
    require_once __DIR__ . '/../vendor/autoload.php';
}

use OSS\OssClient;
use OSS\Core\OssException;

// The AccessKey pair of an Alibaba Cloud account has permissions on all API operations. Using these credentials to perform operations in OSS is a high-risk operation. We recommend that you use a RAM user to call API operations or perform routine O&M. To create a RAM user, log on to the RAM console. 
$accessKeyId = "yourAccessKeyId";
$accessKeySecret = "yourAccessKeySecret";
// In this example, the endpoint of the China (Hangzhou) region is used. Specify your actual endpoint. 
$endpoint = "https://oss-cn-hangzhou.aliyuncs.com";
// Specify the name of the bucket. Example: examplebucket. 
$bucket= "examplebucket";

$ossClient = new OssClient($accessKeyId, $accessKeySecret, $endpoint, false);

try {
    // Create a retention policy and set the retention period to 30 days. 
    $wormId = $ossClient->initiateBucketWorm($bucket, 30);

    // Query the ID of the retention policy. 
    print($wormId);
} catch (OssException $e) {
    printf(__FUNCTION__ . ": FAILED\n");
    printf($e->getMessage() . "\n");
    return;
}

print(__FUNCTION__ . ": OK" . "\n");
const OSS = require('ali-oss');

const client = new OSS({
  // Specify the region in which the bucket is located. For example, if the bucket is located in the China (Hangzhou) region, set the region to oss-cn-hangzhou. 
  region: 'yourregion',
  // The AccessKey pair of an Alibaba Cloud account has permissions on all API operations. Using these credentials to perform operations in OSS is a high-risk operation. We recommend that you use a RAM user to call API operations or perform routine O&M. To create a RAM user, log on to the RAM console. 
  accessKeyId: 'yourAccessKeyId',
  accessKeySecret: 'yourAccessKeySecret'
});
// Create a retention policy for the bucket. 
async function initiateBucketWorm() {
 // Specify the name of the bucket. Example: examplebucket. 
  const bucket = 'examplebucket'
  // Specify a retention period for objects in the bucket. 
  const days = '30'
        const res = await client.initiateBucketWorm(bucket, days)
  console.log(res.wormId)
}

initiateBucketWorm()
# -*- coding: utf-8 -*-
import oss2

# The AccessKey pair of an Alibaba Cloud account has permissions on all API operations. Using these credentials to perform operations in OSS is a high-risk operation. We recommend that you use a RAM user to call API operations or perform routine O&M. To create a RAM user, log on to the RAM console. 
auth = oss2.Auth('yourAccessKeyId', 'yourAccessKeySecret')
# Specify the endpoint of the region in which the bucket is located. For example, if the bucket is located in the China (Hangzhou) region, set the endpoint to https://oss-cn-hangzhou.aliyuncs.com. 
# Specify the name of the bucket. Example: examplebucket. 
bucket = oss2.Bucket(auth, 'https://oss-cn-hangzhou.aliyuncs.com', 'examplebucket')

# Create a retention policy and set the retention period to one day. 
result = bucket.init_bucket_worm(1)
# Query the ID of the retention policy. 
print(result.worm_id)
package main

import (
    "fmt"
    "github.com/aliyun/aliyun-oss-go-sdk/oss"
    "os"
)

func HandleError(err error) {
    fmt.Println("Error:", err)
    os.Exit(-1)
}

func main() {
    // Create an OSSClient instance. 
    // Specify the endpoint of the region in which the bucket is located. For example, if the bucket is located in the China (Hangzhou) region, set the endpoint to https://oss-cn-hangzhou.aliyuncs.com. Specify your actual endpoint. 
    // The AccessKey pair of an Alibaba Cloud account has permissions on all API operations. Using these credentials to perform operations in OSS is a high-risk operation. We recommend that you use a RAM user to call API operations or perform routine O&M. To create a RAM user, log on to the RAM console. 
    client, err := oss.New("yourEndpoint", "yourAccessKeyId", "yourAccessKeySecret")
    if err != nil {
        HandleError(err)
    }

    // Specify the name of the bucket. Example: examplebucket. 
    bucketname := "examplebucket"
    // Set the retention period to 60 days. 
    result,err := client.InitiateBucketWorm(bucketname,60)
    if err != nil {
        HandleError(err)
    }

    fmt.Println(result)
}
#include <alibabacloud/oss/OssClient.h>
using namespace AlibabaCloud::OSS;

int main(void)
{
      /* Initialize information about the account that is used to access OSS. */
      /* The AccessKey pair of an Alibaba Cloud account has permissions on all API operations. Using these credentials to perform operations in OSS is a high-risk operation. We recommend that you use a RAM user to call API operations or perform routine O&M. To create a RAM user, log on to the RAM console. */
      std::string AccessKeyId = "yourAccessKeyId";
      std::string AccessKeySecret = "yourAccessKeySecret";
      /* Specify the endpoint of the region in which the bucket is located. For example, if the bucket is located in the China (Hangzhou) region, set the endpoint to https://oss-cn-hangzhou.aliyuncs.com. */
      std::string Endpoint = "https://oss-cn-hangzhou.aliyuncs.com";
      /* Specify the name of the bucket. Example: examplebucket. */
      std::string BucketName = "examplebucket";

      /* Initialize resources, such as network resources. */
      InitializeSdk();

      ClientConfiguration conf;
      OssClient client(Endpoint, AccessKeyId, AccessKeySecret, conf);
  
        /* Create a retention policy and set the retention period to 10 days. */
      auto outcome = client.InitiateBucketWorm(InitiateBucketWormRequest(BucketName, 10));

      if (outcome.isSuccess()) {      
            std::cout << " InitiateBucketWorm success " << std::endl;
      }
      else {
        /* Handle exceptions. */
        std::cout << "InitiateBucketWorm fail" <<
        ",code:" << outcome.error().Code() <<
        ",message:" << outcome.error().Message() <<
        ",requestId:" << outcome.error().RequestId() << std::endl;
        ShutdownSdk();
        return -1;
      }

      /* Release resources, such as network resources. */
      ShutdownSdk();
      return 0;
}

Use ossutil

You can configure retention policies by using ossutil. For more information, see worm (manage retention policies).

Use the RESTful APIs

If your business requires a high level of customization, you can directly call RESTful APIs. To directly call an API, you must include the signature calculation in your code. For more information, see InitiateBucketWorm.

FAQ

What are the benefits of a retention policy?

A retention policy provides secure and compliant data storage. Within the retention period of a retention policy, data cannot be modified or deleted. Data that is protected by using RAM policies and bucket policies can be modified and deleted.

In which scenarios do I need a retention policy?

If you want to store data for a long period in a bucket and prohibits data deletion or overwrites, you can configure a retention policy for the bucket. This type of data includes medical records, technical documents, and contracts.

Can I configure a retention policy for specific objects in a bucket?

No, you cannot. Retention policies can be configured only at the bucket level. OSS does not support retention policies at the directory or object level.

How do I calculate the expiration time of an object?

To calculate the expiration time of an object, add the retention period to the time when the object was last modified. For example, the retention period for Bucket A is 10 days. An object in the bucket was last modified on February 15, 2022. The object expires on February 25, 2022.

How do I delete a bucket that is protected by a retention policy?

  • If the bucket contains no objects, you can directly delete the bucket.

  • If the bucket contains objects, you cannot delete the bucket even if the retention period elapses. Before you can delete the bucket, you must delete all objects in the bucket.

  • If the bucket contains objects that are protected within the retention period, you cannot delete the bucket.

If my Alibaba Cloud account has overdue payments for OSS, are objects that are protected within the retention period of the retention policy retained?

If your Alibaba Cloud account has overdue payments for OSS, Alibaba Cloud applies your retention policy based on the terms and conditions of your contract.

Can an authorized RAM user configure a retention policy?

API operations related to the retention policy are available. These API operations support RAM policies. RAM users that are granted relevant permissions by using RAM policies can create or delete a retention policy in the OSS console, or by using OSS API operations or OSS SDKs.