1. Login to the AWS console.
2. Go to the S3 service.
3. Select the bucket for which you want to enable Object Lock feature.
4. Click on the “Properties” tab.
5. Scroll down to the “Object Lock” section.
6. Click on the “Edit” button.
7. Select the “Enable object lock” radio button.
8. Choose the “Retention period” as per your requirement. You can choose either “Governance” or “Compliance” mode.
9. Click on the “Save” button.

​

1. Open the AWS CLI on your local machine or EC2 instance.
2. Run the following command to enable object lock on a specific S3 bucket:
   aws s3 put-bucket-object-lock-configuration --bucket <bucket-name> --object-lock-configuration '{"ObjectLockEnabled":"Enabled","Rule":{"DefaultRetention":{"Mode":"COMPLIANCE","Days":<number-of-days>}}}'
   
   Make sure to replace <bucket-name> with the name of the S3 bucket and <number-of-days> with the number of days for which the objects should be locked.
3. Verify that the object lock feature has been enabled by running the following command:
   aws s3 get-bucket-object-lock-configuration --bucket <bucket-name>
   
   This should return the object lock configuration for the specified bucket.

1. Import the necessary AWS SDK libraries in your Python code. You can use the boto3 library for this.

import boto3

2. Create an AWS S3 client object using the boto3.client() method.

s3 = boto3.client('s3')

3. Use the put_bucket_object_lock_configuration() method of the S3 client object to enable the object lock feature for your S3 bucket. This method takes the following parameters:

• Bucket: The name of the S3 bucket for which you want to enable the object lock feature.
• ObjectLockConfiguration: A dictionary that contains the configuration settings for the object lock feature. In this case, we need to set the ObjectLockEnabled key to Enabled.

response = s3.put_bucket_object_lock_configuration(
    Bucket='your-bucket-name',
    ObjectLockConfiguration={
        'ObjectLockEnabled': 'Enabled'
    }
)

4. Check the response of the put_bucket_object_lock_configuration() method to ensure that the object lock feature has been enabled successfully.

if response['ResponseMetadata']['HTTPStatusCode'] == 200:
    print('Object lock feature has been enabled for your S3 bucket.')
else:
    print('Error enabling object lock feature for your S3 bucket.')

# S3 bucket used by CloudTrail with Object Lock enabled.
# NOTE: Setting object_lock_enabled = true forces bucket replacement.
# You cannot turn on Object Lock for an existing bucket; create a new one and
# repoint the CloudTrail trail to it.

resource "aws_s3_bucket" "cloudtrail_logs" {
  bucket              = "YOUR_CLOUDTRAIL_LOG_BUCKET_NAME"
  object_lock_enabled = true
}

resource "aws_s3_bucket_versioning" "cloudtrail_logs" {
  bucket = aws_s3_bucket.cloudtrail_logs.id

  versioning_configuration {
    status = "Enabled"
  }
}

resource "aws_s3_bucket_object_lock_configuration" "cloudtrail_logs" {
  bucket = aws_s3_bucket.cloudtrail_logs.id

  rule {
    default_retention {
      mode  = "COMPLIANCE"   # or "GOVERNANCE" per your compliance needs
      days  = 365            # or use years = N
      # years = 1
    }
  }
}

# Example CloudTrail pointing to the Object-Lock-enabled bucket
resource "aws_cloudtrail" "trail" {
  name                          = "YOUR_TRAIL_NAME"
  s3_bucket_name                = aws_s3_bucket.cloudtrail_logs.bucket
  include_global_service_events = true
  is_multi_region_trail         = true
  enable_log_file_validation    = true
  is_organization_trail         = false

  # add any other required arguments for your environment
}

• a new aws_s3_bucket with object_lock_enabled = true,
• new aws_s3_bucket_versioning and aws_s3_bucket_object_lock_configuration attached to that bucket,
• an update to aws_cloudtrail so s3_bucket_name points at the new bucket.