IMMUTABLE BACKUP & OBJECT LOCK

Immutable Backup and Object Lock Planner

Work out the minimum lock period your backup chain needs, how much locked data you will store and pay for, what a mistaken lock period would cost, and who can still delete your backups on AWS S3, Azure Blob, Wasabi or Backblaze B2.

$ Runs in your browser. Nothing you enter is sent anywhere.

1. Your storage and backup schedule

Cloud storage provider:

Lock mode / policy type:

Legal hold: Legal hold is placed on the backup data

A legal hold has no expiry date. It blocks deletion until someone removes it.

Keep restore points for R days:

Your retention: every restore point must be restorable for this many days. Whole days, 1 or more.

A full backup every F days, incrementals in between:

F = 1 means a full every day (no incrementals). F = 7 means a weekly full plus 6 daily incrementals.

Extra lock days your backup software adds (check product docs):

Some backup products add a buffer on top of retention when they set the lock. Enter 0 if yours does not.

Size of one full backup as stored (after dedup/compression), TB (1 TB = 1024 GB, as billed by AWS/Azure):

Size of one incremental as stored, TB (1 TB = 1024 GB, as billed by AWS/Azure):

Not used when F = 1 (there are no incrementals).

What if someone sets this lock period by mistake? (days):

For example a typo of 365 instead of 36. Whole days, 1 or more.

Minimum storage duration of this storage class/provider (days):

Data deleted earlier is still billed for this many days. S3 Standard-IA/One Zone-IA 30, Glacier IR/Flexible 90, Deep Archive 180; Azure Cool 30, Cold 90, Archive 180. Default: Wasabi (pay as you go) 90, others 0. Whole days, 0 or more.

Advanced: prices (US East, checked 28 Sep 2026)

Storage price, USD per GB-month:

One flat price per GB-month is applied to all locked data. Volume tiers (lower prices above 50 TB on AWS and Azure), and request charges are not included. The Wasabi 1 TB monthly minimum is not included. Official price pages: AWS S3, Azure Blob, Wasabi, Backblaze B2.

2. Minimum lock period and locked data

– Minimum lock period L = R + F – 1 + B

– Locked data (average)

– Storage cost per month

– Extra vs. retention only

Locked TB is the average over a backup cycle; just before the oldest full expires the amount is higher.

Why the lock must be longer than your retention

How much data is locked

What if the lock period is set by mistake?

Who can delete a locked backup?

Account	Can delete before the lock expires?	Why

Provider notes

S3 Object Lock works only in buckets with S3 Versioning enabled. It can be enabled on an existing versioned bucket. Once enabled, you can’t disable Object Lock or suspend versioning for that bucket.
Governance mode: users can’t overwrite or delete a locked object version or change its lock settings unless they have the s3:BypassGovernanceRetention permission and send the x-amz-bypass-governance-retention:true header. The S3 console includes that header by default.
Compliance mode: a locked object version can’t be overwritten or deleted by any user, including the root user. Its mode can’t be changed and its retention can’t be shortened. Retention can be extended. The only way to delete it before its retention date is to delete the AWS account.
Legal hold: no fixed period; it stays until removed. Anyone with s3:PutObjectLegalHold can place or remove it.

Sources: S3 Object Lock, Object Lock overview, Configuring Object Lock (AWS documentation).

Unlocked policy: meant for testing. It can be shortened, extended or deleted.
Locked policy: can’t be deleted. The retention period can be extended but not shortened. A container-level locked policy allows at most 5 extensions over its life; version-level has no such limit.
Retention period: 1 to 146,000 days.
Container-level WORM needs no versioning (all blobs inherit the policy). Version-level WORM needs versioning and can be set at account, container or blob scope.
Legal hold: data stays WORM until the hold is cleared. You can’t create version-level WORM on a container that has a legal hold.
Billing: no extra charge for immutability; locked data is billed at the normal tier price. Version-level WORM can raise the bill because extra versions are kept.
A container or account with a locked or version-level WORM policy can be deleted only when it is empty.

Sources: Time-based retention policies for immutable blob data, Immutable storage overview (Microsoft Learn).

Governance mode: the root user, or any user with the IAM permission s3:BypassGovernanceRetention, can bypass the retention period.
Compliance mode: “cannot be reversed for any reason, by any user, regardless of user permissions.”
Legal hold is supported.
Object Lock can be enabled only when the bucket is created, and versioning must be enabled first. Plan this before you create the bucket.
Wasabi also has a separate bucket-level “Compliance” feature that can be turned on at any time, with or without versioning.

Sources: Wasabi Object Locking, Wasabi bucket Compliance.

Governance mode: settings can be modified or overridden by clients with the appropriate application key capabilities.
Compliance mode: cannot be removed by any user, but retention dates can be extended.
Legal hold is supported.
Object Lock can be enabled on a new bucket or on an existing bucket.
If files are over-locked (locked for too long), the only way to remove them is to close the Backblaze B2 account.

Source: Backblaze B2 Object Lock.

Checklist before you rely on it

0 of 8 done

Separate account / subscription for the backup copy.
MFA on all admin accounts.
Versioning on (S3, Wasabi, B2; on Azure only for version-level WORM).
Lock enabled at bucket / container level, not only per object.
Lock period is at least L = 36 days.
Restore test from the locked copy done.
Alerts on retention-policy changes.
Backup software supports Object Lock / immutability for this provider.

Formulas used

Minimum lock L (days) = R + F – 1 + B

Written per day = full TB ÷ F + incremental TB × (F – 1) ÷ F

Locked TB (lock of D days) = D × written per day

Billed TB (lock of D days) = max(D, m) × written per day, where m = minimum storage duration

Retention-only TB (no lock) = full TB × (R + F – 1) ÷ F + incremental TB × (F – 1) × (2R + F – 2) ÷ (2F)

Retention-only billed TB = full TB × max(R + F – 1, m) ÷ F + (incremental TB ÷ F) × sum over k = 1..F-1 of max(R + F – 1 – k, m)

Extra TB = locked TB – retention-only TB; extra cost = (billed TB – retention-only billed TB) × 1024 × price

Monthly cost = billed TB × 1024 × price per GB-month

Mistake extra per month = max(0, max(A, m) × written per day × 1024 × price – monthly cost)

Assumptions: steady state (the schedule has run for at least one lock period); every backup, full or incremental, is locked for the same period; sizes are as stored after dedup and compression; one flat storage price. Real products may lock differently (for example per block or per restore point) – check your backup software’s documentation.

Estimates are a starting point. Review and test before relying on them in production. HNOrigin is not affiliated with or endorsed by Amazon Web Services, Microsoft, Wasabi or Backblaze. Product names are trademarks of their owners.