AWS S3 Bucket policy to prevent Object updates

Question

I have set of objects in an S3 Bucket, all with a common prefix. I want to prevent updating of the currently existing objects, however allow users to add new objects in the same prefix.

As I understand it, the S3:PutObject action is both used to update existing objects AND create new ones.

Is there a bucket policy that can limit updating, while allowing creating?

ex: forbid modifying already existing s3:/bucket/Input/obj1, but allow creating s3:/bucket/Input/obj2

---

edit, context: We're using S3 as a store for regression test data, used to test our transformations. As we're continuously adding new test data, we want to ensure that the already ingested input data doesn't change. This would resolve one of the current causes of failed tests. All our input data is stored with the same prefix, and likewise for the expected data.

Novara

WHY do you wish to prevent this from happening? Please edit your question to describe your full use-case. There might be an alternative we can offer if you provide more details. – Quadrate

As @oleksii suggested, S3 Object Lock is your best bet. – Pasteur

Answer 1

It is not possible in a way you describe, but there is a mechanism of sorts, called S3 object lock, which allows you to lock a specific version of file. It will not prevent creation of new versions of file, but the version you lock is going to be immutable.

Commensurable

Answer 2

No, this is not possible.

The same API call, and the same permissions, are used to upload an object regardless of whether an object already exists with the same name.

You could use Amazon S3 Versioning to retain both the old object and the new object, but that depends on how you will be using the objects.

Quadrate