Glacier Vault lock policies can lock s3, cannot be changed Console, api or cli 24 hour window to validate the lock Once locked, cannot be changed Implemented using IAM Blogs Docs Code