08-Legal Holds

Overview

CloudNexus Legal Holds allow you to suspend the deletion lifecycle of storage buckets, volumes, and managed database snapshots. When a hold is applied, resources are preserved indefinitely or until a specified expiration date, regardless of existing lifecycle policies or deletion requests.

Legal Holds are essential for:

• Litigation Response: Preserving evidence for ongoing or anticipated legal proceedings.
• Regulatory Compliance: Meeting retention mandates from GDPR, HIPAA, SOX, or FINRA.
• Internal Investigations: Preventing data loss during security or compliance audits.

Prerequisites

Before creating legal holds, ensure your account meets the following requirements:

• You have the compliance:holds:write IAM permission.
• The target resources are within regions that support retention policies (currently all US, EU, and AP regions).
• Audit logging is enabled for your project to track hold modifications.

Creating a Legal Hold

You can create legal holds via the CloudNexus Console, CLI, or API. Holds can target individual resources, resource groups, or entire projects.

Using the Console

1. Navigate to Security & Compliance → Legal Holds.
2. Click Create Hold.
3. Define the scope (e.g., bucket-prod-assets, db-cluster-financials).
4. Set the reason and assign a hold ID for tracking.
5. Configure expiration (optional). Select Indefinite for permanent holds.
6. Review and confirm. Two-factor authentication may be required.

Using the CLI

# Apply a legal hold to a specific bucket with indefinite retention
cx compliance hold create \\
  --resource-id "arn:cnx:storage:us-east-1:acc-8832:bucket-prod-assets" \\
  --hold-id "LIT-2024-005" \\
  --reason "Discovery request for Case #2024-05: Smith v. Acme" \\
  --expiration "indefinite"

# Output:
{
  "hold_id": "lh-8832-abc-4921",
  "status": "active",
  "applied_at": "2025-01-12T14:32:00Z"
}

Using the API

POST /v2/compliance/holds

{
  "scope": [
    "bucket-prod-assets",
    "db-cluster-main",
    "vol-backup-daily"
  ],
  "hold_id": "REG-GDPR-2025",
  "reason": "GDPR Article 17 Right to Erasure exception",
  "expires_at": "2026-01-12T00:00:00Z",
  "notify_owners": true
}

Scope and Behavior

When a legal hold is active, the following behaviors apply to protected resources:

Releasing a Legal Hold

When litigation concludes or compliance periods expire, holds must be formally released. Releasing a hold restores normal lifecycle operations.

1. Navigate to the hold details or use cx compliance hold release --hold-id <ID>.
2. Provide a release reason and confirmation code.
3. The system will perform a grace period check (configurable, default 24 hours) before fully releasing the hold to prevent accidental deletion.
4. Once released, an audit event is logged with timestamp and user identity.

Audit & Reporting

CloudNexus maintains an immutable audit trail for all hold actions. You can export reports in JSON, CSV, or PDF formats.

# Generate a hold activity report for the last 30 days
cx compliance report generate \\
  --type "hold-activity" \\
  --from "2024-12-12" \\
  --to "2025-01-12" \\
  --format "pdf" \\
  --output "/tmp/hold-report.pdf"

Troubleshooting

Common Issues

• "ResourceProtected" Error: Attempting to delete a resource under hold. Check active holds with cx compliance hold list.
• Hold Not Applied: Verify IAM permissions. The user must have compliance:holds:write on the target scope.
• Region Mismatch: Holds must be created in the same region as the resource or via the global control plane.

Related Resources

• 07-Audit Logs — Configuring immutable logging for compliance.
• IAM Policy Reference — Permissions required for hold management.
• Storage Lifecycle Policies — How holds interact with lifecycle rules.
• Support — Contact CloudNexus Compliance team for enterprise hold configurations.