object locks are set to "Governance" one, which CAN be overriden for those with the correct permissions. I tried giving "S3 Full Access", which contains the needed permission to override Governance Object Locks, and error remained. That's another reason for me to believe it's not object lock related.

Yes I do, as we discussed on another post some days ago :) Default lock is set to 7 days. Do you believe after 7 days the files/folders will be deleted with no problems?

Anyway, funny is that via AWS CLI, I can delete stuff, using the exact same keys MSP is using, as explained. By that, I figured out it shouldn't be object lock related afterall. If that was the case, I should get an "Access Denied" via CLI as well, as I'm using the very same access credentials MSP360 is using.

I'm uploading to Glacier Instant Retrieval, and everything is working fine. Initially, when studying the new S3 classes, I understood (incorrectly, I found out later) that "Restore Cost" would be charged when I restored data, and by restore, I understood taking data out of the S3 cloud. With synthetic backups, data is read and duplicated within the S3 cloud, and I (incorrectly) imagined that this would not count as "Restore". However, it do counts. Seems it's more a "READ Cost" than a "Restore Cost". Back to the Synthetic Full, when it happens on a 2TB backup, for example, it work flawlessly, no problem on that, but AWS charges me 2TB of "Read Cost" on the Glacier IR, and my billing there goes crazy.

That's why I'm looking to still keep using Glacier IR, but stop using synthetic backups. I'm OK with reuploading everything, that's not a problem, I just couldn't figure out how to disable it.

The feature is working as expected, there's really no problem on it. Problem is on the S3 Class I choose and, by the workings of the Synthetic Full, it blows my billings there. So I really need to disable it.

new information: I granted "S3 Full Access" to the user, and the "error on deleting folder" still occurs ... it really doesn't seem to be a permission problem indeed.

Found an article from MSP360 ( https://help.msp360.com/cloudberry-backup/backup/about-backups/new-backup-format/synthetic-full-backup ) showing that I must enable 'Use synthetic full backup' at storage account level. However, I don't have that option here, on a fully updated msp360 (v7.8.7.59). Maybe it was removed and enabled by default at some point?

And actually, Alexander, it might worth upgrading your blog post "Specifying AWS IAM User Group ...." ( https://www.msp360.com/resources/blog/backup-with-iam-users/ ) to include the need for "s3:PutObjectRetention" and maybe "s3:GetObjectRetention" policies as well. It seems that without at least PutObjectRetention, setting the GFS retention policies, by MSP360, would be denied.

Thanks for the answer, Alexander ... so, at worst case scenario, considering i'm thinking on a 7 day default retention, i would use some unneeded storage for just a few (less than 7) days and, once that is expired, files that couldn't be deleted *will be* deleted anyway, lost won't be unneededly used forever? If that's the only drawback, it seems a very cheap price to pay to get REALLY "up to last backup" data protection on the S3 buckets :)