You can now do this with S3 Object Lock. It's a per-bucket setting, and allows you to place one of two kinds of WORM locks.
- "retention period" - can't be changed
- "legal hold" - can be changed by the bucket owner at any time
https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lock.html