Starting in Spectrum Protect 8.1.16, you can now use immutable data lock on IBM COS

https://www.youtube.com/watch?v=qu9PmSLPDdM

Parameters for Vault on IBM COS:

• storage effiency
• retension: enable
  • retension duration: 1
  • minimum duration: 0
  • maximum duration: 30
• Enable Secure Slice
• Name Index Enabled

SP> define connection <name> cloudurl=https://cos bucketname=xxxx id=xxxx pa=xxxx
SP> validate con <name> f=d
SP> def stgpool <stgpool_lock> stgtype=cloud connection=<name> enableclouddatalock=yes clouddatalockduration=1
SP> q container f=d

So the stgpool is created in read-only, you can change the duration, it 'll apply to new data only.