AWS Certified DevOps Engineer – ProfessionalResilient Cloud SolutionsMedium
A financial institution requires a highly resilient and durable storage solution for audit logs that must be retained for 7 years. These logs are infrequently accessed but critical for compliance and forensic analysis. The solution must ensure data integrity and protect against accidental or malicious alterations, including by privileged users. Which AWS storage service and feature combination meets these requirements most effectively?
- AAmazon EBS Snapshots replicated to another region.
- BAmazon S3 Standard-IA with Object Lock in Compliance mode.
- CAmazon EFS with lifecycle management to Glacier.
- DAmazon S3 Glacier Deep Archive with S3 Versioning enabled.
Show answer & explanationAnswer & explanation
Correct answer: B. Amazon S3 Standard-IA with Object Lock in Compliance mode.
Amazon S3 Object Lock in Compliance mode prevents an object from being overwritten or deleted by any user, including the root user, for a fixed amount of time or indefinitely. This ensures data integrity and immutability for audit logs, meeting the compliance requirement for protection against alteration. S3 Standard-IA is suitable for infrequently accessed data.
Why the other options are wrong
- A. EBS Snapshots are for block storage backups, not for highly durable, immutable object storage for audit logs, and they don't inherently provide immutability.
- C. EFS is a shared file system, and while it can tier to Glacier, it does not offer the immutability and WORM (Write Once Read Many) capabilities required for audit logs against privileged users.
- D. S3 Versioning protects against accidental overwrites but does not prevent deletion of all versions, nor does it offer the immutability of Object Lock in Compliance mode.
S3 Object Lock Compliance Mode
An S3 Object Lock retention mode that prevents an object version from being overwritten or deleted by any user, including the root user, for the duration of the retention period.
- Provides WORM (Write Once Read Many) storage.
- Ideal for regulatory compliance and audit logs.
- Cannot be disabled or shortened once set.
Memory trick: Object Lock Compliance: Locks logs, lasts legally.