AWS Certified SysOps Administrator – AssociateReliability and Business ContinuityEasy
A SysOps Administrator needs to configure a new Amazon S3 bucket to store critical application logs. Due to compliance requirements, the logs must be immutable and retained for a minimum of 7 years, and no one, including the root user, should be able to delete or modify them during this period. Which S3 Object Lock retention mode should be applied to meet these stringent requirements?
- ALegal hold
- BRetention period
- CGovernance mode
- DCompliance mode
Show answer & explanationAnswer & explanation
Correct answer: D. Compliance mode
S3 Object Lock Compliance mode provides the strongest protection. When an object is locked in Compliance mode, it cannot be overwritten or deleted by any user, including the root user, until the retention period expires. This meets the requirement for immutability and protection against all deletion/modification.
Why the other options are wrong
- A. Legal hold is an indefinite hold that prevents object deletion but can be removed by authorized users, which doesn't guarantee a minimum fixed retention period or absolute immutability against root user actions.
- B. Retention period is a component of Object Lock, but 'Compliance mode' specifies the type of protection for that period, which is the key distinction here.
- C. Governance mode prevents users from overwriting or deleting an object unless they have special permissions (s3:BypassGovernanceRetention), which doesn't meet the 'no one, including root user' requirement.
S3 Object Lock Compliance Mode
S3 Object Lock Compliance mode provides the highest level of data protection, preventing any user, including the root account, from deleting or overwriting an object until its retention period expires.
- Highest level of immutability.
- No user, not even root, can delete or modify.
- Retention period is fixed and cannot be changed.
- Used for strict regulatory compliance.
Memory trick: Compliance mode is for ultimate immutability, even the root can't touch it.