A financial services company needs to store critical transaction logs for compliance, requiring immutability and long-term retention. The logs must be protected from accidental deletion or modification for 7 years, even by root users. After 7 years, the logs should be automatically archived to a lower-cost storage class. Which combination of AWS services and features should be used?
- AAmazon S3 Glacier Deep Archive with S3 Lifecycle policies
- BAmazon S3 Intelligent-Tiering with S3 Cross-Region Replication
- CAmazon S3 Object Lock in Compliance mode with S3 Lifecycle policies
- DAmazon S3 Standard with S3 Versioning
Show answer & explanationAnswer & explanation
Correct answer: C. Amazon S3 Object Lock in Compliance mode with S3 Lifecycle policies
Amazon S3 Object Lock in Compliance mode prevents objects from being overwritten or deleted by any user, including the root user, for a specified retention period, ensuring immutability. S3 Lifecycle policies can then transition these objects to lower-cost storage classes like Glacier after the retention period, meeting the long-term archiving requirement.
Why the other options are wrong
- A. S3 Glacier Deep Archive is a storage class for long-term archiving, and Lifecycle policies help with transitions, but it doesn't enforce immutability against root users.
- B. S3 Intelligent-Tiering optimizes costs based on access patterns, and Cross-Region Replication enhances durability, but neither provides immutability against deletion/modification by a root user.
- D. S3 Standard with Versioning protects against accidental deletion but not against modification or deletion by a root user or malicious intent for immutability.
S3 Object Lock & Lifecycle
Amazon S3 Object Lock provides WORM (Write Once, Read Many) protection for objects, making them immutable. S3 Lifecycle policies automate the transition of objects between different storage classes based on age or access patterns.
- Ensures data immutability (WORM)
- Compliance mode protects against root user deletion
- Retention periods configurable
- Lifecycle policies automate cost optimization
Memory trick: Lock your objects for compliance, then lifecycle them to save cash.