Question

A financial services company must retain regulatory transaction records in Amazon S3 for exactly 7 years in a way that meets SEC 17a-4 write-once-read-many (WORM) requirements. During this period, no user — including administrators with root access — must be able to delete or overwrite the records. Which approach satisfies this requirement?

Accepted Answer

Enable S3 Object Lock in compliance mode with a 7-year retention period on the objects.

Answer

Enable S3 Object Lock in governance mode with a 7-year retention period, granting only administrators the s3:BypassGovernanceRetention permission.

Answer

Apply an S3 bucket policy that denies s3:DeleteObject and s3:PutObject for all principals for 7 years.

Answer

Enable S3 Versioning and configure a lifecycle rule that transitions objects to S3 Glacier Deep Archive for 7 years.