Question

A developer stores application audit logs as objects in an S3 bucket. Compliance requires that logs remain immediately queryable for 30 days, then be retained cheaply for 7 years where retrieval within several hours is acceptable, and finally be deleted. The developer wants this handled automatically without writing custom code. What is the most appropriate solution?

Accepted Answer

Configure an S3 Lifecycle rule that transitions objects to S3 Glacier Flexible Retrieval after 30 days and expires (deletes) them after 7 years.

Answer

Write a scheduled Lambda function that copies 30-day-old objects to a Glacier bucket and deletes objects older than 7 years.

Answer

Enable S3 Versioning and rely on version expiration to move old logs to Glacier and remove them after 7 years.

Answer

Configure an S3 Lifecycle rule that transitions objects to S3 Standard-IA after 30 days and never expires them, using a bucket policy to block reads after 7 years.