A financial services company must retain audit log files stored in an S3 bucket for 7 years to meet regulatory compliance. The logs must be protected from accidental or malicious deletion, including by administrators with full S3 permissions, and must survive the loss of an entire AWS Region. Which combination of features best satisfies these requirements?