Question

A financial services company must retain regulatory audit files in Amazon S3 so that no user — including the AWS account root user — can delete or overwrite them for a fixed 7-year period. The security team is specifically concerned about ransomware and insider threats that might use valid credentials with administrative privileges. Which approach meets the requirement?

Accepted Answer

Enable S3 Object Lock in compliance mode with a 7-year retention period on the objects.

Answer

Enable S3 Object Lock in governance mode with a 7-year retention period and grant s3:BypassGovernanceRetention only to auditors.

Answer

Apply a bucket policy that denies s3:DeleteObject and s3:PutObject to all principals except the root user.

Answer

Enable S3 Versioning with MFA Delete and a lifecycle rule that transitions objects to Glacier for 7 years.