Question

A financial services company must retain quarterly audit backup files for exactly 7 years to satisfy a regulator. The backups are archived to an Amazon S3 Glacier vault. Security policy requires that no administrator—including the account root user—be able to delete or shorten the retention of these archives once the retention rule is finalized. Which approach meets this requirement?

Accepted Answer

Apply an S3 Glacier Vault Lock policy that enforces a 7-year deny-delete rule, then complete the lock by submitting the lock ID to finalize the immutable policy.

Answer

Attach an IAM policy to all administrators that denies glacier:DeleteArchive, and enable MFA Delete on the vault.

Answer

Enable S3 Versioning on the source bucket with a lifecycle rule transitioning objects to Glacier after 90 days and an expiration of 7 years.

Answer

Configure an S3 Glacier Vault Access Policy granting read-only permissions and rely on a Service Control Policy to deny delete actions org-wide.