Question 169 - DAS-C01 discussion

This solution meets the requirements because:

S3 Object Lock is a feature in Amazon S3 that allows users and businesses to store files in a highly secure, tamper-proof way.It's used for situations in which businesses must be able to prove that data has not been modified or destroyed after it was written, and it relies on a model known as write once, read many (WORM)1.

S3 Object Lock provides two ways to manage object retention: retention periods and legal holds. A retention period specifies a fixed period of time during which an object remains locked.A legal hold provides the same protection as a retention period, but it has no expiration date2.

S3 Object Lock has two retention modes: governance mode and compliance mode. Governance mode allows users with specific IAM permissions to overwrite or delete an object version before its retention period expires.Compliance mode prevents anyone, including the root user of the account that owns the bucket, from overwriting or deleting an object version or altering its lock settings until the retention period expires2.

By creating the S3 bucket with S3 Object Lock in compliance mode, the company can ensure that the quarterly financial statements are stored in a WORM model and cannot be modified or deleted by anyone until the retention period expires or the legal hold is removed.This can help meet regulatory requirements that require WORM storage, or to add another layer of protection against object changes and deletion2.