AWS Certified Solutions Architect – Associate (SAA-C03) — Question 87

A company needs to store data in Amazon S3 and must prevent the data from being changed. The company wants new objects that are uploaded to Amazon S3 to remain unchangeable for a nonspecific amount of time until the company decides to modify the objects. Only specific users in the company's AWS account can have the ability 10 delete the objects.
What should a solutions architect do to meet these requirements?

Answer options

• A. Create an S3 Glacier vault. Apply a write-once, read-many (WORM) vault lock policy to the objects.
• B. Create an S3 bucket with S3 Object Lock enabled. Enable versioning. Set a retention period of 100 years. Use governance mode as the S3 bucket’s default retention mode for new objects.
• C. Create an S3 bucket. Use AWS CloudTrail to track any S3 API events that modify the objects. Upon notification, restore the modified objects from any backup versions that the company has.
• D. Create an S3 bucket with S3 Object Lock enabled. Enable versioning. Add a legal hold to the objects. Add the s3:PutObjectLegalHold permission to the IAM policies of users who need to delete the objects.

Correct answer: D

Explanation

The correct answer is D because it utilizes S3 Object Lock to ensure that objects cannot be deleted or altered until the legal hold is released, while also enabling versioning for added protection. Option A does not apply to S3 for object immutability; it focuses on archiving. Option B, while it involves Object Lock, uses a retention period that may not meet the indefinite requirement. Option C does not prevent modifications but only tracks them, which does not satisfy the need for immutability.