SAA-C03 Practice Question 23: S3 Object Lock Worm
AWS Certified Solutions Architect – Associate (SAA-C03) · Test 3 · question 3 of 10
A brokerage must keep trade confirmations in write-once-read-many (WORM) storage for seven years. Its regulator requires that no one can delete or overwrite a record, or shorten its retention, before the seven years are up. That includes the AWS account's root user and every administrator.
The records will be written to a new S3 bucket. Which configuration meets the requirement?
Show answer and explanation
Answer:
S3 Object Lock stores objects under a WORM model, and it works only in buckets with S3 Versioning enabled. A default retention period on the bucket locks each object version automatically when it is written. In compliance mode, no user can overwrite or delete a protected object version, including the root user. Its retention mode cannot be changed, and its retention period cannot be shortened. That matches the regulator's wording exactly.
Option B looks almost the same, but governance mode can be bypassed. A user with the s3:BypassGovernanceRetention permission who sends the bypass header can delete objects or change their retention. An administrator could grant themselves that permission, so the requirement is not met.
Option C adds friction, not immutability. MFA delete requires an MFA code to permanently delete an object version or change the versioning state, but the bucket owner holding the device can still do both. Locking the device in a safe is a procedure, not a technical control.
Option D can be undone by any administrator who is allowed to edit the bucket policy. Removing the deny statement takes one API call, so it is not WORM storage.
References: Locking objects with Object Lock; Configuring MFA delete