Audit evidence must be retained for seven years and must not be deleted by administrators during that period.
Store it in S3 with WORM retention and distinguish retention mode from a legal hold.
Which configuration is most appropriate?
Use S3 Object Lock Compliance mode or Legal Hold to prevent deletion or overwrite during the required period.
Detailed explanation
DynamoDB TTL is not WORM protection for S3 audit objects.
DynamoDB TTL is not WORM protection for S3 audit objects.
Object Lock provides WORM retention and an explicit legal-hold control for audit objects.
Object Lock provides WORM retention and an explicit legal-hold control for audit objects.
Expiration would delete evidence before the retention period ends.
Expiration would delete evidence before the retention period ends.
Broad delete permission conflicts with retention protection and least privilege.
Broad delete permission conflicts with retention protection and least privilege.
Check official documentation
Compare the following points with the official documentation.
Amazon S3 Object Lock、Governance・Compliance mode、Legal Holdの公式説明を確認する。
What to confirm
自動削除・TTL・IAM権限と、WORM法的保持を区別できる。
Key points
- S3 Object Lock
- Compliance mode
- Legal Hold
- WORM
Notes
- Environment: AWS公式DEA-C01試験ガイドと各サービスの公式ドキュメントの確認
- Confirm current AWS service behavior in the official DEA-C01 documentation.
Foundation review
Retention versus expiration
Lifecycle expiration must never conflict with a legal or regulatory hold.
Governance boundary
Retention mode, access policy, and audit evidence should be reviewed together.