Audit logs must not be deleted or overwritten for a defined period.
Meet a compliance requirement for immutable object retention.
Which feature is most appropriate?
Configure S3 Object Lock with an appropriate retention mode and period to provide WORM-style protection for the audit objects.
Detailed explanation
A user name is not an object-retention control.
A user name is not an object-retention control.
CloudFront caches content and does not govern S3 object retention.
CloudFront caches content and does not govern S3 object retention.
Automatic deletion conflicts directly with the defined retention requirement.
Automatic deletion conflicts directly with the defined retention requirement.
Object Lock prevents deletion or overwrite during the retention period according to its configured mode.
Object Lock prevents deletion or overwrite during the retention period according to its configured mode.
Check official documentation
Compare the following points with the official documentation.
Amazon S3 Object Lockの公式説明を確認する。
What to confirm
保持期間とWORM要件をObject Lockへ対応付けられる。
Key points
- S3 Object Lock
- Retention mode
- WORM
Notes
- Environment: AWS公式S3ドキュメントの確認
- Confirm current AWS service behavior in the official documentation.
Foundation review
Retention versus lifecycle
Object Lock protects data during a required period, whereas Lifecycle can expire data after retention.
Compliance boundary
Immutability must be enforced by the storage control, not merely described in an identity name.