A company stores customer records in Amazon S3. The company must not delete or modify the customer record data for 7 years after each record is created. The root user also must not have the ability to delete or modify the data. A data engineer wants to use S3 Object Lock to secure the data. Which solution will meet these requirements?

S3 Object Lock provides two retention modes: governance and compliance. To meet the requirement that no user, including the root user, can delete or modify the data, compliance mode is necessary. Compliance mode ensures that a protected object version cannot be overwritten or deleted by any user for the duration of the retention period. Setting a default retention period of 7 years on the bucket ensures all new objects automatically inherit this WORM (Write-Once-Read-Many) protection, fulfilling the strict immutability requirement.

A. Governance mode allows users with special permissions (s3:BypassGovernanceRetention) to alter retention settings or delete objects, which violates the requirement.
C. A legal hold prevents deletion but does not have a fixed retention period; it must be explicitly removed and is not time-based.
D. This option is incomplete; it specifies setting a retention period but omits the crucial retention mode (compliance) needed to prevent deletion by the root user.

1. Amazon S3 User Guide. (2023). S3 Object Lock retention modes. AWS Documentation. Retrieved from https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-overview.html#object-lock-retention-modes

2. Amazon S3 User Guide. (2023). Using S3 Object Lock. AWS Documentation. Retrieved from https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-managing.html (Section: "Default retention settings")