Security · Flashcard
What can S3 Object Lock in compliance mode do that governance mode cannot?
- ABlock deletion by every user including the account root for the whole retention period
- BApply a default retention period to each new object placed into the bucket automatically
- CHold an object for an unbounded time until an authorised user explicitly releases it
- DProtect an object in a bucket that never had S3 Versioning enabled on it beforehand
Why this is the answer
In compliance mode no user can overwrite or delete the object version — the documentation says 'including the root user in your AWS account' — and the retention period cannot be shortened or the mode changed. Governance mode stops most users but is bypassable by anyone holding `s3:BypassGovernanceRetention` who sends the bypass header. A default bucket retention period works in either mode. Holding until explicit release is a legal hold, independent of mode. And Object Lock requires versioning either way.
Official docs