SAA-C03 Design Secure Architectures Practice Question

A company stores application logs in an Amazon S3 bucket and wants to protect them from accidental or malicious deletion for a fixed retention period. Legal requires that no user, including the AWS account root user, be able to delete or overwrite the log objects for 365 days, and that the protection be verifiable. Which solution should a solutions architect recommend?

⚠ Common exam trap

The trap here is assuming that S3 Versioning or a restrictive bucket policy provides immutability, when only Object Lock in compliance mode removes the ability to delete or shorten retention.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Enable S3 Object Lock on the bucket in compliance mode with a 365-day retention period, and apply the retention settings to the log objects.

S3 Object Lock in compliance mode makes object versions immutable for the specified retention period and no identity, including the root user, can shorten or remove the retention. Governance mode is weaker because a privileged principal can bypass it, and versioning or lifecycle rules alone do not block deletion.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Enable S3 Object Lock on the bucket in compliance mode with a 365-day retention period, and apply the retention settings to the log objects.
Why this is correct
S3 Object Lock in compliance mode prevents any principal, including the account root user, from deleting or overwriting a protected object version until the retention period expires. The retention date is recorded on each object version, making the protection independently verifiable, which matches both the immutability and the audit requirements.
✗
Enable S3 Object Lock on the bucket in governance mode with a 365-day retention period, and grant the security team s3:BypassGovernanceRetention.
Why it's wrong here
Governance mode allows principals with s3:BypassGovernanceRetention to remove the retention or delete the object version. Since the requirement states that no user, including the root user, may delete the objects for the retention period, governance mode with a bypass permission leaves an opening that compliance mode would close.
✗
Configure an S3 Lifecycle rule that transitions the log objects to S3 Glacier Deep Archive after 30 days and expires them after 365 days.
Why it's wrong here
Lifecycle transitions change the storage class and eventually delete objects, but they do not prevent a user from deleting an object before the expiry date. There is no enforcement mechanism blocking deletion, so the immutability requirement for the full 365 days is not satisfied by this approach.
✗
Enable S3 Versioning on the bucket and add a bucket policy that denies s3:DeleteObject for all principals except the account root user.
Why it's wrong here
Versioning preserves prior versions but does not prevent deletion of the current object or of individual versions, and a policy that exempts the root user leaves a path to remove the protection. The requirement that even the root user be unable to delete the objects is not met by this design.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SAA-C03 Design Secure Architectures Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question