AWS Certified Solutions Architect - Associate

Explanation

Correct Answer: B - Use S3 Object Lock in compliance mode with a retention period of 365 days.

Why this is correct:

1. S3 Object Lock in compliance mode provides the strongest protection against object deletion and modification:

   • Objects cannot be deleted or overwritten by any user, including the root account
   • Retention periods cannot be shortened
   • This ensures "no users can have the ability to modify or delete any files"

2. Retention period of 365 days ensures that "every file in the repository for a minimum of 1 year after its creation date"

3. Access control can be managed separately using IAM policies and bucket policies to:

   • Allow scientists to add new files (PUT permissions)
   • Restrict other users to read-only access (GET permissions)

Why other options are incorrect:

A. S3 Object Lock in governance mode with a legal hold of 1 year:

• Governance mode allows users with special permissions to delete or modify objects
• Legal hold is temporary and can be removed by authorized users
• Doesn't guarantee the 1-year minimum retention requirement

C. Use an IAM role to restrict all users from deleting or changing objects:

• IAM policies can be bypassed or modified
• Doesn't provide the immutable storage requirement
• Users with sufficient permissions could still delete objects

D. Configure S3 bucket to invoke AWS Lambda function:

• This is a monitoring solution, not a prevention solution
• Doesn't prevent deletion or modification
• Doesn't enforce the 1-year retention requirement

Key AWS Concepts:

• S3 Object Lock provides WORM (Write Once Read Many) storage
• Compliance mode is the strictest - no one can delete or modify objects during retention period
• Retention period ensures objects are preserved for a specified duration
• Legal hold is temporary and can be removed, while retention periods are fixed

This solution meets all requirements: immutable storage, 1-year retention, and controlled access permissions.