A brokerage must retain trade confirmations in S3 for seven years, prevent deletion or overwrite even by admins, provide legal-hold capability, and prove integrity for regulators. Versioning alone failed audit. Which data-integrity mechanism enforces the retention requirement?

S3 Object Lock in Compliance mode delivers true WORM enforcement by blocking overwrite and deletion by any principal including admins and root until retention expires, supports independent legal holds that persist beyond retention for litigation, and combines versioning with retention metadata to prove immutability to regulators for the required seven years, which versioning alone cannot guarantee. Governance mode with the same retention and holds appears similar but fails the even-by-admins requirement because principals with s3:BypassGovernanceRetention permission can delete or modify protected objects, making it appropriate for business policy rather than regulatory non-erasability. Versioning with MFA Delete and lifecycle retention adds recovery and an authentication step for deletes, yet it still allows new versions that functionally overwrite records, lacks time-based WORM blocking and legal-hold controls, and permits expiration-driven removal, so it cannot pass audit. Checksums with KMS encryption and CloudTrail logging provide strong integrity verification, confidentiality, and detective trails, but they do not prevent privileged deletion or enforce retention, remaining detective rather than preventive. Exam caveat is to associate Compliance with no bypass and Governance with bypass allowed, remembering Object Lock requires versioning, which is enabled automatically when you turn Object Lock on (new or existing bucket). Practical check is to query GetObjectRetention and GetObjectLegalHold, attempt an admin delete to confirm denial, and validate default retention covers the full seven-year period.