A biotech firm keeps research data in S3 Standard for 90 days, then rarely accesses it for six years under a legal retention mandate that blocks deletion, while minimizing cost. Version churn is high. Which automatic lifecycle and retention solution should the engineer design to meet compliance and cost goals?
Select an answer to reveal the explanation.
Short Explanation
You need cheap storage with strong guardrails. Layering pairs automatic cool-down moves with a no-delete safety seal.
Full Explanation
The correct design combines timed S3 Lifecycle transitions from Standard after 90 days to low-cost archive storage such as Glacier Flexible or Deep Archive for rarely accessed six-year retention with expiration of noncurrent versions to control cost from high churn, plus Object Lock in Compliance mode to enforce immutable WORM retention that even privileged users cannot bypass until expiry, satisfying legal hold, automation, and cost goals together. The Governance mode variant is plausible for internal controls but fails the blocks deletion mandate by concept because authorized principals with bypass permission can still delete protected objects, which violates strict legal immutability. The Intelligent-Tiering variant preserves automation with Compliance retention and noncurrent cleanup but fails cost minimization by concept because it keeps predictable rarely accessed multi-year data in a monitored frequent-access tier instead of the cheapest Deep Archive tier suited for six-year archival. The one-year retention variant gets archiving, cleanup, and Compliance immutability right but fails duration by concept because it would permit deletion after one year, violating the stated six-year legal mandate. Exam caveat: distinguish Governance versus Compliance carefully and verify whether the stem requires absolute immutability or allows privileged override, plus confirm transition timing, minimum storage durations, and retrieval latency costs. Practical check: enable versioning and Object Lock, preferably at bucket creation though it can now be enabled on an existing versioned bucket, validate Lifecycle rules with noncurrent expiration on a test prefix, and audit lock durations and restore performance before production rollout.