A financial services firm wants to apply write-once-read-many (WORM) protection to trade records stored in S3 using S3 Object Lock. The bucket currently does not have versioning enabled. What must happen first?
- Nothing; Object Lock can be enabled independently of versioning
- Versioning must be enabled on the bucket, since Object Lock only works on versioning-enabled buckets
- The bucket must first be converted into a One Zone-IA bucket
- A legal hold must be placed on every existing object before Object Lock can be turned on
Correct answer: B. Versioning must be enabled on the bucket, since Object Lock only works on versioning-enabled buckets
AWS documentation on S3 Object Lock states directly that Object Lock works only in buckets that have S3 Versioning enabled, because retention periods and legal holds are applied to individual object versions rather than to a single mutable object. This means the firm must enable versioning on the bucket before Object Lock protection can be configured, making the second option correct and the first option, which claims independence from versioning, incorrect. Storage class has nothing to do with Object Lock eligibility; One Zone-IA is a cost-and-durability choice unrelated to WORM protection, so converting the bucket to that storage class would not satisfy any Object Lock prerequisite and is not even how storage classes are set at the bucket level. Legal holds are optional per-object-version protections that can be applied after Object Lock is enabled on a versioned bucket; they are not a prerequisite that must be applied to existing objects before Object Lock itself can be turned on, so the fourth option reverses the actual order of operations.
Source: AWS S3 documentation: Locking objects with Object Lock — Object Lock requires S3 Versioning to be enabled