A pharmaceutical company locks clinical trial records in S3 Object Lock using Compliance mode with a 5-year retention period, to satisfy a regulator's WORM requirement. Two years in, the AWS account's root user attempts to delete one of the locked object versions before its retention period expires. What happens?
- The deletion succeeds because the root user can always override any S3 protection
- The deletion succeeds only if the root user also supplies the BypassGovernanceRetention header
- The deletion fails; under Compliance mode, no user including the root user can delete or shorten the retention before it expires
- The deletion fails, but only until a legal hold is manually removed
Correct answer: C. The deletion fails; under Compliance mode, no user including the root user can delete or shorten the retention before it expires
AWS documentation on S3 Object Lock retention modes is explicit that in Compliance mode, a protected object version can't be overwritten or deleted by any user, including the root user of the AWS account, and its retention mode can't be changed and its retention period can't be shortened; the documented note even states the only way to delete such an object before its retention date expires is to delete the entire AWS account. This makes the third option correct. The first option is wrong because root-user override is exactly what Compliance mode is designed to prevent, unlike ordinary IAM permission boundaries. The second option describes the bypass mechanism for Governance mode, where the s3:BypassGovernanceRetention permission plus the x-amz-bypass-governance-retention header allow authorized users to override the lock; this mechanism has no effect in Compliance mode, so it cannot be used here. The fourth option incorrectly conflates legal holds with retention periods: a legal hold is an independent, indefinite protection that can be removed by an authorized user, but removing one does not affect a separate Compliance-mode retention period, which remains enforced regardless.
Source: AWS S3 documentation: Locking objects with Object Lock — Compliance mode retention cannot be overridden by any user including root