A compliance team applies S3 Object Lock in Governance mode to a set of audit logs with a 1-year retention period. Six months later, an authorized administrator with the `s3:BypassGovernanceRetention` permission needs to delete one of the locked objects early for a legitimate reason. What must the administrator do?
- Nothing extra; holding the permission alone silently allows the delete to succeed
- Include the `x-amz-bypass-governance-retention: true` header on the delete request
- Wait for the legal hold on the object to expire first
- Switch the object's retention mode to Compliance before deleting it
Correct answer: B. Include the `x-amz-bypass-governance-retention: true` header on the delete request
AWS documentation on Object Lock retention modes explains that to override or remove Governance-mode retention settings, a user must have the s3:BypassGovernanceRetention permission AND must explicitly include the x-amz-bypass-governance-retention:true header with the request that requires overriding governance mode; holding the permission alone is not sufficient without also sending that header (the console includes it automatically, but a direct API or CLI call does not add it for you). This makes the second option correct and the first option incorrect, since the header is a required explicit step, not an automatic consequence of having the permission. Legal holds are a separate, independent protection mechanism from retention periods; this scenario describes only a retention period, so there is no legal hold to wait out, making the third option irrelevant to this situation. Retention mode can be changed from Governance to Compliance, but doing so would make the object harder to delete, not easier, since Compliance mode cannot be bypassed by anyone; switching modes achieves the opposite of what the administrator needs, so the fourth option is incorrect.
Source: AWS S3 documentation: Locking objects with Object Lock — Governance mode bypass requires s3:BypassGovernanceRetention permission and the bypass header