S3 Object Lock Flashcards
1
Q
What does S3 Object Lock do? Why is it useful?
A
- protect objects in S3 from being overwritten or deleted for a fixed (or indefinite) amount of time
- Create Storage using Write Once, Read Many (WORM) model
- good for regulatory requirements
2
Q
What does WORM stand for?
A
Write Once, Read Many. (A compliant form of storage)
3
Q
What are the two modes of S3 Object Lock? What is the main difference between the two?
A
Governance Mode and Compliance Mode:
- In governance mode, you cannot overwrite or delete an object version or alter its lock settings UNLESS you have special permissions.
- In compliance mode, NO user, not even the root user, can overwrite or delete an object or update its lock settings
4
Q
Define and compare Retention Period vs. Legal Hold
A
Both protect an object version from being overwitten/deleted.
- Retention Period is a fixed amount of time.
- Legal Hold can be freely placed/removed by anyone with the ‘s3:PutObjectLegalHold’ Permission
5
Q
What is S3 Glacier Vault Lock?
A
- Basically, S3 Object Lock for vaults in Glacier.
- easily deploy and enforce complaince controls for S3 Glacier Vaults with a Vault Lock policy.
- Specify controls (like WORM) in a vault lock policy and lock from future edits.
6
Q
What is the best way to put an object lock on all objects in an S3 bucket?
A
S3 Object Locks can be configured to be bucket-wide, so just put one object lock on at the bucket level.
7
Q
What is the storage model associated with S3 Object Lock?
A
Write Once, Read Many (WORM)
8
Q
In S3 Glacier Vault Lock, once the policy is initially locked, can it be changed?
A
No
