A company plans to create Amazon S3 buckets to store log data.

Comprehensive and Detailed 100to 150 words of Explanation From AWS Certified Security – Specialty topics:

S3 Object Lock in compliance mode is the strictest WORM protection for S3 objects. When an object version is protected by compliance-mode retention, no user, including the root user in the AWS account, can overwrite or delete the protected object version before the retention period expires. This exactly satisfies the requirement to prevent deletion for 90 days even by administrators or root. Governance mode is weaker because users with special bypass permissions can override governance retention. A legal hold does not use a time-based 90-day retention period unless manually removed later. S3 Glacier Vault Lock applies to S3 Glacier vaults, not regular S3 buckets using S3 Standard storage class.

================