AWS Certified Sysops Administrator Associate · Free Practice Question Medium
Question 17
A business has transferred data from a write-once, read-many (WORM) storage device to an Amazon S3 bucket that has S3 Object Lock set up in governance mode. During the migration, unnecessary data was inadvertently copied to the S3 bucket.
A SysOps administrator has attempted to remove this surplus data from the S3 bucket using the AWS CLI but encountered an error.
What two steps should the SysOps administrator undertake to successfully remove the unnecessary data? (Select TWO.)
-
A
Extend the Retain Until Date for the affected data.
-
B
Assume a role that has the s3:PutObjectRetention permission.
-
C
Integrate the x-amz-bypass-governance-retention:true header in the request when executing the delete command.
-
D
Assume a role that has the s3:BypassGovernanceRetention permission.
-
E
Change the S3 bucket's Object Lock from governance mode to compliance mode.
Reveal correct answers
Correct answers: C, D
Explanation
When the S3 Object Lock is set in governance mode, it prevents users from overwriting or deleting any version of the object unless they have special permissions. One of these permissions is the 's3:BypassGovernanceRetention' IAM permission, which allows a user to bypass the governance mode restrictions. Therefore, the SysOps administrator would need this permission to delete the objects.
To bypass governance mode, you must explicitly indicate in your request that you want to bypass this mode. To do this, include the x-amz-bypass-governance-retention:true header with your request, or use the equivalent parameter with requests made through the AWS CLI, or AWS SDKs.
Together, these two steps allow the SysOps administrator to delete the unnecessary data from the S3 bucket.
CORRECT: "Assume a role that has the s3:BypassGovernanceRetention permission" is a correct answer (as explained above.)
CORRECT: "Integrate the x-amz-bypass-governance-retention:true header in the request when executing the delete command" is also a correct answer (as explained above.)
INCORRECT: "Extend the Retain Until Date for the affected data" is incorrect.
The Retain Until Date attribute is used in conjunction with S3 Object Lock to specify a fixed period during which the object remains locked. Extending this date would not allow the SysOps administrator to delete the objects. Instead, it would extend the period during which the object is protected from being deleted.
INCORRECT: "Assume a role that has the s3:PutObjectRetention permission" is incorrect.
The s3:PutObjectRetention permission allows a user to set retention settings on an object. However, this alone does not grant the ability to bypass the governance mode restrictions and delete an object.
INCORRECT: "Change the S3 bucket's Object Lock from governance mode to compliance mode" is incorrect.
Changing the S3 bucket's Object Lock from governance mode to compliance mode would make it impossible to delete the object even with root privileges. In compliance mode, the protected object version can't be overwritten or deleted by any user. Therefore, this action would not help to delete the unnecessary data.
References:
https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock.html
Save time with our AWS cheat sheets:
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
