A company migrated a write-once, read-many (WORM) drive into an S3 bucket that has Object Lock enabled in Governance mode. During the transfer some unnecessary objects were copied into the bucket. When a SysOps admin tries to delete those objects using the AWS CLI, the delete fails with an error. Which steps will allow the admin to successfully remove those objects? (Choose two.)
Choose an answer
Tap an option to check your answer.
Correct answer: Assume an IAM role that includes the s3:BypassGovernanceRetention permission., Include the header x-amz-bypass-governance-retention:true in the delete request..
Why this is the answer
S3 Object Lock in Governance mode prevents an object from being deleted or overwritten by most users. To delete objects protected by Governance mode, you need specific permissions and headers. The s3:BypassGovernanceRetention permission, when included in an IAM role, grants the ability to bypass this protection. Additionally, the x-amz-bypass-governance-retention:true header must be included in the delete request to confirm the intent to bypass the governance retention. Extending the Retain Until Date would further protect the objects, not allow their deletion. The s3:BypassLegalRetention permission and the x-amz-bypass-legal-retention:true header are used for bypassing Legal Hold, which is a different Object Lock setting and not applicable here.
Pass your exam — without the endless answer hunt
Get every verified question and explanation for this exam in one place, and save hours of prep. 1,000+ certifications · 20+ languages · free to start.
Pass your exam faster → No card needed