A company must retain all data in a single Amazon S3 bucket for 1 year. The security team is concerned that leaked long-term credentials could allow an attacker to access the AWS account and tamper with or delete objects. Which solution will ensure both existing and future objects in the bucket are protected for the required retention period?

The correct solution leverages S3 Object Lock in compliance mode, which prevents objects from being overwritten or deleted by any user, including the root user, for the specified retention period. Creating a new account and replicating data provides an isolated, immutable copy, protecting against credential compromise in the primary account. S3 Versioning is essential to retain all versions of an object. The other options are incorrect because: enabling an AWS Config rule with Lambda remediation and MFA Delete doesn't guarantee immutability against a compromised root user or administrator, and an S3 Lifecycle rule to delete objects after 1 year contradicts the requirement to retain data for 1 year. Denying S3 bucket creation via Service Catalog and enforcing S3 Versioning and MFA Delete still doesn't provide the immutability of S3 Object Lock. GuardDuty provides threat detection but doesn't prevent object deletion or tampering.