A company must retain documents using a write-once, read-many (WORM) model to satisfy legal and compliance rules. Which Amazon S3 capability enables this requirement?

S3 Glacier Vault Lock allows you to deploy WORM (write-once, read-many) policies on an S3 Glacier vault. These policies are immutable once locked, ensuring that data cannot be deleted or overwritten for a specified period, satisfying legal and compliance requirements for data retention. S3 Versioning keeps multiple versions of an object, protecting against accidental overwrites or deletions, but it doesn't enforce immutability for compliance. An S3 bucket policy defines access permissions for a bucket and its objects but doesn't inherently provide WORM capabilities. S3 multi-factor authentication (MFA) delete adds an extra layer of security for deleting objects but doesn't prevent overwrites or enforce long-term immutability.