A private S3 bucket contains sensitive data. You must capture IP addresses from failed authentication attempts to access objects, store those logs in a way that they cannot be changed or deleted for 90 days. Which design meets these requirements?

The correct option is to enable S3 server access logging to deliver logs to a second S3 bucket, then enable S3 Object Lock on that target bucket with a 90-day default retention. S3 server access logging captures all requests made to an S3 bucket, including failed authentication attempts, providing the necessary IP address information. Delivering these logs to a separate S3 bucket ensures they are isolated from the sensitive data. S3 Object Lock, specifically in compliance mode, prevents logs from being overwritten or deleted for the specified retention period, meeting the immutability requirement. Other options are incorrect because: CloudTrail logs API calls, not individual object access attempts, and while it can capture some authentication failures, S3 server access logging is more comprehensive for object-level access. CloudWatch Logs retention does not provide the same immutability guarantees as S3 Object Lock. CloudTrail log file integrity validation ensures logs haven't been tampered with after delivery, but doesn't prevent deletion or modification within the S3 bucket itself for a specified period like Object Lock. S3 server access logging to CloudWatch Logs captures the necessary data, but CloudWatch Logs retention does not offer the same strong immutability guarantees as S3 Object Lock.