A security engineer must implement a write-once-read-many (WORM) control for data stored in Amazon S3 buckets that use the S3 Standard storage class. The solution must prevent overwriting or deleting objects by any user, including the root user. Which approach meets these requirements?

S3 Object Lock in compliance mode prevents an object from being overwritten or deleted by any user, including the root user, for a fixed amount of time or indefinitely. This fulfills the WORM requirement and protects against accidental or malicious deletion. S3 Glacier Vault Lock is for S3 Glacier vaults, not S3 Standard buckets. S3 Object Lock in governance mode allows users with special permissions to override or remove object locks, which does not meet the requirement to prevent deletion by any user, including root. Applying a legal hold in governance mode still doesn't prevent the root user from removing the hold.