Data scientists use Amazon SageMaker to train AI/ML models with large, sensitive datasets stored in an Amazon S3 bucket. Training typically takes 30 days. The company’s data retention policy requires deletion of any data older than 45 days from the S3 bucket. The bucket is already secured appropriately. What should a security engineer do to enforce this retention policy?

An S3 Lifecycle rule is the most efficient and native AWS service to manage object retention and deletion based on age. It automatically enforces the policy without requiring custom code or external triggers, aligning with the requirement to delete data older than 45 days. The Lambda function options are overly complex and less efficient. The first Lambda option, triggered by PutObject, would run excessively and still require logic to check age, which S3 Lifecycle rules handle natively. The second Lambda option, triggered monthly, might miss the 45-day window for some objects, failing to meet the policy's strict timeline. S3 Intelligent-Tiering is for cost optimization by moving data between storage classes, not for enforcing data deletion policies.