Mortgage approval documents in Cloud Storage must not be deleted or overwritten for 5 years; changes must be uploaded as separate files. How do you enforce this?

A locked bucket retention policy prevents objects from being deleted or overwritten for a specified duration, directly addressing the requirement for mortgage approval documents. Uploading changes as separate files is compatible with this policy, as new objects can still be added. Uniform bucket-level access and fine-grained access control manage who can access data, not how long data is retained or protected from modification. While important for security, they don't enforce immutability. CMEK encrypts data but doesn't prevent deletion or overwriting; key rotation is a security best practice but unrelated to retention requirements.