Mortgage approval documents must be stored so any updates are uploaded as separate files and original documents cannot be deleted or overwritten for 5 years. How do you enforce this on Cloud Storage?

A locked bucket retention policy in Cloud Storage ensures that objects cannot be deleted or overwritten for the specified duration (5 years in this case). This directly addresses the requirement for immutability and long-term preservation of original documents. When new updates occur, they are uploaded as new, separate objects, preserving the original. Organization or project-level retention policy constraints (constraints/storage.retentionPolicySeconds) only enforce a minimum retention period for new buckets or objects created within that scope, but they don't prevent deletion or overwriting of existing objects if a bucket's own policy isn't set and locked. CMEK is for encryption and key management, not for data immutability or retention enforcement.