Protecting data includes keeping it immutable, finding sensitive data and managing secrets. This page covers three services whose behavior is easy to confuse under exam pressure.
| Feature | Governance mode | Compliance mode | Legal hold |
|---|---|---|---|
| Who can delete or overwrite | Users with special permissions (s3:BypassGovernanceRetention plus the bypass header) | Nobody, including the root user | Anyone with s3:PutObjectLegalHold can remove the hold |
| Retention settings | Users with bypass permission can alter them | Mode cannot be changed and the period cannot be shortened | No expiration date; independent of the retention period |
| Typical use | Protect from most users, or test retention settings | Requirement that no one can delete the object during retention | Immutability for an unknown length of time |
Source: docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock.html
In Compliance mode nobody can overwrite or delete the protected version, not even root, and the period cannot be shortened. In Governance mode it can be bypassed with s3:BypassGovernanceRetention and the x-amz-bypass-governance-retention:true header.
Official source: docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock.html
Object Lock only works on buckets with versioning and protects the specified VERSION: it does not prevent new versions or delete markers. A simple DELETE returns 200 with a delete marker; a DELETE with a versionId returns 403.
Official source: docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock.html
A legal hold protects like a retention period but has no expiration date and is independent of the retention period. Anyone with s3:PutObjectLegalHold can place and remove it. Use it when you don't know how long the object must stay immutable.
Official source: docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock.html
With the s3:object-lock-remaining-retention-days condition key in the bucket policy you can set the minimum and maximum allowed retention. An individual retention set on the PUT overrides the bucket's default retention.
Official source: docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock.html
Secrets Manager rotates secrets in three ways: managed rotation (no Lambda), managed external secrets rotation for partners (no Lambda), and rotation by Lambda function for everything else.
Official source: docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets.html
Macie discovers sensitive data in S3 buckets using machine learning and pattern matching, and evaluates bucket security. It produces two kinds of findings: policy findings (e.g. a bucket becoming public) and sensitive data findings.
Official source: docs.aws.amazon.com/macie/latest/user/what-is-macie.html
Macie's automated sensitive data discovery continually samples representative objects; sensitive data discovery jobs are deeper and targeted (one-time or recurring). Use managed data identifiers or custom data identifiers (regex).
Official source: docs.aws.amazon.com/macie/latest/user/what-is-macie.html
Macie publishes findings to Amazon EventBridge (to automate with Lambda or SNS) and can send them to Security Hub. In multi-account setups it is managed centrally with a Macie administrator (via Organizations or invitations).
Official source: docs.aws.amazon.com/macie/latest/user/what-is-macie.html
Answer practice questions, then review your mistakes with spaced repetition.