Classify data before choosing controls

Data governance begins with a rule for the data, not a service. Name the owner, allowed principals, approved Regions, integrity need, retention period, deletion authority, recovery objective, and evidence audience.

Different data can need different rules. Public manuals may allow anonymous reads. Internal metrics require authentication. Confidential exports need least privilege. Regulated records may require a fixed location and non-bypassable retention.

Encryption answers who can recover plaintext with an authorized key path. It does not decide who may read the object, where copies may exist, when it may be deleted, or what evidence an auditor needs.

Version the classification and require approval when publicity, legal use, location, or retention changes. Controls should follow the approved rule rather than the loudest possible setting.

Include maximum retention as well as minimum retention. Keeping data longer than allowed can violate policy just as surely as deleting it too early, so name who approves both retention and deletion.

S3 Block Public Access helps prevent accidental public exposure. It does not replace IAM and bucket policies, and intentionally public data needs an explicit reviewed design.

Amazon Macie can discover sensitive data and posture issues in S3. It may find misclassified data, but the data owner still decides the class and someone must remediate the finding.

S3 lifecycle rules schedule transitions or expiration. Versioning preserves object versions. Neither is a non-bypassable write-once-read-many control.

S3 Object Lock protects object versions. Governance mode permits authorized bypass. Compliance mode prevents protected versions from being shortened or deleted during retention, including by the root user.

Use compliance mode only when the legal rule justifies deliberate irreversibility. Test disposable objects first because an incorrect long retention period creates cost and risk that privileged administration cannot undo.

Test retention on disposable versions before protecting real records. Ordinary deletion and privileged shortening should fail in compliance mode, while an eligible short-lived object should expire only after its own date.

CloudTrail records supported API activity. AWS Config records resource configuration and can evaluate it against rules. They answer different questions: who performed an operation, and what configuration existed or violated a rule.

An evidence tool does not make the workload compliant. Evidence shows what a control did; owners must review exceptions, remediate failures, and record the result.

Protect logs from the administrators being observed. A useful evidence package names the requirement, checked resources, observed result, exception, remediation owner, due date, and follow-up.

Residency applies beyond the primary bucket. Include replicas, logs, backups, temporary outputs, and encryption keys in the data-flow inventory.

Before changing retention, inspect locked versions separately from new data. A new 30-day rule can govern eligible new objects while existing compliance-locked versions keep their original dates.

For residency, trace every derived copy. A compliant primary bucket is not enough when replication, logs, backups, or analysis output can leave the approved Region.