A regulated company must retain each S3 record for seven years. During retention, even the account root user must be unable to delete or shorten protection for the retained object version. Which configuration meets this requirement?

1. Enable S3 Versioning and give administrators permission to delete any object version.
2. Transition each object to S3 Glacier Deep Archive and allow DeleteObjectVersion.
3. Use S3 Object Lock compliance mode with the required retention period for each protected object version.
4. Use Object Lock governance mode and grant administrators bypass-governance-retention permission.