A private bucket plus an S3 user scoped to it by an access policy (raw IAM-style JSON).

Backups bucket — object lock + retention

A separate write-once bucket with object lock, versioning, a compliance retention period, and auto-expiry — protected from deletion with metadata.delete_protection.

In compliance mode these protections are immutable: not even an S3 user with admin permissions can turn off object lock, shorten the retention period, or delete a locked object before it expires.

Related pages

Resource docs

• S3 Bucket resource docs
• S3 User resource docs
• S3 Access Policy resource docs

More in this section

• Networking
• VMs
• VPN
• Load Balancing
• Examples

Reference

• Kvindo provider on the Terraform Registry