S3 Versioning, Object Lock, and MFA Delete.

In Simple Words:

• Versioning: Preserves every version of an object; deleting an item creates a reversible delete marker.
• Object Lock: Implements WORM (Write Once, Read Many). Compliance Mode prevents deletion by anyone, including the AWS root account.
• MFA Delete: Requires a hardware MFA code to permanently delete object versions.

resource "aws_s3_bucket_versioning" "versioning" {
  bucket = aws_s3_bucket.secure_docs.id
  versioning_configuration {
    status = "Enabled"
  }
}