S3 Glacier Storage Classes: Retrieval Tradeoffs, Lifecycle Policies, and Vault Lock

Three storage classes, not one service

"S3 Glacier" is a category of storage, not a single option. There are three distinct storage classes with different access patterns, retrieval speeds, and costs:

| Storage Class | Minimum Storage Duration | Retrieval Time | Use Case | |---|---|---|---| | S3 Glacier Instant Retrieval | 90 days | Milliseconds | Quarterly access, immediate when needed | | S3 Glacier Flexible Retrieval | 90 days | 1–12 hours (standard), 1–5 min (expedited) | Annual access, acceptable latency | | S3 Glacier Deep Archive | 180 days | 12 hours (standard), 48 hours (bulk) | 7–10 year retention, compliance archives |

All three cost significantly less per GB than S3 Standard, with Deep Archive being the cheapest object storage AWS offers. The cost tradeoff is retrieval latency and retrieval pricing.

Retrieval mechanics for Flexible Retrieval and Deep Archive

Flexible Retrieval and Deep Archive require initiating a retrieval job before the data is downloadable:

# Initiate a retrieval job
aws s3api restore-object \
  --bucket my-archive-bucket \
  --key "backups/2023/database-backup.tar.gz" \
  --restore-request '{"Days": 3, "GlacierJobParameters": {"Tier": "Standard"}}'

# Check status
aws s3api head-object \
  --bucket my-archive-bucket \
  --key "backups/2023/database-backup.tar.gz"

# Response shows restore status:
# "Restore": "ongoing-request=\"false\", expiry-date=\"Fri, 01 Jan 2026 00:00:00 GMT\""

Days: 3 specifies how long the restored copy remains available in S3 before expiring. The restored object is a temporary copy — the original stays in Glacier storage class.

Retrieval tiers for Flexible Retrieval:

• Expedited: 1–5 minutes. Higher per-GB cost. Good for urgent, small-volume retrieval.
• Standard: 3–5 hours. Default pricing.
• Bulk: 5–12 hours. Lowest cost. For large-scale, non-urgent retrieval.

Lifecycle policies: automating transitions

Direct uploads to Glacier Instant Retrieval work via the GLACIER_IR storage class. For Flexible Retrieval and Deep Archive, you typically transition objects from S3 Standard using lifecycle rules:

{
  "Rules": [
    {
      "ID": "archive-old-logs",
      "Status": "Enabled",
      "Filter": { "Prefix": "logs/" },
      "Transitions": [
        {
          "Days": 30,
          "StorageClass": "STANDARD_IA"
        },
        {
          "Days": 90,
          "StorageClass": "GLACIER"
        },
        {
          "Days": 365,
          "StorageClass": "DEEP_ARCHIVE"
        }
      ],
      "Expiration": {
        "Days": 2555  // delete after 7 years
      }
    }
  ]
}

In Terraform:

resource "aws_s3_bucket_lifecycle_configuration" "archive" {
  bucket = aws_s3_bucket.logs.id

  rule {
    id     = "archive-logs"
    status = "Enabled"

    filter {
      prefix = "logs/"
    }

    transition {
      days          = 30
      storage_class = "STANDARD_IA"
    }

    transition {
      days          = 90
      storage_class = "GLACIER"
    }

    transition {
      days          = 365
      storage_class = "DEEP_ARCHIVE"
    }

    expiration {
      days = 2555
    }
  }
}

The lifecycle runs at midnight UTC. Objects are not transitioned at exactly day 30 — they transition on the first lifecycle evaluation after day 30 from creation.

# Enable Object Lock when creating a bucket (cannot be added later)
aws s3api create-bucket \
  --bucket compliance-archive \
  --object-lock-enabled-for-bucket

# Set retention on a specific object
aws s3api put-object-retention \
  --bucket compliance-archive \
  --key "audit/2024/report.pdf" \
  --retention '{"Mode": "COMPLIANCE", "RetainUntilDate": "2031-01-01T00:00:00Z"}'

Choosing between Glacier classes

Glacier Instant Retrieval when:

• Data must be retrievable immediately when needed (medical imaging, financial records that occasionally require audit access)
• Access is quarterly at most — paying Standard-IA prices for more frequent access is cheaper
• You want Glacier pricing without managing retrieval jobs

Glacier Flexible Retrieval when:

• Data is accessed annually or less
• Several hours of retrieval time is acceptable
• Large-volume periodic restores (DR testing, annual audits) where bulk retrieval saves significant cost

Glacier Deep Archive when:

• Data is accessed rarely if ever — regulatory retention, long-term backup of replaced systems
• Minimum 180-day storage duration is acceptable
• 12–48 hour retrieval time is acceptable

The minimum storage duration is an often-overlooked cost. Storing 1 TB in Deep Archive for 10 days and then deleting it still costs as if it was stored for 180 days.