Glacier & Archive Solutions
Key concepts
Glacier Instant Retrieval
Glacier Flexible Retrieval
Glacier Deep Archive
Retrieval options and costs
Vault lock for compliance
Overview
Amazon S3 Glacier storage classes provide secure, durable, and extremely low-cost cloud storage for data archiving and long-term backup. Understanding the three Glacier classes, their retrieval options, and compliance features is critical for the SAA-C03 exam.
Core Concept
S3 Glacier offers three storage classes: Glacier Instant Retrieval (millisecond access), Glacier Flexible Retrieval (minutes to hours), and Glacier Deep Archive (hours, lowest cost). The key trade-off: lower storage cost = higher retrieval cost + longer retrieval time.
When exam questions mention 'rarely accessed' data with specific retrieval time requirements, match the SLA: milliseconds = Glacier Instant, 1-12 hours = Glacier Flexible, 12-48 hours acceptable = Deep Archive. Always verify minimum storage duration requirements (90/90/180 days).
Key Concepts
S3 Glacier Storage Classes
S3 Glacier Instant Retrieval
Purpose: Archive data requiring immediate access when needed
Key Characteristics:
- Millisecond retrieval (same as S3 Standard)
- ~68% lower cost than S3 Standard-IA
- Minimum storage duration: 90 days
- Minimum object size: 128 KB billable
- 99.9% availability, 11 9s durability
Pricing (US-East-1):
- Storage: ~$0.004/GB/month
- Retrieval: ~$0.03/GB
Best For:
- Medical images accessed quarterly
- News media assets
- Genomics data
- User-generated content archives requiring instant access
S3 Glacier Flexible Retrieval
Purpose: Archive data with flexible retrieval needs (minutes to hours)
Key Characteristics:
- Multiple retrieval options (expedited, standard, bulk)
- ~10% lower cost than Glacier Instant
- Minimum storage duration: 90 days
- 99.99% availability, 11 9s durability
Retrieval Options: | Tier | Time | Use Case | |------|------|----------| | Expedited | 1-5 minutes | Urgent requests | | Standard | 3-5 hours | Regular access | | Bulk | 5-12 hours | Large datasets (FREE) |
Best For:
- Backup and disaster recovery
- Compliance archives
- Media asset workflows
- Data that can tolerate hours of retrieval time
S3 Glacier Deep Archive
Purpose: Lowest-cost storage for long-term archives (7-10+ years)
Key Characteristics:
- Lowest storage cost in AWS (~$0.00099/GB/month)
- Minimum storage duration: 180 days
- No expedited retrieval option
- 99.99% availability, 11 9s durability
Retrieval Options: | Tier | Time | |------|------| | Standard | 12 hours | | Bulk | 48 hours |
Cost Comparison:
- ~23x cheaper than S3 Standard
- 1 TB = ~$1/month vs ~$23/month in Standard
Best For:
- Regulatory compliance data (SEC 17a-4, HIPAA)
- Financial records (7+ year retention)
- Healthcare records
- Magnetic tape replacement
- Digital preservation
Retrieval Options Deep Dive
Glacier Retrieval Options
| Storage Class | Retrieval Tier | Time | Cost per GB | Notes |
|---|---|---|---|---|
| Glacier Instant | Standard | Milliseconds | $0.03 | Same latency as S3 Standard |
| Glacier Flexible | Expedited | 1-5 min | $0.03 | May need provisioned capacity |
| Glacier Flexible | Standard | 3-5 hours | $0.01 | Default option |
| Glacier Flexible | Bulk | 5-12 hours | FREE | Best for large restores |
| Deep Archive | Standard | 12 hours | $0.02 | Only expedited option |
| Deep Archive | Bulk | 48 hours | $0.0025 | Lowest cost for large restores |
Provisioned Retrieval Capacity
Purpose: Guarantee expedited retrieval availability
The Problem:
- Expedited retrievals are subject to demand
- During peak times, expedited may not be available
- Can cause SLA violations for critical restores
The Solution:
- Purchase provisioned retrieval capacity
- Guarantees expedited retrieval availability
- Cost: ~$100/month per unit
- Each unit provides up to 3 expedited retrievals per 5 minutes
When to Use:
- Mission-critical archives requiring guaranteed fast access
- DR scenarios with strict RTO requirements
- Regulated industries with access SLAs
Vault Lock & Compliance
S3 Glacier Vault Lock
Purpose: Enforce compliance controls with immutable policies
Key Features:
- Implement WORM (Write Once Read Many) storage
- Lock vault policy to prevent future modifications
- Policy cannot be changed once locked (not even by root)
- Separate from vault access policy
Policy Types:
- Vault Access Policy: Controls who can access vault (can be modified)
- Vault Lock Policy: Compliance controls (immutable once locked)
Locking Process:
- Create vault lock policy
- Initiate lock (24-hour validation period)
- Complete lock (policy becomes immutable)
- Abort lock (if issues found during validation)
Compliance Standards Supported:
- SEC Rule 17a-4(f)
- CFTC Rule 1.31(c)-(d)
- FINRA Rule 4511(c)
- HIPAA/HITECH
- PCI-DSS
- FedRAMP
S3 Object Lock (Alternative)
Purpose: WORM protection at the object level in S3
Modes:
- Governance Mode: Users with special permissions can delete
- Compliance Mode: No one can delete, including root account
Retention Options:
- Retention Period: Protect for specified duration
- Legal Hold: Protect indefinitely until removed
Key Differences from Vault Lock: | Feature | Vault Lock | Object Lock | |---------|------------|-------------| | Scope | Entire vault | Individual objects | | Storage Classes | Glacier only | All S3 classes | | Flexibility | Less (vault level) | More (per object) | | Management | Legacy API | S3 API |
Best Practice: Use S3 Object Lock for new workloads, Vault Lock for legacy Glacier vaults
# Initiate restore from Glacier Flexible Retrieval
aws s3api restore-object \
--bucket my-bucket \
--key archived-file.zip \
--restore-request '{
"Days": 7,
"GlacierJobParameters": {
"Tier": "Standard"
}
}'
# Initiate expedited restore
aws s3api restore-object \
--bucket my-bucket \
--key urgent-file.zip \
--restore-request '{
"Days": 1,
"GlacierJobParameters": {
"Tier": "Expedited"
}
}'
# Initiate bulk restore (free for Flexible Retrieval)
aws s3api restore-object \
--bucket my-bucket \
--key large-archive.zip \
--restore-request '{
"Days": 7,
"GlacierJobParameters": {
"Tier": "Bulk"
}
}'
# Check restore status
aws s3api head-object \
--bucket my-bucket \
--key archived-file.zip \
--query 'Restore'{
"ObjectLockEnabled": "Enabled",
"Rule": {
"DefaultRetention": {
"Mode": "COMPLIANCE",
"Years": 7
}
}
}Cost Optimization Strategies
Glacier Cost Optimization
Strategy 1: Use Bulk Retrievals
- Bulk retrievals are FREE for Glacier Flexible Retrieval
- Plan restores ahead when possible
- Batch multiple files into single bulk restore job
Strategy 2: Right-Size Retention Periods
- Don't over-archive: verify compliance requirements
- Use lifecycle policies to delete after retention period
- Avoid minimum storage duration charges
Strategy 3: Choose Correct Storage Class
- Instant Retrieval: Only if millisecond access truly required
- Flexible Retrieval: Default for most archive use cases
- Deep Archive: Long-term compliance (7+ years)
Strategy 4: Lifecycle Automation
Standard → Standard-IA (30 days) → Glacier Flexible (90 days) → Deep Archive (365 days)
Strategy 5: Avoid Frequent Retrievals
- Retrieval costs can exceed storage costs
- If accessing frequently, reconsider storage class
- Monitor retrieval patterns with CloudWatch
Best Practices
- Match Retrieval SLA to Business Need: Don't pay for faster retrieval than required
- Use Bulk Retrievals: Free for Glacier Flexible, cheapest for Deep Archive
- Plan for Minimum Storage Duration: Factor 90/180 day minimums into lifecycle policies
- Enable Vault Lock for Compliance: Immutable policies for regulated data
- Use S3 Object Lock for New Workloads: More flexible than legacy Vault Lock
- Purchase Provisioned Capacity: When expedited retrieval SLAs are mandatory
- Combine with Lifecycle Policies: Automate transitions to Glacier tiers
Common Exam Scenarios
Exam Scenario Decision Guide
| Scenario | Recommended Solution | Key Reasoning |
|---|---|---|
| Medical images accessed quarterly, need instant access | Glacier Instant Retrieval | Millisecond access, 68% cheaper than Standard-IA |
| Backup data, restore within 4 hours when needed | Glacier Flexible Retrieval (Standard tier) | 3-5 hour retrieval meets SLA, cost-effective |
| Compliance data, 7-year retention, rarely accessed | Glacier Deep Archive | Lowest cost, 12-48 hour retrieval acceptable |
| DR scenario with 15-minute RTO requirement | Glacier Flexible with Provisioned Capacity | Guaranteed expedited retrieval availability |
| SEC 17a-4 regulated financial records | Deep Archive + Vault Lock (WORM) | Immutable compliance controls, lowest cost |
| Large dataset restore (petabytes), cost priority | Glacier Flexible Bulk retrieval | Free retrieval, 5-12 hour completion |
| Archive data that might need immediate access | Glacier Instant Retrieval | Millisecond access when needed, archive pricing |
| Replace magnetic tape library | Glacier Deep Archive | Lower cost than tape, better durability |
Common Pitfalls
Retrieval Costs Exceed Storage
Frequently retrieving data from Glacier can cost more than storing it in S3 Standard. A single GB retrieved from Glacier Instant costs $0.03, while storing that GB in Standard costs $0.023/month. If you retrieve data more than once per month, Standard may be cheaper.
Minimum Storage Duration Charges
Deleting objects before minimum storage duration (90 days for Instant/Flexible, 180 days for Deep Archive) incurs pro-rated charges for the remaining time. Plan data lifecycle carefully to avoid unexpected costs.
Expedited Retrieval Availability
Expedited retrievals from Glacier Flexible are subject to capacity. During high-demand periods, expedited requests may be rejected. Purchase provisioned retrieval capacity if guaranteed expedited access is required.
Deep Archive Has No Expedited Option
Glacier Deep Archive only supports Standard (12 hours) and Bulk (48 hours) retrieval. If you need faster access than 12 hours, use Glacier Flexible Retrieval instead.
Vault Lock Is Permanent
Once a Vault Lock policy is completed (after 24-hour validation), it cannot be changed or deleted - not even by the root account. Test thoroughly during the 24-hour validation window before completing the lock.
Related Services
Quick Reference
Storage Class Comparison
| Feature | Glacier Instant | Glacier Flexible | Deep Archive |
|---|---|---|---|
| Storage Cost | ~$0.004/GB | ~$0.0036/GB | ~$0.00099/GB |
| Retrieval Time | Milliseconds | 1 min - 12 hours | 12 - 48 hours |
| Min Duration | 90 days | 90 days | 180 days |
| Expedited | N/A | Yes (1-5 min) | No |
| Bulk Free | N/A | Yes | No |
| Availability | 99.9% | 99.99% | 99.99% |
Retrieval Pricing (US-East-1)
| Class | Tier | Per GB | Per 1,000 Requests |
|---|---|---|---|
| Glacier Instant | Standard | $0.03 | $10.00 |
| Glacier Flexible | Expedited | $0.03 | $10.00 |
| Glacier Flexible | Standard | $0.01 | $0.05 |
| Glacier Flexible | Bulk | FREE | $0.025 |
| Deep Archive | Standard | $0.02 | $0.10 |
| Deep Archive | Bulk | $0.0025 | $0.025 |
CLI Quick Reference
# Restore object (Glacier Flexible)
aws s3api restore-object --bucket BUCKET --key KEY \
--restore-request '{"Days":7,"GlacierJobParameters":{"Tier":"Standard"}}'
# Check restore status
aws s3api head-object --bucket BUCKET --key KEY --query 'Restore'
# Copy restored object to Standard
aws s3 cp s3://bucket/key s3://bucket/key-restored --storage-class STANDARD
Test Your Knowledge
A healthcare company must store patient records for 7 years per HIPAA requirements. Records are accessed once during an annual audit with 24-hour advance notice. Which storage solution is MOST cost-effective?
A company needs to restore 100 TB of archived data from S3 Glacier Flexible Retrieval for a disaster recovery test. Cost is the primary concern, and they have 24 hours to complete the restore. Which retrieval option should they use?
A financial services firm must comply with SEC Rule 17a-4, requiring records to be stored in non-rewriteable, non-erasable format. What is the BEST solution?
A media company archives video assets to S3 Glacier Flexible Retrieval. Occasionally, they need urgent access to specific videos within 5 minutes for breaking news coverage. However, expedited retrievals sometimes fail during high-demand periods. What should they implement?