Amazon S3 Glacier
An ultra-low-cost storage service designed for long-term archival, starting at approximately $0.005 per GB per month, with built-in compliance support
Overview
Amazon S3 Glacier is an ultra-low-cost storage service purpose-built for data archival and long-term retention. It is integrated as a set of S3 storage classes and offers three tiers: S3 Glacier Instant Retrieval, S3 Glacier Flexible Retrieval, and S3 Glacier Deep Archive. Deep Archive costs approximately $0.002 per GB per month (Tokyo region), roughly one-tenth the cost of S3 Standard. The Vault Lock feature lets you apply WORM (Write Once Read Many) policies to prevent data tampering or deletion, meeting compliance requirements for financial institutions and healthcare organizations (SEC Rule 17a-4, HIPAA, etc.). Combined with S3 Lifecycle policies, data can be automatically transitioned to Glacier based on its age.
Three Storage Tiers and the Retrieval Speed Trade-Off
Glacier offers three storage tiers, each balancing cost against retrieval speed. S3 Glacier Instant Retrieval provides millisecond access at a higher storage cost, making it ideal for data accessed roughly once per quarter. S3 Glacier Flexible Retrieval offers three retrieval speeds - Expedited (1-5 minutes), Standard (3-5 hours), and Bulk (5-12 hours) - letting you choose based on urgency. S3 Glacier Deep Archive is the lowest-cost option at approximately $0.002 per GB per month, with Standard retrieval within 12 hours and Bulk within 48 hours, suited for data accessed only once or twice a year. By comparison, Azure Blob Storage's Archive tier has similar storage costs but lacks an equivalent to Glacier's Expedited retrieval, with its fastest rehydration option (High Priority) still taking up to an hour. Retrieval fees increase with speed across all tiers, so estimating retrieval frequency and calculating costs in advance is essential.
Vault Lock and WORM for Compliance
Glacier's Vault Lock feature enables Write Once Read Many (WORM) policies that prevent archived data from being modified or deleted for a specified retention period. Once a Vault Lock policy is confirmed, it becomes immutable - even the root account cannot alter or remove it. This makes it suitable for meeting strict regulatory requirements such as SEC Rule 17a-4 for financial records and HIPAA for healthcare data. Vault Lock policies can be combined with S3 Object Lock for layered protection across both active and archived data. For deeper knowledge of archival compliance strategies, specialized books on Amazon can be helpful. Organizations subject to audit requirements should document their Vault Lock configurations and test retrieval procedures periodically to ensure data remains accessible when needed.
Designing Automatic Tiering with Lifecycle Policies
S3 Lifecycle policies automate the transition of objects through storage tiers based on age, eliminating the need for manual data management. A common pattern is to transition objects from S3 Standard to Glacier Flexible Retrieval after 90 days and to Deep Archive after 365 days. This approach works well for log files, backup archives, and regulatory records that are frequently accessed when fresh but rarely needed after a few months. When designing lifecycle rules, consider the minimum storage duration charges - Flexible Retrieval has a 90-day minimum and Deep Archive has a 180-day minimum, so transitioning data that might be deleted before these thresholds can actually increase costs. Combining lifecycle policies with S3 Intelligent-Tiering for the first 90 days and Glacier for longer-term storage provides a fully automated, cost-optimized archival pipeline.