Amazon S3 Glacier

What it is

"Amazon S3 Glacier" on the exam means low-cost archive storage. Today it is delivered as three S3 Glacier storage classes inside Amazon S3: your archives are ordinary S3 objects in S3 buckets, managed with the S3 console, API (Application programming interface)A defined way for one program to ask another for data or actions, such as a set of HTTPS requests and responses. Every AWS service is controlled through its API, which the console, the CLI, and the SDKs call for you.Glossary entry, and features such as lifecycle rules, encryption, tagging, and Object Lock.

There is also an older, separate service with its own API that stores archives in vaults. It is now called Amazon Glacier, and it is no longer accepting new customers. Existing data stays accessible, and AWS recommends the S3 Glacier storage classes for all long-term data. You can still meet vault terms in exam questions, so this tutorial covers both.

The three S3 Glacier storage classes

Class	Access	Minimum duration	Typical use	Archived?
S3 Glacier Instant Retrieval	Milliseconds, like Standard-IA	90 days	Archives read about once a quarter that must open immediately: image hosting, file sharing, medical records	No
S3 Glacier Flexible Retrieval	Minutes to hours, after a restore	90 days	Backups and archives read once or twice a year; free bulk retrieval	Yes
S3 Glacier Deep Archive	Hours (within 12 or 48), after a restore	180 days	The cheapest storage: compliance records kept for years and rarely read	Yes

All three are designed for 11 nines of durability and store data across at least three AZ (Availability Zone)An isolated location within an AWS Region, made up of one or more data centers with their own power, cooling, and networking. The AZs in a Region are linked by fast, low-latency connections, so spreading resources across them protects against the failure of one site.Glossary entry.
Glacier Instant Retrieval has lower storage cost than Standard-IA but higher access cost, and a 128 KB minimum billable object size.
Flexible Retrieval and Deep Archive add about 40 KB of metadata per archived object (32 KB at the archive rate, 8 KB at the S3 Standard rate), so archiving many tiny objects can cost more than it saves.
Deleting, overwriting, or transitioning an object before its minimum duration is charged for the remaining days.

Restoring archived objects

Objects in Flexible Retrieval and Deep Archive are not available in real time. You send a restore request (RestoreObject) with a retrieval tier and a number of days. S3 creates a temporary copy that you can read for that many days, while the object's storage class stays the same. You pay for both the archived object and the temporary copy while it exists.

Tier	Flexible Retrieval	Deep Archive
Expedited	1–5 minutes	Not available
Standard	3–5 hours	Within 12 hours
Bulk	5–12 hours, free	Within 48 hours

Expedited retrievals can be refused at times of high demand. Provisioned capacity guarantees them: each unit allows at least three Expedited retrievals every 5 minutes and up to 300 MB/s. The account making the request buys it.
Restore requests are limited to 1,000 per second per account; above that, S3 throttles them. For millions of objects, use S3 Batch Operations, which restores them all from one job at the full rate and speeds up large restores (Standard restores from Flexible Retrieval can finish in minutes to 5 hours).
Event notifications (s3:ObjectRestore:Post and s3:ObjectRestore:Completed) tell you when a restore starts and finishes, so an application can wait for it instead of polling.
If data must be read immediately but rarely, choose Glacier Instant Retrieval rather than relying on Expedited restores.

Restoring an archived object. An application sends a RestoreObject request, with a retrieval tier and a number of days, for an object in Glacier Flexible Retrieval. After minutes to hours, S3 creates a temporary copy that can be read for that many days. An event notification says the restore has completed, and the application reads the copy.

Getting data into the Glacier classes

S3 Lifecycle rules transition objects as they age, for example Standard → Standard-IA after 30 days → Flexible Retrieval after 90 days → Deep Archive after a year, and can expire them at the end of their retention.
Upload directly to a Glacier class by setting the storage class on the PUT.
S3 Intelligent-Tiering can archive objects itself: its optional Archive Access (after 90 days without access) and Deep Archive Access (after 180 days) tiers use the same restore process.
To move large On-premisesIn data centers or offices that you run yourself, rather than in the cloud. Hybrid architectures connect on-premises systems to AWS, for example through AWS Direct Connect or a VPN.Glossary entry archives or tape libraries, use AWS DataSync or the Tape Gateway of AWS Storage Gateway, which stores virtual tapes in the Glacier classes.

The Amazon Glacier vault service

For existing customers only, the original service works differently from S3:

Vaults hold archives. Each archive gets a system-generated archive ID instead of a name you choose. There is no console support for uploads or downloads: use the CLI or SDK (Software development kit)A set of libraries for a programming language that wraps a service's API and handles details such as signing requests and retrying. AWS SDKs exist for Python (Boto3), JavaScript, Java, Go, and other languages.Glossary entry.
Reading data or listing a vault's contents is an asynchronous job (archive retrieval or inventory job). An SNS notification can tell you when the job completes.
A vault access policy is a Resource-based policyA permissions policy attached to a resource, such as an S3 bucket policy or an SQS queue policy, that says which principals can use it, including principals in other accounts. Identity-based policies, in contrast, attach to users, groups, and roles.Glossary entry for permissions that you can change at any time.
A Vault Lock policy enforces compliance controls such as WORM (Write once, read many)A storage model in which data can be written once and then cannot be changed or deleted for a set period, often to meet record-keeping rules. Amazon S3 Object Lock and AWS Backup Vault Lock provide it.Glossary entry retention. After you initiate the lock, you have 24 hours to test and complete it; once locked, the policy can never be changed or deleted.
Data in vaults can't be reached through the S3 API. AWS provides guidance for moving vault data to the S3 Glacier storage classes.

In S3, the equivalent of Vault Lock is S3 Object Lock in compliance mode; see encryption keys and data retention.

Security, resilience, performance, and cost

Security

The same controls as the rest of S3: IAM and bucket policies, Block Public Access, encryption (SSE (Server-side encryption)Encryption that a service applies when it stores your data and removes when you read it back. Amazon S3 encrypts every new object with SSE-S3 by default; SSE-KMS uses keys in AWS KMS instead.Glossary entry-S3 by default, or SSE-KMS), and VPC endpointA private connection from a VPC to an AWS service or another endpoint service without crossing the internet. Gateway endpoints, for Amazon S3 and DynamoDB, are route table targets; interface endpoints are network interfaces that use AWS PrivateLink.Glossary entry.
Object Lock (compliance or governance mode, and legal holds) and MFA (Multi-factor authentication)Signing in with two or more different kinds of proof, such as a password plus a code from a phone app or a security key. AWS recommends MFA for the root user and for every human user.Glossary entry delete stop archives being deleted early.

Resilience

Data is stored across at least three Availability Zones. For a second AWS RegionA separate geographic area where AWS runs its services, such as us-east-1 in Northern Virginia, made up of several Availability Zones. Most resources live in one Region; you choose Regions for latency, data residency, and the services you need.Glossary entry, use S3 Cross-Region Replication, which can write replicas straight into a Glacier class.

Performance

Choose the class by how fast you need the data back: milliseconds (Instant Retrieval), minutes (Flexible Retrieval with Expedited), or hours (Standard or Bulk, and Deep Archive).

Cost

Storage is cheaper the colder the class, but retrieval costs more and takes longer. Pay for storage, requests, and per-GB retrievals; bulk retrievals from Flexible Retrieval are free.
Watch the minimum durations (90 and 180 days), the 128 KB minimum size for Instant Retrieval, and the per-object metadata for archived classes.

Monitoring

S3 Storage Lens, S3 Inventory, CloudWatch storage metrics, and CloudTrail work as they do for any S3 object; restore event notifications report restore progress.

Choosing an archive option

If the requirement is	Choose
Rarely read, but must open in milliseconds	S3 Glacier Instant Retrieval
Read once or twice a year, minutes to hours is fine	S3 Glacier Flexible Retrieval
Lowest cost, kept for years, 12 to 48 hours is fine	S3 Glacier Deep Archive
Occasional urgent restores within minutes, guaranteed	Flexible Retrieval with Expedited and provisioned capacity
Access pattern unknown	S3 Intelligent-Tiering with archive tiers
Accessed monthly with millisecond access	S3 Standard-IA, not a Glacier class

Reverse mindmap: when the question points here

Is it S3 Glacier?

Yes, when the question says
- Cheapest long-term archive leads to S3 Glacier Deep Archive
- Archive with retrieval in minutes leads to Flexible Retrieval, Expedited
- Rarely accessed, millisecond retrieval leads to Glacier Instant Retrieval
- Replace an on-premises tape library leads to Tape Gateway to Glacier classes
Restore it
- Free retrieval, hours are fine leads to Bulk from Flexible Retrieval
- Guarantee Expedited retrievals leads to Provisioned capacity
- Know when the restore finishes leads to s3:ObjectRestore:Completed event
- Restore millions of objects leads to S3 Batch Operations restore job
- Data back within 12 hours from Deep Archive leads to Standard tier
Protect it
- Nobody can delete for seven years leads to Object Lock compliance mode
- Unchangeable vault policy leads to Glacier Vault Lock
- Archive automatically after 90 days leads to Lifecycle transition
No, when the question says
- Accessed every month leads to S3 Standard-IA
- Kept only a few days leads to S3 Standard, to avoid minimum duration charges

Key takeaways

The S3 Glacier storage classes are part of S3: Instant Retrieval (milliseconds, 90 days), Flexible Retrieval (minutes to hours, 90 days), and Deep Archive (hours, 180 days).
Flexible Retrieval and Deep Archive need a restore, which creates a temporary copy for the days you choose.
Restore tiers: Expedited 1–5 minutes (Flexible only), Standard 3–5 hours or within 12 hours, Bulk 5–12 hours (free) or within 48 hours.
Provisioned capacity guarantees Expedited retrievals; restore events tell you when data is ready.
The original vault-based Amazon Glacier service no longer accepts new customers; Vault Lock policies are permanent once locked, and Object Lock is the S3 equivalent.