Amazon Glacier and the S3 Glacier Storage Classes

The standalone Amazon Glacier service is no longer accepting new customers. It is a separate service with its own vault-based API dating from 2012, distinct from Amazon S3. Existing data stays secure and accessible indefinitely and no migration is required, but nobody starting an archive today can create a vault.

For low-cost, long-term archival storage, AWS directs new work to the S3 Glacier storage classes, which store archives as ordinary S3 objects in an ordinary bucket:

• S3 Glacier Instant Retrieval — archive data that is rarely accessed but must come back in milliseconds, at S3-like latency. 90-day minimum storage duration.
• S3 Glacier Flexible Retrieval — archive accessed roughly once a year, restored in minutes to hours depending on the retrieval tier chosen. 90-day minimum.
• S3 Glacier Deep Archive — the lowest-cost class, for data accessed less than once a year, restored within hours. 180-day minimum.

All three are designed for eleven nines of durability across at least three Availability Zones. They use S3 bucket APIs, are available in every Region, are cheaper than the old vault service, and integrate with the rest of AWS in a way the standalone service never did. Objects reach them through a lifecycle rule or by being written directly with that storage class. AWS publishes migration guidance for moving existing vault archives into them.

The claim that Glacier is unsuitable for online delivery is no longer true as a blanket statement: Glacier Instant Retrieval serves objects at millisecond latency at archive prices. It is Flexible Retrieval and Deep Archive that are asynchronous, requiring a RestoreObject call before the data can be read.

See S3 storage classes for how these sit alongside the rest of S3.

The vault service, for those still on it

The rest of this page describes the standalone service, which remains in use by accounts that adopted it before it closed.

Vaults and archives

A vault is the container, equivalent to an S3 bucket. It is created in a specific Region, has a unique name within that Region, and holds an unlimited number of archives.

An archive is the unit of storage, equivalent to an S3 object. It can be any data — a file, a ZIP, a TAR — is assigned an ID by Glacier on upload, and takes an optional description that can only be set at upload time. Archives are immutable: an archive can be deleted, but never modified in place.

The service has a console, but it supports no archive operations. Uploading, downloading and deleting archives all require the CLI, an SDK or direct REST calls.

Retrieval

Retrieval is asynchronous in both directions. Reading an archive, or listing a vault’s inventory, means initiating a job, waiting for it to complete, and then downloading the output. A vault can be configured to publish job-completion notifications to an SNS topic, which is how this is wired into anything automated.

Vault access policies and Vault Lock

Two separate mechanisms, easily confused:

• A vault access policy is a resource-based policy governing who may do what with the vault. It can be changed at any time. IAM governs administrative access alongside it.
• A Vault Lock policy is immutable once locked, and is the compliance control: it enforces rules such as a retention period during which no archive may be deleted, or a requirement for MFA.

Locking is a deliberate two-step process:

1. Initiate the lock, which attaches the policy in an in-progress state and starts a 24-hour window.
2. Within that window, either abort the lock, or complete it.
3. If neither happens, the lock aborts automatically when the window expires.

Once completed the policy is permanent and cannot be changed or removed by anyone. The 24-hour window exists to test the policy against real operations before that becomes irreversible, and it should be used for exactly that.

Integration

Glacier vaults back the AWS Storage Gateway Virtual Tape Library, which is why some backup-software deployments still hold vaults.

For any new archive, the equivalent controls exist in S3 — Object Lock in compliance mode provides the same immutability guarantee as Vault Lock, on objects in an ordinary bucket.