S3, Glacier + Storage Classes

Simple Storage Solution (S3)

Storage Classes

Storage class	Min storage duration	Min retrieval time	Retrieval fee	Durability	AZs	Best for
S3 Standard	None	Immediate	None	99.999999999%	3	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Yes	99.999999999%	3	Infrequent access, rapid retrieval needed
S3 One Zone-IA	30 days	Immediate	Yes	99.999999999%*	1	Infrequent access, data can be regenerated if lost
S3 Intelligent-Tiering	None	Immediate (frequent/infrequent tiers)	None	99.999999999%	3	Unknown or changing access patterns
S3 Glacier Instant Retrieval	90 days	Milliseconds	Yes	99.999999999%	3	Archive with instant access needed
S3 Glacier Flexible Retrieval	90 days	Minutes to hours	Yes	99.999999999%	3	Archive, retrieval within hours acceptable
S3 Glacier Deep Archive	180 days	12–48 hours	Yes	99.999999999%	3	Long-term archive, accessed once or twice a year

*One Zone-IA durability is 99.999999999% within the single AZ, but data is lost if the AZ is destroyed.

Key cost and behavior rules:

Standard-IA and One Zone-IA both charge retrieval fees — frequent access makes them more expensive than Standard
Minimum storage duration charges apply even if you delete the object early (e.g., delete after 10 days on Standard-IA — you still pay for 30 days)
Intelligent-Tiering monitors access and moves objects between tiers automatically; no retrieval fees; small monthly monitoring fee per object
One Zone-IA is cheaper than Standard-IA but non-resilient to AZ failure — only use when data is reproducible

Glacier

Glacier storage classes are designed for long-term archival. For Glacier Flexible Retrieval, three retrieval tiers are available:

Retrieval tier	Time	Best for
Expedited	1–5 minutes	Urgent but occasional access; higher cost
Standard	3–5 hours	Default option; moderate cost
Bulk	5–12 hours	Large volumes of data; lowest cost per GB

Glacier Deep Archive only offers Standard (12 hours) and Bulk (48 hours) retrieval.

Glacier Instant Retrieval: millisecond retrieval like Standard-IA, but with a 90-day minimum storage duration and lower per-GB price for data accessed once a quarter.

Security

Bucket policies (resource-based):

JSON policy attached directly to the bucket; can grant or deny access to any AWS principal including other accounts
Can allow cross-account access without requiring a role assumption
Uses the Principal element to specify who the policy applies to