Amazon S3 Glacier Cheat Sheet

Long-term archival solution optimized for infrequently used data, or “cold data.”
Glacier is a REST-based web service.
You can store an unlimited number of archives and an unlimited amount of data.
You cannot specify Glacier as the storage class at the time you create an object.
It is designed to provide an average annual durability of 99.999999999% for an archive. Glacier synchronously stores your data across multiple AZs before confirming a successful upload.
To prevent corruption of data packets over the wire, Glacier uploads the checksum of the data during data upload. It compares the received checksum with the checksum of the received data and validates data authenticity with checksums during data retrieval.
Glacier works together with Amazon S3 lifecycle rules to help you automate archiving of S3 data and reduce your overall storage costs. Requested archival data is copied to S3 One Zone-IA

Data Model

Vault
- A container for storing archives.
- Each vault resource has a unique address with form:
  https://region-specific endpoint/account-id/vaults/vaultname
- You can store an unlimited number of archives in a vault.
- Vault operations are Region specific.
Archive
- Can be any data such as a photo, video, or document and is a base unit of storage in Glacier.
- Each archive has a unique address with form:
  https://region-specific-endpoint/account-id/vaults/vault-name/archives/archive-id
Job
- You can perform a select query on an archive, retrieve an archive, or get an inventory of a vault. Glacier Select runs the query in place and writes the output results to Amazon S3.
- Select, archive retrieval, and vault inventory jobs are associated with a vault. A vault can have multiple jobs in progress at any point in time.
Notification Configuration
- Because jobs take time to complete, Glacier supports a notification mechanism to notify you when a job is complete.

Glacier Operations

Retrieving an archive (asynchronous operation)
Retrieving a vault inventory (list of archives) (asynchronous operation)
Create and delete vaults
Get the vault description for a specific vault or for all vaults in a region
Set, retrieve, and delete a notification configuration on the vault
Upload and delete archives. You cannot update an existing archive.
Glacier jobs — select, archive-retrieval, inventory-retrieval

Vaults

Vault operations are region specific.
Vault names must be unique within an account and the region in which the vault is being created.
You can delete a vault only if there are no archives in the vault as of the last inventory that Glacier computed and there have been no writes to the vault since the last inventory.
You can retrieve vault information such as the vault creation date, number of archives in the vault, and the total size of all the archives in the vault.
Glacier maintains an inventory of all archives in each of your vaults for disaster recovery or occasional reconciliation. A vault inventory refers to the list of archives in a vault. Glacier updates the vault inventory approximately once a day. Downloading a vault inventory is an asynchronous operation.
You can assign your own metadata to Glacier vaults in the form of tags. A tag is a key-value pair that you define for a vault.
Glacier Vault Lock allows you to easily deploy and enforce compliance controls for individual Glacier vaults with a vault lock policy. You can specify controls such as “write once read many” (WORM) in a vault lock policy and lock the policy from future edits. Once locked, the policy can no longer be changed.

Glacier Select

You can perform filtering operations using simple SQL statements directly on your data in Glacier.
You can run queries and custom analytics on your data that is stored in Glacier, without having to restore your data to a hotter tier like S3.
When you perform select queries, Glacier provides three data access tiers:
- Expedited – data accessed is typically made available within 1–5 minutes.
- Standard – data accessed is typically made available within 3–5 hours.
- Bulk – data accessed is typically made available within 5–12 hours.

Glacier Data Retrieval Policies

Set data retrieval limits and manage the data retrieval activities across your AWS account in each region.
Three types of policies:
- Free Tier Only – you can keep your retrievals within your daily free tier allowance and not incur any data retrieval cost.
- Max Retrieval Rate – ensures that the peak retrieval rate from all retrieval jobs across your account in a region does not exceed the bytes-per-hour limit you set.
- No Retrieval Limit

Amazon S3 Glacier Security

Glacier encrypts your data at rest by default and supports secure data transit with SSL.
Data stored in Amazon Glacier is immutable, meaning that after an archive is created it cannot be updated.
Access to Glacier requires credentials that AWS can use to authenticate your requests. Those credentials must have permissions to access Glacier vaults or S3 buckets.
Glacier requires all requests to be signed for authentication protection. To sign a request, you calculate a digital signature using a cryptographic hash function that returns a hash value that you include in the request as your signature.
Glacier supports policies only at the vault level.
You can attach identity-based policies to IAM identities.
A Glacier vault is the primary resource and resource-based policies are referred to as vault policies.
When activity occurs in Glacier, that activity is recorded in a CloudTrail event along with other AWS service events in Event History.

Amazon S3 Glacier Pricing

You are charged per GB per month of storage
You are charged for retrieval operations such as retrieve requests and amount of data retrieved depending on the data access tier – Expedited, Standard, or Bulk
Upload requests are charged.
You are charged for data transferred out of Glacier.
Pricing for Glacier Select is based upon the total amount of data scanned, the amount of data returned, and the number of requests initiated.
There is a charge if you delete data within 90 days.

Amazon S3 Glacier Limits

Under a single AWS account, you can have up to 1000 vaults.

Free Amazon Glacier Tutorials on YouTube:

https://www.youtube.com/user/AmazonWebServices/search?query=Glacier

Other Amazon Glacier-related Cheat Sheets:

Amazon S3 vs Glacier

Validate Your Knowledge

Question 1

A SysOps Administrator plans to set up a disaster and recovery plan in AWS. The requirement is to establish a durable, highly available backup and archiving strategy for the company-owned financial documents, which should be accessible immediately for 6 months. It is expected that there would be a compliance audit every 3 years. The Administrator needs to ensure that the files are still available during that period.

Which service should the Administrator use to fulfill these requirements in the most cost-effective manner?

Set up a storage gateway to upload data in an S3 bucket. Configure lifecycle policies to archive the data to a Cold HDD EBS volume.
Set up a Direct Connect connection to upload data to an S3 bucket. For archiving purposes, use IAM policies to move the data into Amazon Glacier.
Upload the data to an encrypted EBS volume. Use AWS Backup to take automated snapshots on a schedule.
Upload data to an S3 bucket. Use lifecycle policies to move the data to Amazon Glacier for archiving.

Show me the answer!

Correct Answer: 4

To manage your objects so that they are stored cost-effectively throughout their lifecycle, configure their Amazon S3 Lifecycle. An S3 Lifecycle configuration is a set of rules that define actions that Amazon S3 applies to a group of objects.

You can use lifecycle policies to define actions that you want Amazon S3 to take during an object’s lifetime (for example, transition objects to another storage class, archive them, or delete them after a specified period of time).

You can add rules in a lifecycle configuration to tell Amazon S3 to transition objects to another Amazon S3 storage class. For example:

– When you know objects are infrequently accessed, you might transition them to the STANDARD_IA storage class.

– You might want to archive objects that you don’t need to access in real-time to the GLACIER storage class.

Hence, the correct answer is: Upload data to an S3 bucket. Use lifecycle policies to move the data to Amazon Glacier for archiving.

The option that says: Set up a storage gateway to upload data in an S3 bucket. Configure lifecycle policies to archive the data to a Cold HDD EBS volume is incorrect. It’s not possible to transition data from Amazon S3 to Amazon EBS via lifecycle policies.

The option that says: Set up a Direct Connect connection to upload data to an S3 bucket. For archiving purposes, use IAM policies to move the data into Amazon Glacier is incorrect. Direct Connect is not required to transfer data to Amazon S3 unless a private connection between an on-premises data center and AWS is specified. Also, IAM policies only set the permissions needed to carry out an action in AWS. S3 lifecycle policy is the correct answer.

The option that says: Upload the data to an encrypted EBS volume. Use AWS Backup to take automated snapshots on a schedule is incorrect. This answer may be a viable option, but it is not as cost-effective as simply using Amazon S3. To use an EBS volume, it must be attached to a running EC2 instance, which means you must also pay for the instance on top of the EBS volume. Furthermore, since EBS volumes are tied to an availability zone, they are not as durable and highly available as an S3 bucket in which objects are replicated across availability zones within a region by default.

References:

https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lifecycle-mgmt.html
https://docs.aws.amazon.com/AmazonS3/latest/dev/lifecycle-transition-general-considerations.html

Note: This question was extracted from our AWS Certified SysOps Administrator Associate Practice Exams.

Question 2

An organization is currently using a tape backup solution to store its application data on-premises. They plan to use a cloud storage service to preserve the backup data for up to 10 years that may be accessed about once or twice a year.

Which of the following is the most cost-effective option to implement this solution?

Use AWS Storage Gateway to backup the data directly to Amazon S3 Glacier.
Order an AWS Snowball Edge appliance to import the backup directly to Amazon S3 Glacier.
Use AWS Storage Gateway to backup the data directly to Amazon S3 Glacier Deep Archive.
Use Amazon S3 to store the backup data and add a lifecycle rule to transition the current version to Amazon S3 Glacier.

Show me the answer!

Correct Answer: 3

AWS DataSync allows you to copy large datasets with millions of files without having to build custom solutions with open source tools or licenses and manage expensive commercial network acceleration software. You can use DataSync to migrate active data to AWS, transfer data to the cloud for analysis and processing, archive data to free up on-premises storage capacity, or replicate data to AWS for business continuity.

AWS DataSync enables you to migrate your on-premises data to Amazon S3, Amazon EFS, and Amazon FSx for Windows File Server. You can configure DataSync to make an initial copy of your entire dataset and schedule subsequent incremental transfers of changing data towards Amazon S3. Enabling S3 Object Lock prevents your existing and future records from being deleted or overwritten.

AWS DataSync is primarily used to migrate existing data to Amazon S3. On the other hand, AWS Storage Gateway is more suitable if you still want to retain access to the migrated data and for ongoing updates from your on-premises file-based applications.

Hence, the correct answer in this scenario is: Use AWS DataSync to move the data. Store all of your data in Amazon S3 and enable object lock.

The option that says: Use AWS DataSync to move the data. Store all of your data in Amazon EFS and enable object lock is incorrect because Amazon EFS only supports file locking. Object lock is a feature of Amazon S3 and not Amazon EFS.

The options that says: Use AWS Storage Gateway to establish hybrid cloud storage. Store all of your data in Amazon S3 and enable object lock is incorrect because the scenario requires that all of the existing records must be migrated to AWS. The future records will also be stored in AWS and not in the on-premises network. This means that setting up a hybrid cloud storage is not necessary since the on-premises storage will no longer be used.

The option that says: Use AWS Storage Gateway to establish hybrid cloud storage. Store all of your data in Amazon EBS, and enable object lock is incorrect because Amazon EBS does not support object lock. Amazon S3 is the only service capable of locking objects to prevent an object from being deleted or overwritten.

References:

https://aws.amazon.com/datasync/faqs/
https://docs.aws.amazon.com/datasync/latest/userguide/what-is-datasync.htmlhttps://docs.aws.amazon.com/AmazonS3/latest/dev/object-lock.html

Note: This question was extracted from our AWS Certified Solutions Architect Associate Practice Exams.

For more AWS practice exam questions with detailed explanations, check this out: