Amazon Glacier Product Details

Amazon Glacier provides three ways to retrieve your archives to meet varying access time and cost requirements: Expedited, Standard, and Bulk retrievals. Archives requested using Expedited retrievals are typically available within 1 – 5 minutes, allowing you to quickly access your data when occasional urgent requests for a subset of archives are required. With Standard retrievals, archives typically become accessible within 3 – 5 hours. Or you can use Bulk retrievals to cost-effectively access significant portions of your data, even petabytes, for just a quarter-of-a-cent per GB. Click here to learn more about data retrieval features.

AWS Snowball can accelerate moving large amounts of data into and out of AWS using portable storage devices for transport. AWS transfers your data directly onto and off of storage devices using Amazon’s high-speed internal network and bypassing the Internet. For significant data sets, AWS Import/Export is often faster than Internet transfer and more cost effective than upgrading your connectivity. You can use AWS Import/Export for migrating data into the cloud, distributing content to your customers, sending backups to AWS, and disaster recovery.

AWS Direct Connect makes it easy to establish a high-bandwidth, dedicated network connection from your premises to AWS. With AWS Direct Connect, you can transfer your business critical data directly from your datacenter into AWS, bypassing your Internet service provider and removing network congestion. Further, AWS Direct Connect makes it easy to scale your connection to meet your data transfer needs. AWS Direct Connect provides 1 Gbps and 10 Gbps connections, and you can easily provision multiple connections if you need more capacity.

Amazon Glacier Vault Lock allows you to easily deploy and enforce compliance controls on individual Glacier vaults via a lockable policy. You can specify controls such as “Write Once Read Many” (WORM) in a Vault Lock policy and lock the policy from future edits. Once locked, the policy becomes immutable and Glacier will enforce the prescribed controls to help achieve your compliance objectives. To learn more, please read Amazon Glacier Vault Lock in the Amazon Glacier developer’s guide.

Amazon Glacier uses AWS Identity and Access Management (IAM) to help you securely control access to AWS and your Amazon Glacier data. You can create users in IAM, assign individual security credentials (i.e., access keys, passwords, and multi-factor authentication devices) and IAM policies on each Amazon Glacier vault to grant permitted activities to intended users.

Amazon Glacier allows you to tag your Glacier vaults for easier resource and cost management. Tags are labels that you can define and associate with your vaults, and using tags adds filtering capabilities to operations such as AWS cost reports. For example, you can use tags to allocate Glacier costs and usage across multiple departments in your organization or by any other categorization. For more information see Tagging Your Amazon Glacier Vaults.

Amazon Glacier supports audit logging with AWS CloudTrail, which records Amazon Glacier API calls for your account and delivers these log files to you. These log files provide visibility into actions performed on your Amazon Glacier assets. For instance, you can determine which users have accessed a vault over the last month or identify who deleted a particular archive and when. Using audit logging can help you implement compliance and governance objectives for your cloud-based archival system. To learn more read Using Audit Logging with Amazon Glacier.

Vault access policies allow you to easily manage access to your individual Glacier vaults. You can define an access policy directly on a vault to grant vault access to users and business groups internal to your organization, as well as to your external business partners. To learn more please read Managing Vault Access Policies in the Amazon Glacier developer’s guide.

Amazon Glacier maintains an inventory of all archives in each of your vaults for disaster recovery or occasional reconciliation. The vault inventory is updated approximately once a day. You can request a vault inventory as either a JSON or CSV file which will contain details about the archives including the size, creation date, and the archive description if provided during upload. The inventory will represent the state of the vault as of the most recent inventory update.

Amazon Glacier data retrieval policies let you define your own data retrieval limits with a few clicks in the AWS console. You can limit retrievals to “Free Tier Only”, or if you wish to retrieve more than the free tier, you can specify a “Max Retrieval Rate” to limit your retrieval speed and establish a retrieval cost ceiling. In both cases, Amazon Glacier will not accept retrieval requests that would exceed the retrieval limits you defined. To learn more please read Configuring Data Retrieval Policies in the Amazon Glacier developer’s guide.

Amazon Glacier can be accessed using the AWS Management Console, an easy-to-use web interface that provides the capability to create vaults, configure vault-level access permissions, and set up SNS notifications for data retrieval. The console also presents a storage usage summary for each vault as well as the last refresh time for the vault inventory.

Data upload and retrieval are done using the AWS SDKs or the underlying Amazon Glacier API. Amazon Glacier is supported by the AWS SDKs for Java, .NET, PHP, and Python (Boto). The SDK libraries wrap the underlying Amazon Glacier API, simplifying your programming tasks. These SDKs provide libraries that map to an underlying REST API and enable you to easily construct requests and process responses. The AWS SDKs for Java and .NET offer high-level and low-level API libraries.

Low-Level API

The low-level wrapper libraries map closely to the underlying Amazon Glacier API and provide the most complete implementation of the underlying Amazon Glacier operations.

High-Level API

The high-level APIs further simplify application development with a higher-level of abstraction for some of the operations. For example, when uploading an archive, the high-level API will automatically compute the checksum for you.

For information about these SDK libraries, see Using the AWS SDK for Java with Amazon Glacier and Using the AWS SDK for .NET with Amazon Glacier.

Amazon Glacier works together with Amazon S3 lifecycle rules to help you automate archiving of Amazon S3 data and reduce your overall storage costs. You can easily set up a rule that stores all your previous Amazon S3 object versions in the lower cost Glacier storage class and deletes them from Glacier storage after 100 days. This example would provide a 100-day window to roll back any changes made to your data and automatically lower your storage costs. For more information about lifecycle configuration and transitioning objects to Amazon Glacier, go to Object Lifecycle Management and Object Archival in the Amazon Simple Storage Service Developer Guide.

Data stored in Amazon Glacier is protected by default; only vault owners have access to the Amazon Glacier resources they create. Amazon Glacier encrypts your data at rest by default and supports secure data transit with SSL. It also supports access control mechanisms with Identity and Access Management (IAM) policies. With Amazon Glacier’s data protection features, you can protect your data from both logical and physical failures, guarding against data loss from unintended user actions, application errors, and infrastructure breakdown. For customers who must comply with regulatory standards such as PCI and HIPAA, Amazon Glacier’s data protection features can be used as part of an overall strategy to achieve compliance. The various data security and reliability features offered by Amazon Glacier are described in detail below.

Amazon Glacier automatically encrypts data at rest using Advanced Encryption Standard (AES) 256-bit symmetric keys and supports secure transfer of your data over Secure Sockets Layer (SSL).

Data stored in Amazon Glacier is immutable, meaning that after an archive is created it cannot be updated. This ensures that data such as compliance and regulatory records cannot be altered after they have been archived. Click here to learn more about archives.

Amazon Glacier supports Identity and Access Management (IAM) policies, which enables organizations with multiple employees to create and manage multiple users under a single AWS account. With IAM policies, you create fine-grained policies to control to your Amazon Glacier vaults. You can write IAM policies to selectively grant or revoke certain permissions and actions on each Amazon Glacier vault.

Amazon Glacier requires all requests to be signed for authentication protection. To sign a request, you calculate a digital signature using a cryptographic hash function that returns a hash value that you include in the request as your signature. After receiving your request, Amazon Glacier recalculates the signature using the same hash function and input that you used to sign the request before processing the request. Click here to learn more about request signing.

Amazon Glacier provides a highly durable storage infrastructure designed for long-term data archival storage. It is designed to provide average annual durability of 99.999999999% for an archive. The service redundantly stores data in multiple facilities and on multiple devices within each facility. To increase durability, Amazon Glacier synchronously stores your data across multiple facilities before confirming a successful upload.

To prevent corruption of data packets over the wire, Amazon Glacier uploads the checksum of the data during data upload. It compares the received checksum with the checksum of the received data to detect bit flips over the wire. Similarly, it validates data authenticity with checksums during data retrieval. Unlike traditional systems, that can require laborious data verification and manual repair, Amazon Glacier performs regular, systematic data integrity checks and is built to be automatically self-healing.

Learn more about data checksums.

Amazon Glacier supports the following archive operations: Upload, Download, and Delete. Archives are immutable and cannot be modified.

Uploading an archive is a synchronous operation. You can upload an archive in a single operation or upload larger archives in parts with the MultipartUpload API to improve throughput and fault tolerance. You can upload archives as small as 1 byte and as large as 40 TB. You will receive a unique archive ID once the archive has been durably stored. For more information, see Uploading an Archive in Amazon Glacier for recommendations on when to use MultipartUpload to improve throughput.

Downloading an archive is an asynchronous operation. You must first initiate a retrieval job of a specific archive. After receiving the job request, Amazon Glacier prepares your archive for download. After the job completes, you have 24 hours to download the data from the staging location.

To delete an archive you need to use the Amazon Glacier REST API or the AWS SDKs and specify the archive ID. You can also use a number of third party tools to delete archives. For more information, see Deleting an Archive in Amazon Glacier.

Your use of this service is subject to the Amazon Web Services Customer Agreement.