Detect, troubleshoot & optimize AWS environments in real-time ->

Amazon Web Service (AWS)

S3 Glacier

Amazon S3 Glacier is a low-cost, long-term cloud storage service designed for data archiving, backup and disaster recovery, and compliance requirements. S3 Glacier provides secure and durable storage for infrequently accessed data at a lower cost compared to Amazon S3 standard storage. Data retrieval times can range from minutes to several hours, making S3 Glacier an ideal solution for storing large amounts of data that are infrequently accessed.
The cost of using S3 Glacier depends on the amount of storage space used, the data retrieval speed, the number of requests, and the data transfer. The cost of data retrieval and transfer can vary based on the amount of data involved and the region in which the data is stored.
Direct Cost

$ per GB - <Region> data transfer to <Region>

$ per GB for <Region>-AWS-Out-Bytes in <Region>

Indirect Cost
No items found.
Terraform Name
S3 Glacier

The following arguments are supported:

  • name - (Required) The name of the Vault. Names can be between 1 and 255 characters long and the valid characters are a-z, A-Z, 0-9, '_' (underscore), '-' (hyphen), and '.' (period).
  • access_policy - (Optional) The policy document. This is a JSON formatted string. The heredoc syntax or file function is helpful here. Use the Glacier Developer Guide for more information on Glacier Vault Policy
  • notification - (Optional) The notifications for the Vault. Fields documented below.
  • tags - (Optional) A map of tags to assign to the resource. If configured with a provider default_tags configuration block present, tags with matching keys will overwrite those defined at the provider-level.

notification supports the following:

  • events - (Required) You can configure a vault to publish a notification for ArchiveRetrievalCompleted and InventoryRetrievalCompleted events.
  • sns_topic - (Required) The SNS Topic ARN.

Associating resources with a
S3 Glacier
Resources do not "belong" to a
S3 Glacier
Rather, one or more Security Groups are associated to a resource.
S3 Glacier
via Terraform:
The following HCL creates a Glacier Vault Resource

resource "aws_sns_topic" "aws_sns_topic" {
 name = "glacier-sns-topic"

resource "aws_glacier_vault" "my_archive" {
 name = "MyArchive"

 notification {
   sns_topic = aws_sns_topic.aws_sns_topic.arn
   events    = ["ArchiveRetrievalCompleted", "InventoryRetrievalCompleted"]

 access_policy = <<EOF
         "Sid": "add-read-only-perm",
         "Principal": "*",
         "Effect": "Allow",
         "Action": [
         "Resource": "arn:aws:glacier:eu-west-1:432981146916:vaults/MyArchive"

 tags = {
   Test = "MyArchive"

S3 Glacier
via CLI:

--account-id <value>
--vault-name <value>
[--cli-input-json | --cli-input-yaml]
[--generate-cli-skeleton <value>]
[--endpoint-url <value>]
[--output <value>]
[--query <value>]
[--profile <value>]
[--region <value>]
[--version <value>]
[--color <value>]
[--ca-bundle <value>]
[--cli-read-timeout <value>]
[--cli-connect-timeout <value>]
[--cli-binary-format <value>]


aws glacier create-vault --vault-name my-vault --account-id -

Best Practices for
S3 Glacier

Categorized by Availability, Security & Compliance and Cost

No items found.
Explore all the rules our platform covers
Related blog posts
All Resources