Introduction

Long-term data archiving, regulatory compliance logging, and disaster recovery planning demand ultra-low-cost cloud storage options. Amazon S3 Glacier provides durable, secure, and extremely cost-effective object archiving designed for data accessed infrequently. Unlike real-time block or object storage engines (such as Amazon S3 Standard or EBS), Glacier relies on asynchronous retrieval workflows, trading immediate milliseconds-level retrieval latency for drastically reduced monthly storage overhead.

In this comprehensive practical guide, we will analyze Amazon Glacier storage tiers, provision an S3 Glacier Vault using both the AWS Management Console and AWS CLI, configure strict IAM permission policies, initiate asynchronous job requests, and manage archive deletion lifecycles cleanly.

Creating a Vault using AWS Console

Think of a vault as a secure container where all your archived files live.

Step1 : Create S3 Glacier Vault via AWS Console & AWS CLI

A Glacier Vault acts as a secure logical container for organizing archived payload objects (archives).

Console Method: Navigate to Amazon S3 Glacier > Vaults > Create Vault. Select your target AWS Region (e.g., ap-south-1), specify your vault name (enterprise-glacier-vault), and submit.

AWS CLI Method: Execute the creation command using standard CLI flags ( indicates your active authenticated account ID):

aws glacier create-vault --account-id - --vault-name enterprise-glacier-vault
    

Step 2: Define Least-Privilege IAM Access Policy

Attach an IAM policy to your service user or execution role restricting action scopes to target vault resources:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "glacier:UploadArchive",
                "glacier:InitiateJob",
                "glacier:GetJobOutput",
                "glacier:ListVaults",
                "glacier:DescribeVault",
                "glacier:DeleteArchive"
            ],
            "Resource": "arn:aws:glacier:ap-south-1:123456789012:vaults/enterprise-glacier-vault"
        }
    ]
}
    

Step 3: Upload Archive Object via AWS CLI

Create a sample payload file and stream it into your glacier vault:

echo "Production Backup Archive Record" > backup-data.txt

aws glacier upload-archive \
  --account-id - \
  --vault-name enterprise-glacier-vault \
  --body backup-data.txt
    

Note: The AWS CLI response output will return a unique 138-character archiveId hash alongside a SHA-256 tree hash. You must store this Archive ID in a local database or tracking sheet, as direct directory browsing is disabled in Amazon Glacier.

Step 4: Initiate Job & Fetch Vault Inventory Listing

To discover archives stored within a vault without pre-saved IDs, submit an asynchronous inventory job:

# 1. Initiate job execution
aws glacier initiate-job \
  --account-id - \
  --vault-name enterprise-glacier-vault \
  --job-parameters '{"Type": "inventory-retrieval"}'

# 2. Wait 3 to 5 hours for the job status to transition to Completed
# 3. Download the inventory JSON catalog payload
aws glacier get-job-output \
  --account-id - \
  --vault-name enterprise-glacier-vault \
  --job-id  \
  vault-inventory.json
    

Step 5: Execute Data Restorations Across Retrieval Tiers

When requesting archive files back, Glacier offers three distinct retrieval tiers based on access speed urgency:

• Expedited Retrieval: Delivers data within 1–5 minutes (Higher operational cost).
• Standard Retrieval: Delivers data within 3–5 hours (Standard operational cost).
• Bulk Retrieval: Delivers massive batch data within 5–12 hours (Lowest cost).

# Initiate standard restore job specifying the archive ID
aws glacier initiate-job \
  --account-id - \
  --vault-name enterprise-glacier-vault \
  --job-parameters '{"Type": "archive-retrieval", "ArchiveId": "", "Tier": "Standard"}'
    

Step 6: Delete Archive Objects and Vault Container

Individual archives can be deleted directly using their specific ArchiveId. Once all archives are completely wiped out, the empty vault container can be deleted:

# 1. Delete specific archive object
aws glacier delete-archive \
  --account-id - \
  --vault-name enterprise-glacier-vault \
  --archive-id 

# 2. Delete the empty Glacier Vault container
aws glacier delete-vault \
  --account-id - \
  --vault-name enterprise-glacier-vault
    

S3 Glacier Vault vs. S3 Lifecycle Transitioning:

Management Complexity Warning: Managing direct S3 Glacier Vaults via CLI requires tracking custom 100+ character ArchiveId strings manually in external databases.

Production Recommendation: For enterprise cloud workflows, it is strongly recommended to store objects in standard Amazon S3 buckets and apply automated S3 Lifecycle Rules. S3 handles moving files to Glacier Flexible Retrieval or Deep Archive automatically behind the scenes, allowing engineers to maintain simple object key paths (s3://bucket-name/folder/filename.ext) without managing raw Glacier Vault Job IDs manually.

Production Troubleshooting: Common AWS Glacier Errors

Asynchronous cloud storage frameworks operate differently than instant block storage engines. Use the diagnostic matrix below to resolve Glacier errors fast:

Error 1: ResourceNotFoundException on GetJobOutput Execution

• The Error Log:

An error occurred (ResourceNotFoundException) when calling the GetJobOutput operation: The job ID was not found or has expired.
    

The Root Cause: Executing get-job-output immediately after initiate-job fails because the job request is still queued in AWS background workers, or the job output expired (Job results are retained for only 24 hours after completion).

The Fix: Poll the job status first to confirm its state displays Succeeded:

aws glacier describe-job --account-id - --vault-name enterprise-glacier-vault --job-id 
    

Only execute get-job-output when Completed returns true.

Error 2: VaultNotEmptyException on Vault Deletion Attempt

• The Error Log:

An error occurred (VaultNotEmptyException) when calling the DeleteVault operation: The vault cannot be deleted because it contains archives.
    

• The Root Cause: Attempting to delete a vault while archive objects exist inside it. Even if you deleted all archives 5 minutes ago, AWS Glacier inventory updates take up to 24 hours to sync internal state metadata.
• The Fix: Delete all individual archives using aws glacier delete-archive. Wait 24 hours for the automated vault inventory daemon to run and register a 0 archive count before executing aws glacier delete-vault.

Error 3: InvalidParameterValueException During Inventory Retrieval

• The Error Log:

An error occurred (InvalidParameterValueException) when calling the InitiateJob operation: Invalid account ID parameter -.
    

The Root Cause: Certain older versions of the AWS CLI or shell environments (like PowerShell) do not parse the - wildcard flag correctly as a shorthand alias for the current authenticated AWS account ID.

The Fix: Explicitly pass your actual 12-digit AWS Account ID instead of the hyphen character:

aws glacier initiate-job --account-id 123456789012 --vault-name enterprise-glacier-vault --job-parameters '{"Type": "inventory-retrieval"}'