Versioning, object lock and lifecycle rules, explained
Three bucket settings decide what happens when files are overwritten, deleted or simply get old. Here is what each one does and when to use it.
Most object storage mistakes are not outages. They are a script that deleted the wrong prefix, an upload that overwrote last month’s file, or a bucket that quietly grew for two years. Three settings protect you from all of them.
Versioning: an undo for every file
With versioning on, overwriting a file keeps the old copy as an earlier version, and deleting a file only hides it behind a delete marker. In the bucket browser, Show versions lists the older copies so you can download or restore them.
Use it for: anything you would be upset to lose, such as backups, documents and user uploads.
The catch: old versions take up space and are billed like any other data. Pair versioning with a lifecycle rule if files change often.
Object lock: nobody can delete it, not even you
Object lock makes files impossible to change or delete for a set retention time, even with a valid key. It protects backups from ransomware, a stolen key or a mistaken script. It needs versioning, and it can only be turned on when the bucket is created.
Governance: Files are locked for the retention period. This is the default.
Compliance: Nobody, not even ByteNests support, can shorten the retention or delete a locked file before it ends.
bn s3 bucket create acme-backups --object-lock --retention 30d
Choose the retention time carefully, especially in compliance mode: locked files are stored and billed until it ends.
Lifecycle rules: tidy up automatically
A lifecycle rule deletes files under a prefix after a number of days. Rules run once a day.
logs/: 30 days: Logs are rarely read after a month.
tmp/: 2 days: Abandoned uploads and scratch files.
backups/daily/: 14 days: Keep two weeks of daily backups.
To expire every file in a bucket, set delete files after a number of days when you create it, or use --expire-days with bn s3 bucket create.
Putting them together
Backups: On: On, 14 to 30 days: Delete after the retention time
User uploads: On: Off: Clear tmp/ after a few days
Public website assets: Optional: Off: None
Logs: Off: Off: Delete after 30 days