Vault

Source: src/AWS/Glacier/Vault.ts

An Amazon S3 Glacier vault — a container for archives in the original (vault-based) S3 Glacier service.

Vault creation is idempotent and free; storage is billed per archive. A vault must be empty to be deleted, which is always the case for vaults that only ever held configuration.

Creating Vaults

Basic Vault

import * as Glacier from "alchemy/AWS/Glacier";

const vault = yield* Glacier.Vault("Backups");

Vault with Tags

const vault = yield* Glacier.Vault("Backups", {
  tags: { team: "storage" },
});

Notifications

const topic = yield* SNS.Topic("VaultEvents");
const vault = yield* Glacier.Vault("Backups", {
  notificationConfig: {
    snsTopic: topic.topicArn,
    events: ["ArchiveRetrievalCompleted", "InventoryRetrievalCompleted"],
  },
});

Access Control

Vault access policy

const vault = yield* Glacier.Vault("Backups", {
  accessPolicy: {
    Version: "2012-10-17",
    Statement: [{
      Sid: "deny-archive-deletes",
      Effect: "Deny",
      Principal: "*",
      Action: ["glacier:DeleteArchive"],
      Resource: ["arn:aws:glacier:us-east-1:123456789012:vaults/backups"],
    }],
  },
});

Vault lock policy (left in-progress, never completed)

const vault = yield* Glacier.Vault("Compliance", {
  lockPolicy: {
    Version: "2012-10-17",
    Statement: [{
      Sid: "deny-archive-deletes",
      Effect: "Deny",
      Principal: "*",
      Action: ["glacier:DeleteArchive"],
      Resource: ["arn:aws:glacier:us-east-1:123456789012:vaults/compliance"],
    }],
  },
});