OCI Archive Storage is the cold tier within Object Storage. Objects cost a fraction of the Standard tier but require a restore operation before reading. For logs older than 90 days, database backups beyond the recovery window, and audit trails required by compliance frameworks, Archive tier delivers significant savings without data loss risk. This post covers lifecycle policy automation, WORM retention rules, cross-region replication, and restore patterns.

Step 1: Archive Bucket with WORM Retention

resource "oci_objectstorage_bucket" "compliance_archive" {
  compartment_id = var.compartment_id
  namespace      = var.tenancy_namespace
  name           = "compliance-archive"
  access_type    = "NoPublicAccess"
  storage_tier   = "Archive"
  versioning     = "Enabled"
  kms_key_id     = var.vault_key_id

  retention_rules {
    display_name = "7-year-compliance-retention"
    duration {
      time_amount = 7
      time_unit   = "YEARS"
    }
    time_rule_locked = "2026-10-13T12:00:00Z"
  }

  defined_tags = { "Operations.Environment" = "production", "Operations.ManagedBy" = "terraform" }
}

output "archive_bucket" { value = oci_objectstorage_bucket.compliance_archive.name }

Step 2: Lifecycle Policy for Automatic Tiering

resource "oci_objectstorage_bucket" "production_logs" {
  compartment_id = var.compartment_id
  namespace      = var.tenancy_namespace
  name           = "production-logs"
  access_type    = "NoPublicAccess"
  storage_tier   = "Standard"
}

resource "oci_objectstorage_object_lifecycle_policy" "logs_lifecycle" {
  bucket    = oci_objectstorage_bucket.production_logs.name
  namespace = var.tenancy_namespace

  rules {
    name        = "infrequent-access-30d"
    action      = "INFREQUENT_ACCESS"
    is_enabled  = true
    time_amount = 30
    time_unit   = "DAYS"
    object_name_filter { inclusion_prefixes = ["logs/"] }
  }

  rules {
    name        = "archive-90d"
    action      = "ARCHIVE"
    is_enabled  = true
    time_amount = 90
    time_unit   = "DAYS"
    object_name_filter { inclusion_prefixes = ["logs/"] }
  }

  rules {
    name        = "delete-2555d"
    action      = "DELETE"
    is_enabled  = true
    time_amount = 2555
    time_unit   = "DAYS"
    object_name_filter { inclusion_prefixes = ["logs/"] }
  }
}

Step 3: Cross-Region Replication

resource "oci_objectstorage_replication_policy" "archive_dr" {
  bucket                  = oci_objectstorage_bucket.compliance_archive.name
  namespace               = var.tenancy_namespace
  name                    = "archive-cross-region-dr"
  destination_region      = "eu-frankfurt-1"
  destination_bucket_name = "compliance-archive-dr"
}

Operational Notes

Archive tier objects require a restore operation before download. Restore takes approximately 1 hour. The restored copy remains in the Standard tier for 24 hours by default. Specify additional hours when submitting the restore request if you need longer access. After the window expires, the object returns to the Archive tier, and you pay only for the Archive rate again.

Once a retention rule is locked (after the time_rule_locked timestamp), it cannot be shortened or deleted even by tenancy administrators. Set the lock time when creating the bucket before any data is written, and confirm the retention period satisfies your compliance framework before locking. Locking is permanent and irreversible.

Regards,
Osama

#OCI #OracleCloud #ArchiveStorage #ObjectStorage #Lifecycle #Terraform #IaC #TechBlog #Oracle #FinOps #DataRetention #CloudStorage #OracleCloudInfrastructure #Compliance #WORM #DataArchival #ColdStorage #CrossRegion #DisasterRecovery #AuditTrail