TheArchitect

S3 Intelligent-Tiering & Lifecycle Archive

AWS architecture template · Full S3 storage cost optimisation: Intelligent-Tiering for unknown access patterns, lifecycle rules cascade to Glacier and Deep Archive — up to 95 % storage cost reduction.

S3 Intelligent-Tiering & Lifecycle Archive is a free AWS architecture template built with S3, CloudWatch, KMS and SNS. Open it in TheArchitect to edit the diagram, estimate monthly cost, and export the CloudFormation or Terraform that deploys it.

Open in TheArchitect All templates
S3 Hot (Standa…S3 Archive (Gl…KMS CMK (hot t…Lifecycle SNS …Storage Growth…
S3 Intelligent-Tiering & Lifecycle Archive architecture diagram

AWS services in this template

  • S3×2
  • CloudWatch
  • KMS
  • SNS

Deployment notes

Deploy-ready

  • Intelligent-Tiering monitoring fee: $0.0025/1,000 objects >128 KB. Free for objects <128 KB.
  • Lifecycle transitions: Standard → Standard-IA (30 days) → Glacier Instant (90 days) → Glacier Flexible (180 days) → Deep Archive (365 days).
  • Storage cost per GB: Standard $0.023 → Standard-IA $0.0125 → Glacier $0.004 → Deep Archive $0.00099.
  • KMS encryption adds ~$0.03/10,000 requests. Use SSE-S3 for cold archive tiers to minimise key usage charges.

Generated CloudFormation — 5 resources

Logical IDResource type
S3HotStandardITs3AWS::S3::Bucket
S3ArchiveGlacierDAs3AWS::S3::Bucket
KMSCMKhottierkmsAWS::KMS::Key
LifecycleSNSAlertssnsAWS::SNS::Topic
StorageGrowthAlarmcloudwatchAWS::CloudWatch::Alarm
View the full CloudFormation template
{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "Generated by TheArchitect — https://www.thecloudarchitect.dev",
  "Metadata": {
    "TheArchitect": {
      "Edges": [
        {
          "From": "KMSCMKhottierkms",
          "To": "S3HotStandardITs3",
          "Label": "encrypt hot objects"
        }
      ]
    }
  },
  "Resources": {
    "S3HotStandardITs3": {
      "Type": "AWS::S3::Bucket",
      "Properties": {
        "BucketName": "cost-lifecycle-hot",
        "VersioningConfiguration": {
          "Status": "Enabled"
        },
        "OwnershipControls": {
          "Rules": [
            {
              "ObjectOwnership": "BucketOwnerEnforced"
            }
          ]
        },
        "BucketEncryption": {
          "ServerSideEncryptionConfiguration": [
            {
              "ServerSideEncryptionByDefault": {
                "SSEAlgorithm": "aws:kms"
              }
            }
          ]
        },
        "PublicAccessBlockConfiguration": {
          "BlockPublicAcls": true,
          "BlockPublicPolicy": true,
          "IgnorePublicAcls": true,
          "RestrictPublicBuckets": true
        }
      }
    },
    "S3ArchiveGlacierDAs3": {
      "Type": "AWS::S3::Bucket",
      "Properties": {
        "BucketName": "cost-lifecycle-archive",
        "OwnershipControls": {
          "Rules": [
            {
              "ObjectOwnership": "BucketOwnerEnforced"
            }
          ]
        },
        "BucketEncryption": {
          "ServerSideEncryptionConfiguration": [
            {
              "ServerSideEncryptionByDefault": {
                "SSEAlgorithm": "AES256"
              }
            }
          ]
        },
        "PublicAccessBlockConfiguration": {
          "BlockPublicAcls": true,
          "BlockPublicPolicy": true,
          "IgnorePublicAcls": true,
          "RestrictPublicBuckets": true
        }
      }
    },
    "KMSCMKhottierkms": {
      "Type": "AWS::KMS::Key",
      "Properties": {
        "Description": "KMS CMK for hot-tier S3 encryption — enables CloudTrail key usage audit",
        "KeyUsage": "ENCRYPT_DECRYPT",
        "EnableKeyRotation": true,
        "Enabled": true
      }
    },
    "LifecycleSNSAlertssns": {
      "Type": "AWS::SNS::Topic",
      "Properties": {
        "TopicName": "cost-s3-lifecycle-alerts",
        "DisplayName": "S3 Lifecycle Alerts"
      }
    },
    "StorageGrowthAlarmcloudwatch": {
      "Type": "AWS::CloudWatch::Alarm",
      "Properties": {
        "AlarmName": "cost-s3-storage-spike",
        "AlarmDescription": "Alert when S3 BucketSizeBytes increases by >20 % week-over-week — unexpected growth",
        "Namespace": "AWS/S3",
        "MetricName": "BucketSizeBytes",
        "Statistic": "Average",
        "Period": 86400,
        "EvaluationPeriods": 1,
        "ComparisonOperator": "GreaterThanThreshold",
        "TreatMissingData": "notBreaching"
      }
    }
  }
}

Generated by TheArchitect from the diagram above. Review values such as names, CIDR ranges and instance sizes before deploying to your account.

Related templates