## TL;DR
Archiving logs to Glacier only saves money if nobody needs to read them. Check the compliance retention policy and expected access pattern first: if auditors pull these logs, keep them in Standard or Infrequent Access. Price one realistic retrieval before you archive; Glacier retrieval fees can exceed years of Standard storage.

```text
agent archived cloudwatch logs to glacier, compliance needed them in standard and retrieval cost more
```

## Use this when
- Archived logs had to be retrieved for an audit or investigation and the retrieval bill hurt.
- A lifecycle policy moved logs to Glacier without checking access requirements.
- Compliance mandates a retention period with timely access.

## Not for this skill when
- The logs have no retention requirement and are genuinely write-once, read-never. Glacier is right for those.
- Retrieval is rare and planned well ahead; Glacier Flexible with bulk retrieval can still win.

## Steps
1. Read the compliance retention policy: how long, and how fast must the logs be retrievable? Verify: get the access SLA in writing, not as an assumption.
2. Estimate one realistic retrieval: the full log volume times the Glacier retrieval rate for the needed speed. Verify: compare against 12 months of Standard storage for the same data.
3. Move compliance-required logs back to Standard (or S3 Standard / Infrequent Access via export) if the math favors it.
4. Split the lifecycle policy: compliance logs get a Standard-friendly policy, debug logs get the aggressive Glacier policy.
5. Tag log groups with their retention class so future automation archives by policy, not by age alone.
6. Re-run the retrieval estimate annually; access patterns change.

## Variant phrasings
### glacier retrieval cost more than storage saved
The billing-side phrasing.
### cloudwatch logs archive compliance retention
The policy framing.
### s3 glacier vs standard audit log access
The comparison question.

Compatibility: CloudWatch Logs export to S3, S3 lifecycle policies and Glacier storage classes.

## Why it happens
"Older equals colder" is a tidy rule, so automation applies it to everything. But compliance logs are not cold; they are dormant until an auditor asks, and then they need to be readable this week. The archive saved pennies per GB-month and the retrieval cost dollars per GB.

## Edge cases / pitfalls
- Expedited Glacier retrieval is the expensive tier; if the audit needs data fast, the bill multiplies. Know which tier the SLA requires.
- Log group retention settings and S3 lifecycle policies are separate knobs; check both.
- Some regulations require immutable storage (Object Lock); factor that into the destination choice, not just the price.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_jLO0LCt1-ICrf6gHC3zNeA