An audit needs a year of logs by tomorrow and they sit in the coldest tier — what do you check first?

## Two numbers, not one When data sits in the coldest tier, "can we get it by tomorrow" and "what will it cost" are answered by different properties of the tier, and confusing them is the usual failure. **Restore latency** is how long after the request the bytes become readable. Warm and intermediate cooler tiers are immediate. The coldest tiers are not: the object is unreadable until a restore completes, which can run from minutes to hours. Providers commonly sell more than one restore speed, with the faster one carrying a larger charge, so latency is partly purchasable — which is exactly the trade to evaluate when a deadline is real. **Retrieval cost** is what you pay to read the bytes back: a charge per gigabyte retrieved, plus a charge per restore request issued, plus rent on the temporary readable copy while it exists. That last one surprises people — during the restore window you are paying for the archived object *and* its readable copy. ## The part that is really about object count A restore is requested per object. A year of application logs is commonly millions to hundreds of millions of objects, and that changes the shape of the problem: - The elapsed time is not one restore latency; it is the latency plus however long it takes to issue and complete that many requests, against whatever request rate the store will accept. - The request charges scale with object count, independently of volume. - The job that issues them needs to be resumable, because it will not finish in one run, and re-requesting an already-restored object is wasted money. This is the same per-object arithmetic that makes tiering small objects expensive in the first place, arriving a second time on the way out. ## The order to work it in 1. **Scope the ask.** Which systems, which date ranges, which fields? Audits are usually narrower than the first email suggests. Every prefix you exclude removes objects from every subsequent number. 2. **Count the objects and the bytes in scope.** Both, separately — one drives requests and elapsed time, the other drives the retrieval charge. 3. **Read the tier's restore options.** Standard and expedited restore speeds, and what each costs. Decide whether the deadline needs the expensive one. 4. **Estimate elapsed time end to end**: request issuance for that many objects, restore completion, then the actual read and transfer to wherever the auditor consumes it. 5. **Decide the readable-copy lifetime.** Keep it as short as the audit allows; you are renting it alongside the original. 6. **Come back with a number, not a yes.** If tomorrow is not achievable at any price, say so early with the two numbers behind it. That conversation is much cheaper on day one than on day two. ## What the restore does and does not do A restore produces a **temporary readable copy**; it does not promote the object back into the warm tier, and it does not cancel the tier's minimum storage duration. When the copy expires, the object is exactly where it was. If the data is going to be read repeatedly over the coming weeks — an audit that runs for a month, say — the honest move may be to copy the in-scope subset into a warm location for the duration and delete it afterwards, rather than restoring the same objects again and again. ## What should have been true beforehand The question is a diagnosis, but the lesson is a design one: - **Keep a warm index.** A small searchable summary — timestamps, identifiers, which archive object holds what — lets an audit locate the few thousand objects it needs instead of restoring a year. The index is a tiny fraction of the volume and stays in the warm tier. - **Compact by a dimension audits use.** One archive object per source per day is retrievable in the units auditors ask in. Millions of per-request objects are not. - **Rehearse one restore.** A single small restore, run once, converts the tier's documented latency into a measured number you can quote under pressure, and proves the restore path works before the day it is needed. A candidate who answers only "it will take a while and cost money" has not done the job. The two numbers, the object-count effect, and the scoping conversation are the answer.