Platform Storage Services

Durability is about bytes surviving; availability is about bytes being reachable now. A many-nines durability figure estimates how unlikely it is that the store loses an object, and says nothing about an hour of failed requests.

Scratch belongs on a block volume: it attaches to one machine and behaves like a local disk, so seeks and in-place writes are cheap. Finished videos belong in an object store, fetched by key over HTTP by any number of readers.

A colder tier discounts rent by charging separately for reads and by making them slow. Data read every week pays a retrieval charge every week and waits for a restore each time, so the bill usually goes up, not down.

Versioning kept each pre-overwrite copy as a previous version under the same key, so recovery is promoting that version back to current, key by key. Nothing is restored from a backup, and every retained version keeps being stored and charged.

A policy attached to the store itself can name callers its owner does not administer, including an anonymous one, so it grants access to a caller carrying no permission of its own. An identity-attached permission only widens what an identity you already manage may do.

Durability defends the bytes against hardware, not against you. The store did exactly what it was asked and then replicated the overwrite faithfully to every copy, so a high durability figure is not a backup and never rewinds a bad write.

There is no rename. The key namespace is flat, so the store lists every key under the old prefix and performs a copy to the new key followed by a delete of the old one — per object. Cost and duration scale with object count, not bytes.

Both actions bill in full. A colder tier carries a minimum storage duration, so an object deleted after fifteen days there is still charged for the whole minimum, plus a per-object fee for the move — often more than the rent the rule saved.

The delete wrote a marker that became the key's current version and hid it from ordinary listings and reads. The earlier versions still exist and still occupy paid storage until something removes them by version identifier.

Replication copies operations, so a deletion is reproduced faithfully at the destination. It defends against losing a failure domain, never against a wrong call. Versioning, a retention lock or a genuinely separate backup are what survive a mistake.

Anyone holding the link, until it expires. A signed time-limited link is a bearer credential in a URL: the store checks the signature and the clock, not the identity of whoever presents it. It bounds exposure in time, not in audience.

Copies inside one zone survive a failed disk or machine. Copies spread across zones in a region survive losing a whole zone. A copy in another region survives losing the region. Each step costs more and is usually a setting you choose.

Reads can be served for any byte span because the store already holds the bytes and can return a slice. Writes create a new immutable object under the key, so there is no place to patch — the store replaces what the key points at.

A preventive control. An account-level override refusing public grants sits above every store in the account, so a rule naming an unrestricted caller is rejected when written or ignored when evaluated, whatever a project team puts in a store's policy.

The request is evaluated against both sides at once. A matching explicit deny in the store's own policy ends the request no matter how broad the caller's identity permission is, and a condition on a store-side allow that the request fails to satisfy has the same effect.

Because the write is acknowledged once the near copies are durable, and the far copy is applied afterwards by a background worker. That copy trails by a variable lag, so the newest objects have not reached it yet.

A block volume attaches to one machine at a time. The filesystem on it — its cache, its free-space map, its journal — is a single-machine structure, so two machines writing would corrupt it. Share through an object store or a shared mount instead.

Colder tiers bill a fixed overhead per object on top of its real size, and charge a fee per object moved. Across hundreds of millions of tiny objects that overhead dwarfs the payload, so the cheaper per-gigabyte rate applies to far more billed gigabytes.

Two independent numbers decide it: the tier's restore latency, which says whether tomorrow is achievable, and the retrieval charge plus per-object restore requests, which says what it costs. Check both before promising the deadline.

A lock that cannot be shortened keeps the bytes until its retained-until date passes, so the erasure obligation has to be met another way — usually by destroying the key material that makes the record readable, and by never placing erasable personal data under such a lock in the first place.

Lifecycle rules are evaluated asynchronously on the provider's own schedule, so an object becomes eligible at the age and moves some time afterwards. The other common cause is a filter mismatch: the object's key never matched the rule.

Round trips, not bytes. On a shared mount every open, stat, create and directory lookup crosses the network, and with tiny files those metadata operations vastly outnumber the data transferred. The fix is to make the unit of work bigger.