S3 Lifecycle Policy Generator

Introduction:

Objects in Amazon S3 often outlive the job that created them. Access logs, temporary exports, ingestion files, old document versions, and abandoned multipart uploads can sit in a bucket for years unless someone writes a retention rule for them. S3 lifecycle configuration is the way those storage decisions become automatic. A rule can move matching objects to a colder storage class, expire current objects, clean noncurrent versions, remove expired delete markers, or abort unfinished multipart uploads after a chosen age.

The important decision is not only when an object should be cheaper or gone. Lifecycle rules also decide which objects qualify. A broad rule can affect a whole bucket, while a narrower rule can match a prefix such as logs/app/, require one or more object tags, and limit the rule to a size range. Scope mistakes are expensive because a lifecycle configuration acts after it is applied. A missing tag can leave data behind, and a whole-bucket expiration rule can delete data that was never meant to be part of the cleanup plan.

Versioning changes what deletion means. In a bucket without versioning, current-object expiration removes the object. In a versioning-enabled or versioning-suspended bucket, the current object and older versions can have separate actions. Noncurrent version cleanup can reduce storage and restore clutter, but it can also remove rollback points that a recovery process expects to keep.

Storage classes add another review step. S3 Standard-IA and S3 One Zone-IA require transition timing that respects the 30-day rule, while Glacier retrieval classes can have minimum storage durations that make early expiration a cost problem. Intelligent-Tiering is different because it is designed for changing access patterns, but it still needs a workload owner to confirm that monitoring and access expectations fit the data.

A useful lifecycle policy starts from a data-retention plan, not from a code format. Confirm who owns the bucket, which existing rules must stay, what legal hold or Object Lock controls may apply, and how restored data would be used before turning generated text into a live configuration.

How to Use This Tool:

Start with the preset closest to the retention pattern, then make the scope and destructive actions explicit before copying any generated output.

1. Choose Lifecycle preset. Use the log archive, temporary cleanup, data lake tiering, version cleanup, multipart cleanup, or directory bucket pattern as a starting point rather than building every field from blank values.
2. Enter Bucket name, Rule ID, Bucket type, and rule status. Pick Disabled when the policy should be staged for review before S3 performs actions.
3. Define scope with Object key prefix, Tag filters, and object-size boundaries. Whole-bucket scope is valid only when the summary and ledger prove that every object in the bucket belongs in the rule.
4. Add current-object transitions as rows of day, storage class, and note. Set Current-object expiration only when deletion after that age is intended.
5. Set the Bucket versioning posture before entering noncurrent transition, noncurrent expiration, or retained-version values. Noncurrent actions are intentionally omitted when the selected bucket posture is not versioned.
6. Use Abort incomplete multipart uploads for stale upload-part cleanup. If tag filters are present, the result should show a companion multipart rule because S3 does not allow that action with tag filters in the same rule.
7. Open Advanced options only when the deployment artifact needs an expected bucket owner, AWS Region, CloudFormation logical ID, Terraform resource name, review comments, or a different row limit.
8. Review Lifecycle JSON, XML, CloudFormation, Terraform, AWS CLI, Rule Ledger, Review Checks, and Lifecycle Timeline. Fix blocking issues first; treat warning notes as approval items rather than decoration.

Interpreting Results:

Lifecycle config ready means the current entries passed the local checks and produced at least one lifecycle rule. It does not mean the configuration is safe for production. The summary tells you how many rules were generated, how many current-object transitions are present, whether current expiration is active, and whether the output is for a general purpose or directory bucket.

Rule Ledger is the best review view before copy or download. It lists the rule ID, object stage, action, day or threshold, storage class, scope, and review note. When a generated artifact and the ledger disagree in your mind, trust the ledger to explain what the normalized policy is trying to do before inspecting the raw JSON.

• Blocking input issues mean the artifacts should not be used until the named field or timing conflict is corrected.
• AWS constraints warnings can still describe valid output, but they point to real review work such as directory bucket omissions, early deletion charge risk, disabled status, or the 128 KB transition default.
• Lifecycle Timeline shows day-based actions for current objects, noncurrent versions, and multipart uploads, but legal retention, backup ownership, and restore tests must be checked outside the chart.
• AWS CLI output uses put-bucket-lifecycle-configuration, so applying it can replace the bucket's existing lifecycle configuration unless the old and new rules are merged first.

Technical Details:

S3 stores lifecycle configuration as a list of rules. Each rule has an ID, status, filter, and one or more actions. A filter can be empty for bucket-wide scope, use a prefix, use a tag, combine several predicates with an And filter, or add object-size comparisons. Current-object actions count from object creation. Noncurrent version actions count from the moment a version stops being current. Multipart cleanup counts from upload initiation rather than object age.

Transition timing is governed by both the target storage class and the order of later actions. Standard-IA and One Zone-IA require at least day 30 before transition. If a later transition or expiration arrives before the selected storage class has met its minimum duration, the policy may be rejected locally or flagged for cost review. Expiration also has a hard ordering rule: current-object expiration must be later than the final current-object transition day.

Rule Core:

Storage Class Timing:

Object Size Boundary Math:

S3 object-size filters use exclusive byte comparisons. The readable kilobyte entries are converted so a requested inclusive boundary still includes objects exactly at that kilobyte value.

A visible minimum of 128 KB becomes ObjectSizeGreaterThan 131071, so an object of exactly 131072 bytes still matches. A maximum of 1024 KB becomes ObjectSizeLessThan 1048577, so an object of exactly 1048576 bytes still matches.

The JSON, XML, CloudFormation, Terraform, and AWS CLI outputs represent the same lifecycle model as closely as each format allows. The command example writes a lifecycle JSON document and submits it with put-bucket-lifecycle-configuration. Because that operation replaces the bucket lifecycle configuration, existing bucket rules need to be carried into the new configuration before the command is used.

Limitations:

The generator creates review artifacts from the values entered in the browser. It does not inspect the live bucket, fetch existing lifecycle rules, check Object Lock, test IAM permissions, or apply the policy to AWS.

• Generated expiration actions can delete production data after the policy is applied outside this page.
• Storage prices, retrieval timing, minimum durations, and AWS service rules can change, so review current AWS documentation before rollout.
• Bucket names, rule IDs, tags, account IDs, and regions typed into the form are reflected in generated text and downloads; avoid adding secrets or private operational notes to review comments.
• Local checks catch common timing and formatting mistakes, but they are not a substitute for deployment review, change control, or account-specific policy checks.

Worked Examples:

FAQ:

Glossary:

Lifecycle rule

An S3 configuration entry that matches objects and applies transition, expiration, noncurrent version, delete-marker, or multipart cleanup actions.

Filter

The rule scope, such as a prefix, tag set, object-size range, or combination of those predicates.

Noncurrent version

An older object version that stopped being current after a newer version or delete marker was created.

Transition

A lifecycle action that moves matching objects or versions to another S3 storage class.

Expiration

A lifecycle action that deletes current objects, old noncurrent versions, or expired delete markers when the rule conditions are met.

Directory bucket

An S3 Express One Zone bucket type with narrower lifecycle action support than a general purpose bucket.

Multipart cleanup

An action that aborts incomplete multipart uploads and removes stale uploaded parts after the configured initiation age.

References:

• Lifecycle configuration elements, Amazon S3 User Guide.
• Lifecycle transition constraints and considerations, Amazon S3 User Guide.
• put-bucket-lifecycle-configuration, AWS CLI Command Reference.
• How to set the default Region in AWS CLI, Simplified Guide.
• How to configure AWS CLI on Linux and macOS, Simplified Guide.