{{ summaryHeading }}
{{ summaryValue }}

{{ summaryLine }}

{{ values.output_label }} {{ warningBadge }} {{ values.transition_count }} transitions
Start with a safe example, then narrow the bucket scope and confirm every age threshold.
The result ledger and chart stay identical across output formats.
The shipped sample uses an AWS documentation bucket name and never contacts AWS.
A companion -multipart-cleanup ID is created only when tag filters require a separate rule.
Unsupported actions are omitted with explicit review warnings in directory-bucket mode.
Choose Disabled when the artifact should be staged for review before activation.
Use a trailing slash for folder-like prefixes such as logs/app/.
Example: 30,STANDARD_IA,move infrequent logs.
Keep expiration later than the final current-object transition.
days
Noncurrent action ages are configured in Advanced.
Abort incomplete multipart uploads after the entered number of days from initiation. Use 0 to omit multipart cleanup.
days
Leave blank for no tag filter. Directory buckets omit tag filters.
Use 0 to omit an explicit minimum-size filter.
KiB
Use 0 for no upper bound; otherwise it must exceed the minimum.
KiB
Ignored unless the visible versioning posture includes noncurrent versions.
days
The class matters only when noncurrent transition age is greater than 0.
Keep this later than the noncurrent transition age.
days
Use 0 to omit the retained-version threshold.
versions
Emitted only without current expiration, tag filters, or directory-bucket mode.
{{ expired_object_delete_marker ? 'Enabled' : 'Disabled' }}
Leave blank to use the deployment environment's normal identity controls.
Leave blank to let the AWS CLI use its configured Region.
Use a letter-led alphanumeric logical ID.
Use a Terraform-local identifier containing letters, digits, or underscores.
The neutral default shows up to 80 rows.
rows
Adds a short generated-file caution to XML, Terraform, and AWS CLI output.
{{ include_review_comments ? 'Enabled' : 'Disabled' }} 
{{ values.policy_text }}
RuleStageActionEligibilityStorage classScopeCopy
{{ row[0] }}{{ row[1] }}{{ row[2] }}{{ row[3] }}{{ row[4] }}{{ row[5] }}
LevelCheckDetailRecommendationCopy
{{ row[0] }}{{ row[1] }}{{ row[2] }}{{ row[3] }}
S3 Bucket Policy Public Access Checker Review an S3 bucket policy for public or cross-account grants, test trust boundaries, and prepare the live AWS checks needed before approval.
Object Storage Cost Calculator Estimate monthly object storage cost from capacity and request volume with retrieval, egress, lifecycle and editable provider rate assumptions.
Terraform Plan Summary Analyzer Analyze Terraform plan JSON or text before apply, flag destructive changes and drift, and rank resources by review risk without uploading plan data.
IAM Policy Permissions Analyzer Review AWS IAM policy JSON for wildcard breadth, privilege paths, and policy-shape issues before validating effective access in AWS.

Amazon S3 Lifecycle rules automate what happens to objects as they age. A rule can move eligible objects to another storage class, expire current objects, manage noncurrent versions, remove expired delete markers, or abort incomplete multipart uploads. These actions reduce manual maintenance, but expiration and version cleanup can also remove the only recoverable copy of data.

Eligibility begins with a filter. A prefix limits the rule to object keys that begin with specific text; tags select objects carrying exact key-value pairs; size boundaries select objects within a byte range. When several filter types appear together, Amazon S3 combines them with logical AND, so an object must satisfy every condition.

Action Applies to Main consequence
Transition Current or noncurrent objects Changes storage class after an age threshold
Expiration Current objects or noncurrent versions Removes eligible data after the configured age
Delete-marker cleanup Expired object delete markers Removes a marker only when no noncurrent versions remain
Multipart cleanup Incomplete uploads Aborts uploads that never completed

Storage class timing affects both validity and cost. Standard-IA and One Zone-IA transitions cannot be scheduled before day 30. Glacier classes have minimum storage-duration charges, so moving or deleting an object too soon can incur charges for the remaining minimum period. Since September 2024, new or modified lifecycle configurations also prevent objects smaller than 128 KiB from transitioning by default unless an explicit size filter changes that behavior.

Versioned buckets need separate current and noncurrent policies. Expiring the current object normally creates a delete marker, while noncurrent expiration removes older versions that might otherwise support rollback. Keeping a number of newer noncurrent versions changes when the age-based action becomes eligible and should be matched to the recovery plan.

A lifecycle update is a bucket-level configuration change. Applying a new configuration replaces the existing lifecycle rule set rather than merging one new rule into it. Safe deployment therefore starts by reading the live configuration, reconciling every existing rule, and confirming Object Lock, legal holds, backups, restore procedures, and data-owner approval.

How to Use This Tool:

Start from the bucket's retention and recovery requirements, then narrow the object scope before adding any destructive action.

  1. Choose a Lifecycle preset and the Bucket type, then enter the real bucket name and a unique rule ID. Use Disabled status when the artifact should remain staged for review.
  2. Define the scope with an object key prefix, tags, and optional minimum or maximum object size. An empty filter applies to the whole bucket and receives a warning.
  3. Add current-object transitions in day, storage class, and optional note order. Set expiration later than the final transition and configure multipart cleanup separately from ordinary object expiration.
  4. For a versioned general-purpose bucket, add noncurrent transition or expiration ages and the number of newer noncurrent versions to retain.
  5. Read Validation review and the action timeline, compare the complete generated rule set with the live bucket configuration, then validate the selected JSON, XML, CloudFormation, Terraform, or AWS CLI artifact in the target toolchain.

Interpreting Results:

The action timeline shows eligibility ages, not guaranteed completion timestamps. Amazon S3 evaluates lifecycle actions asynchronously, so the physical transition or deletion may occur after the configured day.

  • Scope summary states which prefix, tags, and size limits must all match. Whole-bucket scope deserves deliberate confirmation.
  • Warning rows identify destructive expiration, disabled rules, directory-bucket omissions, small-object transition behavior, or timing that may incur minimum-duration charges.
  • Artifact parity means every output format was projected from the same rule model. It does not prove that the target bucket, provider version, IAM identity, Region, or account state accepts the artifact.

Technical Details:

An S3 lifecycle configuration contains up to 1,000 rules. Each rule has an ID, Enabled or Disabled status, one filter, and at least one lifecycle action. Prefix, tag, and object-size predicates inside a combined filter are conjunctive: every predicate must match the same object.

Rule Core:

Subject Required rule Result when unmet
Current transitions Days are strictly increasing; Standard-IA and One Zone-IA start at day 30; the next transition respects the prior class's minimum storage period Generation stops
Current expiration Expiration day is later than the final current transition Generation stops; early minimum-duration timing can still produce a cost warning
Noncurrent actions Bucket versioning posture is enabled and noncurrent expiration is later than noncurrent transition Unsupported or reversed timing is rejected
Directory buckets Current expiration and multipart cleanup remain available; tag filters, transitions, noncurrent actions, and delete-marker cleanup are omitted Each omitted requested feature produces a warning
Tag-filtered multipart cleanup Abort incomplete multipart uploads cannot share a tag filter A companion rule is emitted without the tags while retaining prefix and size scope
Action floor At least one transition, expiration, noncurrent action, delete-marker action, or multipart cleanup action An empty policy is rejected

Transition inputs are sorted by day before validation. The supported targets are Standard-IA, One Zone-IA, Intelligent-Tiering, Glacier Instant Retrieval, Glacier Flexible Retrieval, and Glacier Deep Archive. Minimum storage review periods are 30 days for the infrequent-access classes, 90 days for Glacier Instant Retrieval and Glacier Flexible Retrieval, and 180 days for Deep Archive.

Formula Core:

AWS object-size filters use strict greater-than and less-than comparisons in bytes. The visible size fields use inclusive KiB endpoints, so the generated byte boundaries are shifted by one byte.

Bmin = ( Kmin × 1024 ) − 1 Bmax = ( Kmax × 1024 ) + 1

Kmin and Kmax are the entered inclusive size limits in KiB. The policy tests object bytes as greater than Bmin and less than Bmax. For a 128 KiB minimum, the emitted lower boundary is 131,071 bytes, so an object of exactly 131,072 bytes is included.

Transformation Core:

Validated inputs first form one canonical lifecycle configuration. The selected output is then serialized from that same rule set as AWS lifecycle JSON, lifecycle XML, CloudFormation JSON, Terraform HCL, or AWS CLI commands. Changing the output format does not change the filter, action ages, rule status, or warning model.

When tags require a separate multipart-cleanup rule, the companion ID adds -multipart-cleanup and preserves the non-tag filter predicates. The main rule retains the tag filter for object transitions or expiration. This split is visible in the rule count and action ledger.

Limitations:

Policy generation happens in the browser and does not contact AWS. It cannot read the current lifecycle configuration, bucket versioning state, Object Lock, legal holds, replication status, object distribution, storage costs, IAM permissions, or restore readiness.

  • PutBucketLifecycleConfiguration replaces the current lifecycle configuration. Fetch and merge existing rules before applying a generated artifact.
  • Expiration and noncurrent expiration are destructive. Test the policy on representative non-production data and verify recovery before enabling it.
  • Minimum storage duration, request, retrieval, and early deletion charges depend on the real object population and current AWS pricing.
  • Directory-bucket support differs from general-purpose buckets; review every omission warning rather than assuming feature parity.

Worked Examples:

Log archive with one-year retention

A rule scoped to logs/app/ can transition current objects to Standard-IA on day 30, then Glacier Instant Retrieval on day 90, and expire them on day 365. The days are strictly increasing, but the final retention decision still needs cost and recovery review because expiration permanently removes eligible current data in a nonversioned bucket.

Tagged objects with multipart cleanup

If the main rule filters on environment=production and aborts incomplete uploads after seven days, two rules are produced. The object lifecycle rule keeps the tag filter; the companion multipart rule drops the tag predicate because AWS does not allow that action with tag filters. Its prefix and size boundaries remain aligned with the main scope.

References: