cloud-retention-config

Cloud Storage Retention Configuration

Overview

Cloud storage platforms provide native retention and lifecycle management features that can enforce data retention schedules at the infrastructure level. Proper configuration ensures that personal data stored in cloud environments is automatically transitioned, archived, or deleted according to retention policies, while legal hold and object lock features prevent premature deletion of data subject to regulatory or litigation requirements. This skill covers configuration for the three major cloud platforms: AWS S3, Microsoft Azure Blob Storage, and Google Cloud Storage.

Legal Context

GDPR Article 5(1)(e) — Storage Limitation

Cloud storage retention policies are a technical implementation of the storage limitation principle, ensuring data is not retained beyond the period necessary for processing purposes.

GDPR Article 32 — Security of Processing

Retention configuration must include appropriate security measures, including encryption at rest, access controls, and audit logging for all retention-related operations.

GDPR Article 25 — Data Protection by Design and by Default

Cloud retention policies should be configured as default settings on all storage resources, rather than applied retroactively.

AWS S3 Lifecycle and Retention Configuration

S3 Lifecycle Rules

S3 Lifecycle rules automate transitions between storage classes and object expiration:

Lifecycle Rule Configuration for Orion Data Vault Corp

S3 Lifecycle Rule — JSON Configuration Example

{
  "Rules": [
    {
      "ID": "customer-data-lifecycle",
      "Filter": {
        "Prefix": "customer-data/"
      },
      "Status": "Enabled",
      "Transitions": [
        {
          "Days": 90,
          "StorageClass": "GLACIER_IR"
        },
        {
          "Days": 365,
          "StorageClass": "DEEP_ARCHIVE"
        }
      ],
      "Expiration": {
        "Days": 2190
      },
      "NoncurrentVersionTransitions": [
        {
          "NoncurrentDays": 30,
          "StorageClass": "GLACIER_IR"
        }
      ],
      "NoncurrentVersionExpiration": {
        "NoncurrentDays": 2190
      }
    }
  ]
}

S3 Object Lock

S3 Object Lock prevents objects from being deleted or overwritten for a fixed retention period or indefinitely. It operates in two modes:

Object Lock Configuration

{
  "ObjectLockConfiguration": {
    "ObjectLockEnabled": "Enabled",
    "Rule": {
      "DefaultRetention": {
        "Mode": "GOVERNANCE",
        "Days": 2190
      }
    }
  }
}

Critical consideration for GDPR erasure: If using Compliance Mode, data subject erasure requests under Art. 17 cannot be fulfilled until the retention period expires. Use Governance Mode for data categories where erasure requests are possible, and reserve Compliance Mode only for data with mandatory statutory retention that overrides the right to erasure under Art. 17(3)(b).

S3 Legal Hold

Legal hold is an independent, on/off flag that prevents object deletion regardless of retention settings:

aws s3api put-object-legal-hold \
  --bucket orion-data-vault-regulated \
  --key customer-data/2024/transaction-batch-0142.parquet \
  --legal-hold Status=ON

Legal hold must be:

• Applied immediately upon receipt of a litigation hold notice
• Tracked in the litigation hold management register (cross-reference: litigation-hold-mgmt skill)
• Removed only upon written authorization from Legal counsel
• Auditable — all legal hold changes logged via CloudTrail

Microsoft Azure Blob Storage Retention

Immutability Policies

Azure Blob Storage supports immutability policies at the container level:

Time-Based Retention Policy Configuration

{
  "properties": {
    "immutabilityPeriodSinceCreationInDays": 2190,
    "allowProtectedAppendWrites": true,
    "allowProtectedAppendWritesAll": false
  }
}

Azure Lifecycle Management Rules

{
  "rules": [
    {
      "enabled": true,
      "name": "customer-data-retention",
      "type": "Lifecycle",
      "definition": {
        "filters": {
          "blobTypes": ["blockBlob"],
          "prefixMatch": ["customer-data/"]
        },
        "actions": {
          "baseBlob": {
            "tierToCool": {
              "daysAfterModificationGreaterThan": 90
            },
            "tierToArchive": {
              "daysAfterModificationGreaterThan": 365
            },
            "delete": {
              "daysAfterModificationGreaterThan": 2190
            }
          },
          "snapshot": {
            "delete": {
              "daysAfterCreationGreaterThan": 2190
            }
          }
        }
      }
    },
    {
      "enabled": true,
      "name": "analytics-data-retention",
      "type": "Lifecycle",
      "definition": {
        "filters": {
          "blobTypes": ["blockBlob"],
          "prefixMatch": ["analytics/"]
        },
        "actions": {
          "baseBlob": {
            "tierToCool": {
              "daysAfterModificationGreaterThan": 90
            },
            "delete": {
              "daysAfterModificationGreaterThan": 790
            }
          }
        }
      }
    }
  ]
}

Azure Legal Hold

az storage container legal-hold set \
  --account-name oriondatavault \
  --container-name regulated-data \
  --tags "litigation-2026-001" "regulatory-investigation-2026-003"

Azure Versioning and Soft Delete Interaction

When configuring retention, account for Azure's soft delete and versioning features:

Google Cloud Storage Retention

Bucket-Level Retention Policy

GCP applies retention policies at the bucket level. Objects cannot be deleted or overwritten until the retention period expires:

{
  "retentionPolicy": {
    "retentionPeriod": "189216000",
    "isLocked": false
  }
}

The retentionPeriod is specified in seconds. Common values:

Locking a Retention Policy

gcloud storage buckets update gs://orion-regulated-finance \
  --lock-retention-policy

Warning: Locking a retention policy is IRREVERSIBLE. Once locked, the retention period cannot be reduced or removed. The bucket cannot be deleted until every object in it has met its retention period. Only lock policies for data categories with absolute statutory retention requirements that override Art. 17 rights.

GCP Object Hold

gcloud storage objects update gs://orion-regulated-data/customer-data/batch-0142.parquet \
  --temporary-hold

GCP Lifecycle Rules

{
  "lifecycle": {
    "rule": [
      {
        "action": {
          "type": "SetStorageClass",
          "storageClass": "NEARLINE"
        },
        "condition": {
          "age": 90,
          "matchesPrefix": ["customer-data/"]
        }
      },
      {
        "action": {
          "type": "SetStorageClass",
          "storageClass": "ARCHIVE"
        },
        "condition": {
          "age": 365,
          "matchesPrefix": ["customer-data/"]
        }
      },
      {
        "action": {
          "type": "Delete"
        },
        "condition": {
          "age": 2190,
          "matchesPrefix": ["customer-data/"]
        }
      }
    ]
  }
}

Cross-Region Replication Retention Alignment

When data is replicated across regions for availability or disaster recovery, retention policies must be aligned:

Alignment Requirements

1. Identical retention periods: Replicated data in the destination region must have the same retention period as the source.
2. Synchronized lifecycle rules: Lifecycle transitions and expirations must be configured identically on source and destination buckets/containers.
3. Legal hold propagation: Legal holds applied in the source must also be applied in the destination. Configure automated propagation.
4. Deletion propagation: When an object expires or is deleted in the source, the replica must also be deleted. Configure replication to handle delete markers.
5. Jurisdictional considerations: If the destination region is in a different jurisdiction, confirm that the applicable retention requirements in that jurisdiction do not conflict with the source retention period.

Cross-Region Configuration Checklist

Compliance Monitoring

Monthly Cloud Retention Audit

1. Policy drift detection: Compare active lifecycle rules and retention policies against the approved retention schedule. Flag any discrepancies.
2. Coverage verification: Confirm that all storage buckets/containers holding personal data have applicable retention policies.
3. Legal hold inventory: List all active legal holds across all cloud platforms. Cross-reference with the litigation hold register to identify holds that should have been released.
4. Expiration verification: Sample recently expired objects to confirm they were actually deleted (not just transitioned or soft-deleted).
5. Cross-region consistency: Verify that replicated buckets/containers maintain identical retention configuration.

Alert Configuration