S3 Intelligent Tiering

S3 Intelligent Tiering Automation

The S3 Intelligent Tiering automation is a Cadence automation that automatically applies an AWS S3 Intelligent-Tiering lifecycle policy to your S3 buckets. Rather than analyzing access patterns and making recommendations, it directly configures buckets so that AWS handles tiering automatically going forward.

How It Works

graph LR
    A[Weekly Trigger] --> B[Scan All Accounts]
    B --> C[List S3 Buckets]
    C --> D[Check Eligibility]
    D --> E[Apply Lifecycle Policy]
    E --> F[Generate Report]
  1. Scan - For each configured AWS account, lists all S3 buckets
  2. Check eligibility - Skips buckets that already have a lifecycle policy or have opted out via tag
  3. Apply policy - Puts an S3 Intelligent-Tiering lifecycle rule on eligible buckets
  4. Report - Records which buckets were updated and any failures

Once the lifecycle policy is applied, AWS automatically moves objects between storage tiers based on access patterns — no further SkySaver involvement is needed.

What Gets Applied

The automation applies two configurations to each eligible bucket:

Lifecycle rule (SkySaver-S3-Intelligent-Tiering):

  • Transitions all objects (current and noncurrent versions) to the INTELLIGENT_TIERING storage class immediately on upload (0-day transition)
  • Applies to all objects in the bucket with no prefix filter

Intelligent Tiering configuration (SkySaver-Archive-Instant-Access):

  • After 90 days without access, objects move to the Archive Instant Access tier
  • Objects remain retrievable in milliseconds — no restore delay like Glacier

Schedule

The automation runs weekly, every Sunday at 6 AM UTC. Each run scans all accounts and applies the policy to any newly created buckets that are eligible.

Eligibility

A bucket is processed only if both conditions are met:

ConditionDetail
No existing lifecycle policyBuckets with any lifecycle rules already configured are skipped to avoid conflicts
No opt-out tagBuckets tagged SkySaverIgnore = S3IntelligentTiering are skipped

Opting Out a Bucket

To exclude a specific bucket from this automation, add the following tag to it in AWS:

  • Key: SkySaverIgnore
  • Value: S3IntelligentTiering

Prerequisites

The SkySaver IAM role in each target account needs these S3 permissions:

  • s3:ListAllMyBuckets
  • s3:GetBucketLocation
  • s3:GetLifecycleConfiguration
  • s3:PutLifecycleConfiguration
  • s3:GetBucketTagging
  • s3:PutIntelligentTieringConfiguration

See AWS Account Setup for the full CloudFormation role setup.

Enabling the Automation

  1. Navigate to Automations
  2. Find Apply S3 Intelligent Tiering
  3. Toggle Available for Project to enable it
  4. Use Enable for All to turn it on across all connected accounts, or manage per-account from Tenant Management > Accounts

Viewing Results

After the automation runs:

  1. Navigate to Automation Reports
  2. Filter by S3 Intelligent Tiering
  3. The report shows one row per bucket with:
    • Account ID and bucket name
    • Region
    • Whether the policy was applied successfully
    • Any error details for failures

Cost Considerations

Cost TypeDetail
S3 Intelligent-Tiering monitoring fee$0.0025 per 1,000 objects/month (AWS charge, applies to all objects in tiered buckets)
Storage savingsVaries by access patterns — infrequently accessed data moves to lower-cost tiers automatically
No retrieval feesArchive Instant Access tier has no retrieval fee, unlike Glacier
128KB minimum

AWS does not charge the Intelligent-Tiering monitoring fee for objects smaller than 128KB, and those objects are not moved between tiers. The automation still applies the lifecycle policy to the bucket — smaller objects simply remain in Standard storage at no monitoring cost.

Troubleshooting

IssueLikely CauseSolution
Bucket not processedBucket already has a lifecycle policyRemove the existing policy if you want SkySaver to manage it
Bucket not processedOpt-out tag presentRemove the SkySaverIgnore tag if you want the bucket included
Configuration failedMissing IAM permissionsVerify S3 permissions in the SkySaver IAM role
Automation not runningNot enabled for accountCheck account-level toggle in Tenant Management