-: So, let's have a play with vault locks
by going into the Glacier Console.
And, in there, I'm able to go ahead and create a vault.
So, as you can see, Glacier is used
for creating vaults, setting data ritual policies,
and sending event notifications.
So lets create a vault, and I'm going to create
in my region close to me,
I'll collect my demo vault,
click on next step,
and here, we can set up notifications
in case some jobs complete.
So, basically, when a retrieval job is completed,
we can receive an SMS notification.
I will not enable it right now.
We'll set it later.
And then, review, everything looks good.
I'll submit it.
And here is my first Glacier vault.
So, basically I have just an, it's like a bucket,
but it's called a vault in Glacier.
And so, if I click on this vault,
I can get some information.
I can get some information around the details of this vault,
the notification that I set if I wanted to get information,
the permissions, so we can set
a vault access policy document, I just mentioned,
to basically say who can do what on this vault.
Just like a S3 bucket policy, really.
And then a vault lock.
And the vault lock basically allows you to create,
edit, and view details, and to create your lock policy.
So, this lock policy gives you compliance.
So if you create a lock policy,
and we can click here to see how to write a lock policy,
we could set a specific kind of lock policy.
For example, this one is to deny delete permissions
for archives less that 365 days old.
Or the second one would be to deny permission
based on the tag.
So, we have lots of different ways to do locks,
but the idea is that using locks,
you're able to get strong requirements on
how your data is going to be in Glacier.
The thing to know is that once you set a lock,
you cannot change it.
So, I will initiate vault lock, which says that
I need to match my ARN, obviously.
So, lets go to Glacier and find my ARN.
So, here's my lock and here's my ARN.
I'm going to copy this right here.
So once I set my vault policy lock,
then it will not be able to be changed ever.
So, I will click on initiate vault lock,
and here, I get a vault I.D.
So, I need to absolutely copy this.
You cannot lose this,
and it's saying we have 24 hours to validate this policy
and complete the lock process.
After which, the lock I.D. will expire
and your in progress policy will be deleted.
So, now I have 24 hours, basically,
to complete the lock process.
So, lets close this,
and so here I have the option to either
delete my vault lock, or I have 23 hours to complete it.
So, I want to complete it,
so I click on complete vault lock,
and I paste the lock I.D. I just got from before,
and if you didn't copy it, then you have to redo everything.
So, delete the vault lock and recreate it.
Then, I acknowledge the fact that
my vault lock, once it's configured,
I will not be able to change it ever.
It's irreversible.
That's why it's so strong from a regulatory perspective,
and I click on complete vault lock,
and here we go.
My vault lock policy is now locked.
And so, we'll never ever ever be able to
delete an archive that is less than 365 days, ever.
I cannot change this.
And so this is why vault lock policies are so important,
and you need to know them coming into the exam.
The last thing to know is that through this UI,
you're not able to upload files that relate to Glacier.
You will have to use the SDK, or the CLI,
or something like this.
I won't show you, but the idea is that
you don't get a full UI like you do for S3.
Here we have to use the API if wanting to upload file
into this demo vault.
So that's it for Glacier.
Just remember how we created a vault,
how we locked it, using some kind of lock policy,
and how you can set another lock policy here
for access to this vault,
and I will see you in the next lecture.