OCI Object Storage lifecycle rules, versioning and retention: a practical setup

#The service needs permission first

Lifecycle policies run as the Object Storage service. Without this policy, creating the lifecycle policy fails:

Allow service objectstorage-ap-mumbai-1 to manage object-family in compartment Data

Use the service name for your region (objectstorage-<region-identifier>).

#Write the rules

rules.json:

{
  "items": [
    {
      "name": "logs-to-ia-after-30d",
      "action": "INFREQUENT_ACCESS",
      "timeAmount": 30, "timeUnit": "DAYS", "isEnabled": true,
      "target": "objects",
      "objectNameFilter": { "inclusionPrefixes": ["logs/"] }
    },
    {
      "name": "logs-archive-after-90d",
      "action": "ARCHIVE",
      "timeAmount": 90, "timeUnit": "DAYS", "isEnabled": true,
      "target": "objects",
      "objectNameFilter": { "inclusionPrefixes": ["logs/"] }
    },
    {
      "name": "delete-tmp-after-7d",
      "action": "DELETE",
      "timeAmount": 7, "timeUnit": "DAYS", "isEnabled": true,
      "target": "objects",
      "objectNameFilter": { "inclusionPrefixes": ["tmp/"] }
    },
    {
      "name": "abort-stale-multipart",
      "action": "ABORT",
      "timeAmount": 3, "timeUnit": "DAYS", "isEnabled": true,
      "target": "multipart-uploads"
    }
  ]
}

oci os object-lifecycle-policy put -bn app-data --items file://rules.json --force
oci os object-lifecycle-policy get -bn app-data

Warning

put replaces the whole policy. Always include every rule you want to keep.

#Tier trade-offs

Restoring an archived object:

oci os object restore -bn app-data --name logs/2025/01/app.log.gz --hours 24

Check the current minimum retention periods and fees in Oracle's pricing pages before you move large data sets.

#Protect against deletion and ransomware

oci os bucket update -bn app-data --versioning Enabled

• With versioning, overwritten and deleted objects keep previous versions. Add lifecycle rules with "target": "previous-object-versions" so old versions don't grow forever.
• Retention rules (time-bound or indefinite) make objects immutable, even for administrators, once the rule is locked. Use them for compliance data such as audit logs and backups.

#Verify it works

Lifecycle runs asynchronously. Check a day later:

oci os object list -bn app-data --prefix logs/ --fields name,storageTier,timeCreated --limit 20

Tip

Turn on Object Storage write/read service logs for buckets that hold customer data. When someone asks "who deleted this file?", that's where the answer is.