Study guide
6.3 Storage Versioning, Replication & Immutability
AWS Certified CloudOps Engineer – Associate SOA-C03
Track your progress as you read
Finished sections get a check mark.
1 Chapter 1: Monitoring & Observability Infrastructure
1.1 Configuring Workload Observability 1.2 CloudWatch Agent Architecture & Deployment 1.3 Metric Alarms, Anomaly Detection & Composite Alarms
2 Chapter 2: Alarms, Dashboards & Event-Driven Remediation
2.1 CloudWatch Dashboards & Multi-Account Visibility 2.2 Notification Architecture & Alarm Invocation 2.3 Amazon EventBridge Rules, Event Buses & Troubleshooting 2.4 Automated Remediation with Systems Manager & Lambda
3 Chapter 3: Performance Optimization for Compute, Storage & Databases
3.1 EC2 & Compute Performance Optimization 3.2 Amazon EBS Performance Metrics & Volume Tuning 3.3 S3 Performance Strategies & Data Transfer 3.4 Shared Storage (EFS/FSx) & Database Performance
4 Chapter 4: Compute & Database Scalability and Elasticity
4.1 EC2 Auto Scaling Policies & Elasticity 4.2 Auto Scaling Advanced Operations: Warm Pools & Lifecycle Hooks 4.3 Dynamic Scalability Through Caching 4.4 Managed Database Scaling: RDS, Aurora & DynamoDB
5 Chapter 5: High Availability, Fault Tolerance & Load Balancing
5.1 Elastic Load Balancing (ALB/NLB) Configuration & Troubleshooting 5.2 Route 53 Health Checks & DNS Failover 5.3 Multi-AZ Architecture & Fault-Tolerant Deployments
6 Chapter 6: Backup, Data Protection & Disaster Recovery
6.1 Centralized Backup Automation & AWS Backup 6.2 Database Restore Strategies & RTO/RPO Management 6.3 Storage Versioning, Replication & Immutability 6.4 Disaster Recovery Patterns & Multi-Region Resilience
7 Chapter 7: Infrastructure as Code with CloudFormation & AWS CDK
7.1 CloudFormation Foundations & Resource Modeling 7.2 Managing Stacks, Drift Detection & Change Sets 7.3 Infrastructure as Code with AWS CDK 7.4 Identifying & Remediating Deployment Failures
8 Chapter 8: Multi-Account Provisioning, Containers & Third-Party IaC
8.1 Golden Images with EC2 Image Builder & Amazon ECR 8.2 Multi-Account & Multi-Region Resource Sharing 8.3 Deployment Strategies & Container Deployments 8.4 Third-Party Automation with Terraform & Git Workflows
9 Chapter 9: Systems Manager & Event-Driven Operations Automation
9.1 AWS Systems Manager Core Management & Run Command 9.2 Systems Manager Patch Manager & Session Manager 9.3 Event-Driven Operations Automation
10 Chapter 10: Identity, Access Management & Governance
10.1 Advanced IAM Policies, Roles & Policy Conditions 10.2 Auditing Access with CloudTrail Lake & IAM Access Analyzer 10.3 Multi-Account Security: Organizations, SCPs & Identity Center 10.4 Compliance Enforcement with AWS Config & Conformance Packs
11 Chapter 11: Data Security, Encryption & Vulnerability Management
11.1 Data Classification & Amazon S3 Security 11.2 Encryption at Rest with AWS Key Management Service (KMS) 11.3 Encryption in Transit with AWS Certificate Manager (ACM) 11.4 Secrets Management & Centralized Security Findings
12 Chapter 12: VPC Architecture, Endpoints & Network Protection
12.1 VPC Core Architecture, Subnetting & High Availability NAT 12.2 Private Network Connectivity: VPC Endpoints & Peering 12.3 Network Protection & Edge Security Auditing
13 Chapter 13: DNS, Route 53 Routing & Content Delivery
13.1 DNS Architecture & Route 53 Resolver for Hybrid Clouds 13.2 Route 53 Advanced Routing Policies & Query Logging 13.3 Global Content & Service Distribution: CloudFront & Global Accelerator
14 Chapter 14: Network Troubleshooting, Traffic Analysis & Hybrid Connectivity
14.1 VPC Configuration Troubleshooting & Analysis Tools 14.2 Network Traffic Analysis: VPC Flow Logs & Log Analytics 14.3 CloudFront Caching & Hybrid Connectivity Troubleshooting
6.3 Storage Versioning, Replication & Immutability
Key Takeaways Explain This Topic AI
Amazon S3 Versioning preserves multiple variants of an object in the same bucket, distinguishing current versions from noncurrent versions and utilizing delete markers for reversible soft deletes.
Permanent object deletion requires specifying both the key and the exact versionId, and MFA Delete enforces hardware or virtual root MFA for version deletions or versioning status changes.
S3 Object Lock enforces WORM compliance in Governance mode (allows override with s3:BypassGovernanceRetention) or Compliance mode (irrevocable lock preventing deletion by any user including root), accompanied by indefinite Legal Holds.
S3 Cross-Region Replication (CRR) and Same-Region Replication (SRR) require versioning on both buckets and explicit KMS permissions; Replication Time Control (RTC) provides an SLA-backed 15-minute replication window, while S3 Batch Operations replicates pre-existing objects.
Amazon FSx for Windows File Server provides automated daily S3 backups alongside native Volume Shadow Copies (VSS) for self-service end-user file restoration.
Last updated: September 2026
6.3 Storage Versioning, Replication & Immutability
CloudOps Blueprint Focus: Object and file storage resiliency forms the foundation of cloud operational durability. For the AWS Certified CloudOps Engineer – Associate (SOA-C03) exam, you must understand Amazon S3 Versioning mechanics, delete marker operations, MFA Delete enforcement, S3 Object Lock WORM retention modes and Legal Holds, Cross-Region and Same-Region Replication (CRR/SRR) prerequisites, Replication Time Control (RTC), S3 Batch Replication, and Amazon FSx automated backups and Windows Shadow Copies.
Amazon S3 Versioning: Mechanics & Lifecycle Operations
Amazon S3 Versioning protects data against accidental user overwrites, application logic bugs, and malicious modifications by preserving multiple variants of an object within the same bucket. Once enabled on a bucket, versioning cannot be disabled; it can only be suspended .
Versioning States & Delete Marker Mechanics
Every write operation ( PutObject , CopyObject ) to a version-enabled bucket generates a unique, opaque Version ID (e.g., 3/L4kqtJlcpXroDTDmJ+rmSpXd3dIbrHY ). S3 maintains two categories of object versions:
Current Version: The latest revision of the object retrieved by default GetObject API requests.
Noncurrent Version: Historical revisions retained in the bucket as newer revisions are written.
Understanding S3 deletion behavior is critical for operational troubleshooting:
Soft Delete: A DeleteObject request without a versionId inserts a zero-byte Delete Marker as the Current Version . Subsequent GetObject calls return 404 Not Found , while past versions remain intact.
Reversing Deletion: Deleting the Delete Marker by its specific version ID restores the previous version as current.
Permanent Deletion: Permanently removing data requires specifying both the key and the exact versionId ( DeleteObject(Key, VersionId) ).
S3 Lifecycle Rules with Versioning
Retaining unlimited historical versions inflates storage costs. CloudOps engineers deploy S3 Lifecycle Rules configured with version-specific actions:
NoncurrentVersionTransitions : Shifts noncurrent versions to lower-cost tiers (such as S3 Standard-Infrequent Access after 30 days and S3 Glacier Flexible Retrieval after 90 days).
NoncurrentVersionExpiration : Permanently purges noncurrent versions after a defined number of days, or retains only a specified count of recent versions using NewerNoncurrentVersions .
ExpiredObjectDeleteMarker : Automatically cleans up expired delete markers that no longer have underlying historical versions, reducing bucket listing overhead.
MFA Delete: Hardware Protection Against Rogue Operations
To guard against compromised credentials or script errors that could permanently purge versioned buckets, AWS provides MFA Delete .
When MFA Delete is activated on a bucket, AWS enforces multi-factor authentication (MFA) verification for two specific operational actions:
Changing the versioning state of the bucket (e.g., suspending versioning).
Permanently deleting an object version (issuing a DeleteObject specifying a versionId ).
MFA Delete carries strict operational constraints: it cannot be enabled or configured via the AWS Management Console; it must be configured using the AWS CLI or REST API. Furthermore, it requires AWS Account Root User credentials accompanied by a valid TOTP code from a physical hardware token or virtual MFA device ( --mfa "arn:aws:iam::123456789012:root 123456" ). Standard IAM users and assumed roles cannot authorize MFA Delete actions.
S3 Object Lock: WORM Compliance & Legal Holds
Amazon S3 Object Lock provides Write-Once-Read-Many (WORM) storage compliance to prevent objects from being deleted or overwritten for a fixed retention period or indefinitely. Object Lock requires that S3 Versioning be enabled at bucket creation time.
Object Lock provides two distinct retention modes alongside legal hold flags:
Lock Mechanism Override Capability IAM Permission Typical Use Case
Governance Mode Yes, by authorized principals. s3:BypassGovernanceRetention Guarding against accidental deletion while allowing compliance admin overrides.
Compliance Mode No. Irrevocable. None. Regulatory mandates (SEC 17a-4) and anti-ransomware protection; cannot be bypassed.
Legal Hold Yes, toggleable. s3:PutObjectLegalHold Ongoing legal investigations and audits; independent of retention dates.
In Compliance Mode , no user—including the root account—can overwrite, delete, or shorten the retention period of an object version until its retention timer expires.
A Legal Hold operates independently of retention periods. It places an explicit lock flag on an object version that prevents deletion until an authorized user with s3:PutObjectLegalHold explicitly removes it.
S3 Replication Architecture: SRR, CRR, RTC & Batch Operations
Amazon S3 supports automated asynchronous replication between buckets:
Same-Region Replication (SRR): Replicates objects across buckets within the same AWS Region for log aggregation or cross-account data isolation.
Cross-Region Replication (CRR): Replicates objects across distinct geographical AWS Regions to fulfill disaster recovery and data locality requirements.
Technical Prerequisites for S3 Replication
Establishing CRR or SRR requires three prerequisites:
Versioning Enabled: S3 Versioning must be active on both source and destination buckets.
IAM Replication Role: An IAM service role granting S3 permissions to read from source ( s3:GetObjectVersionForReplication ) and write to destination ( s3:ReplicateObject ).
KMS Permissions for Encrypted Objects: Replicating SSE-KMS objects requires enabling KMS replication in the rule and granting the IAM role decryption rights on the source key ( kms:Decrypt ) and encryption rights on the destination key ( kms:GenerateDataKey , kms:Encrypt ).
Replication Time Control (RTC) & Batch Replication
S3 Replication Time Control (RTC): Guarantees 99.9% of new objects replicate within 15 minutes backed by an SLA, publishing CloudWatch metrics ( ReplicationLatency , BytesPendingReplication ).
S3 Batch Replication: Replicates pre-existing objects uploaded prior to replication rule creation, or retries failed objects via S3 Batch Operations.
Amazon FSx Data Protection: Automated Backups & Shadow Copies
Amazon FSx for Windows File Server provides two complementary recovery mechanisms:
Automated Daily Backups: File-system-consistent incremental backups stored in Amazon S3, retained for 1 to 90 days, surviving file system deletion.
Volume Shadow Copies (VSS): Windows-native point-in-time snapshots scheduled via PowerShell, enabling users to restore previous file revisions directly within Windows File Explorer without IT tickets.