TL;DR: Glacier Select runs SQL against data while it's still archived — AWS filters inside Glacier and returns only matching rows, so a quarterly audit pull no longer means restoring a 100 GB archive to fish out 2 GB of records. The catch that bites everyone: it only works if you archived queryable formats (CSV, JSON Lines, Parquet; server-side encryption only) — a decision you make before archiving, not after.
The numbers
Querying 2 GB of records out of a 100 GB archive:
| Path | Cost |
|---|---|
| Full restore + temp Standard storage + query | ~$1.00 restore + ~$2.30/mo temp storage + egress |
| Glacier Select (scan + return) | ~$0.43 |
Retrieval tiers still apply to Select jobs: expedited 1–5 min, standard 3–5 h, bulk 5–12 h (cheapest — right for non-urgent audits). Field example: a fintech's quarterly audit pulls dropped ~90% in retrieval cost when "restore the whole month" became one WHERE customer_id = … query.
Do this
-
Design archives to be queryable before you archive — this is 80% of the value:
- Plain CSV, JSON Lines, or Parquet (Parquet best: size + queryability)
- Whole-object GZIP at most; never per-record compression or ZIP bundles
- Server-side encryption only — client-side encryption blocks Select forever
-
For an existing queryable archive, query instead of restoring:
aws s3api select-object-content --bucket archive-bucket \ --key logs/2025-11.jsonl.gz \ --expression "SELECT * FROM s3object[*] s WHERE s.customer_id = '12345'" \ --expression-type SQL \ --input-serialization '{"JSON":{"Type":"LINES"},"CompressionType":"GZIP"}' \ --output-serialization '{"JSON":{}}' out.jsonPick the bulk tier for anything plannable — audit and forensics requests rarely need the expedited premium.
-
Keep an index of what's archived where (S3 Inventory) so incident-response can target the right three days of logs instead of scanning a year.
Gotchas
- The #1 failure is format, discovered too late: ZIPped bundles, per-record compression, client-side encryption, or multi-line JSON archived years ago mean falling back to full restores anyway. Fix the pipeline now, not at audit time.
- SQL is the same subset as S3 Select: filters, projections, simple aggregates — no JOINs, one object at a time.
- Scan fees scale with archive size, not result size. Unselective queries on huge archives erode the win — selectivity is the whole point.
- Latency is still Glacier latency. Even expedited is minutes; this is not an interactive query engine.
Skip this if
- You need most of the archive anyway — a plain restore is simpler and comparable in cost.
- You query the same archive repeatedly — that data doesn't belong in Glacier at all; move it to Glacier Instant Retrieval or Intelligent-Tiering.
- The data is unstructured (images, video, binaries) — nothing for SQL to parse.