Archiving 900 TB of Retail Records with Immutability and No Public Endpoints
Harborlight Retail operates 1,100 stores and must keep seven years of point-of-sale and invoice records for tax authorities: about 900 TB, most of it older than 18 months, currently on tape in a Cincinnati data center behind a NAS front end. Only about 4 TB is touched in a typical month. A nightly 300 GB extract travels over the public internet to a reporting SaaS, and auditors have flagged both the transfer path and the absence of immutability guarantees. The company runs an IBM Cloud VPC in Dallas with application servers serving store managers through a public load balancer, and it wants the archive to stay in the United States. Customer-managed encryption keys are mandatory, records must be non-deletable for the retention period, and monthly retrieval of older records must finish within four hours. Network spend is the fastest-growing line item, and the security team will not approve any new public endpoints.
1. Design the storage layout and bucket policies for the 900 TB archive plus the 4 TB active set. Justify every class and control.
Read the worked answer
Separate the archive by access frequency and protect it by policy, not by convention.
Classes. Put the 4 TB active set in the standard class, because it is read repeatedly and retrieval fees or minimum-duration rules would bite. Move the 900 TB to a colder class: colder tiers lower the storage rate but introduce retrieval fees and minimum storage durations, which is acceptable here because only about 4 TB is read per month and the four-hour retrieval window is comfortably inside those tiers' restore behavior. Expect a small warm band for the 18-month-to-3-year tranche if queries against it are routine. Test with a month of real retrieval logs rather than guessing the split, and consolidate small files before transitioning them, since per-object request and transition charges can exceed the storage saving on tiny objects.
Immutability. Apply a bucket retention policy with a seven-year period and legal-hold support so records cannot be deleted or overwritten before expiry, even by an administrator. Combine it with versioning so an overwrite preserves the prior object. Document the exception path and the retention-shortening prohibition before go-live, because an over-broad lock can also block legitimate corrections.
Encryption. Customer-managed keys from a key management service, with the key ring per environment and key rotation defined. Note that destroying the root key makes the archive unreadable, which is a powerful control and a serious operational risk requiring dual control on key deletion.
2. The nightly extract and archive access must stop crossing the public internet. Design the connectivity and explain what actually changes on the bill.
Read the worked answer
The goal is private paths end to end, so every hop needs a decision.
On-premises to IBM Cloud. Terminate a dedicated or provider-hosted direct-link connection into a transit gateway, then attach the Dallas VPC through that gateway. That replaces internet transfer with a private circuit, removes exposure of on-premises source addresses, and gives a predictable latency profile for the nightly 300 GB window. Choose the dedicated option when the monthly volume justifies the port; choose the exchange-provider option when you need sub-10 Gbps and faster provisioning.
VPC to object storage. Use a private service endpoint for object storage in the VPC, so application servers reach buckets over the private network. Then remove public gateways and floating IPs from the archive and application subnets. Store-manager access should terminate at the public load balancer on a dedicated edge subnet, or at a web application firewall and global traffic-management service, so the application tier itself never holds a public address.
The bill. Direct-link carries a port charge plus per-GB transfer, which may exceed today's internet egress at low volume; the trade is security and predictable throughput, so compare at 9 TB a month, not at 300 GB. Private endpoint traffic removes public egress charges and often reduces the network line materially, while object storage operation counts still apply. Model both lines together and state the assumption explicitly, because a private circuit that is underused is a fixed cost, not a saving.
3. Auditors will ask what happens if a bucket is deleted or a region fails. What resilience and retention design answers them?
Read the worked answer
Answer with a durability story, a deletion story, and a test record.
Durability. Use cross-region resiliency for the archive buckets so objects are spread beyond a single metro. Define the RPO explicitly: with a 300 GB nightly load, a cross-region copy plus the source-of-truth tape gives an RPO measured in hours; if a tighter RPO is claimed, add replication or shorten the extract interval and prove it. Four-hour restore for cold objects should be validated with a real restore of a controlled sample, not inferred from documentation.
Deletion. Immutable retention plus versioning means an accidental or malicious delete creates a delete marker or is refused outright, and the retained version survives. Add a separate account or isolated bucket for audit logs, since an actor who can delete logs defeats the investigation. Grant bucket-delete permission to a break-glass identity only, with dual approval.
Evidence. Keep the retention configuration, key policies, restore test records, and access logs available for the audit cycle, and route management and data events to a retained destination. Review the retention policy annually against the seven-year legal requirement, because shortening a lock is not permitted and lengthening it carelessly creates permanent cost and legal exposure.