Glossary

Storage automation

Storage automation uses software, APIs and policies to provision, protect, move and expire storage without an administrator carrying out each step. It removes the variation of manual work. It also applies any error in a rule to everything the rule matches, at machine speed and often without anyone watching.

What gets automated first?

Requests that arrive often and follow a pattern. A ticket for 50 TB that once passed through several approvals and a console wizard becomes an API call that creates a bucket with a set protection class, quota and tags. Recurring jobs follow: moving aging data to cheaper media under storage tiering, expiring data at the end of retention under storage lifecycle management, rebuilding after a drive failure and raising alerts before a pool fills. Each of these was once a runbook step that depended on someone remembering it. API-driven object storage makes most of this straightforward to script.

Errors multiply with reach

A manual mistake touches one volume. A rule touches every object it matches. An expiry rule with the wrong prefix or the wrong age can remove millions of objects overnight with no confirmation prompt. A script running under an account with broad permissions fails across the whole environment at once, and a stolen automation credential gives an attacker the same reach.

Rolling out a storage rule

Teams that run automation at scale handle policies with the discipline used for application code:

  1. Write the rule down in version control, with its owner and purpose.
  2. Have a second person review it, especially any rule that deletes or shortens retention.
  3. Run it in report-only mode to list what it would change, and check the list.
  4. Apply it to a small scope first, such as one bucket or one tenant.
  5. Widen the scope in stages, watching the counts of objects moved or removed.
  6. Keep the automation account to the narrowest permissions the rule needs.

Copies no rule can touch

Some data is safer when its survival does not depend on every rule being right. An immutable backup held under S3 Object Lock in compliance mode cannot be deleted, or have its retention shortened, by any account or script before the retention date. A flawed rule or a compromised automation account then fails without destroying those copies. The same practices apply to infrastructure defined as code, described under cloud automation.