# Cost per terabyte: 2026 Rule 17a-4(f) S3 Object Lock vs Azure Immutable Blob, 7 years

Sara Hoffman · October 15, 2026

> Compare AWS S3 Object Lock vs Azure Immutable Blob Storage for 7-year SEC Rule 17a-4(f) retention, with full 2026 cost per terabyte pricing and compliance guidance.

This guide compares AWS S3 Object Lock and Azure Immutable Blob Storage for 7-year SEC Rule 17a-4(f) retention in 2026.

It shows how to price full cost per terabyte and choose the WORM platform that satisfies both cost and compliance requirements.

![This guide compares AWS S3 Object Lock and — Cost per terabyte](https://static.mm-ais.com/article-images-ai/cost-per-terabyte-2026-rule-17a-4-f-s3-o-ai-dc29379a.jpg)

## How S3 and Azure WORM Actually Lock Data

S3 Object Lock is applied per object version, not at the bucket level: each version carries its own retain-until date and one of two modes. Governance mode allows a privileged user with the special bypass permission to shorten or remove retention before expiry; compliance mode prevents anyone, including the root user, from shortening or removing the retention period until it expires. That distinction matters for SEC 17a-4(f) style WORM because compliance mode is the stricter of the two, while governance mode leaves an administrative escape hatch.

Azure Immutable Blob Storage, per Microsoft Learn's immutable storage overview, supports two policy types that can be set together: time-based retention policies and legal hold policies. A time-based policy lets objects be created and read but not modified or deleted until the interval expires; after expiry, objects can be deleted but not overwritten. A legal hold keeps data immutable until the hold is explicitly cleared, also allowing create and read while blocking modify and delete. Microsoft Learn notes that both can be set at the same level and at the same time.

The scope split is the part to check before pricing or auditing: Azure's overview describes container-level WORM, where policies are set at the container level only, and version-level WORM, where policies are set at the version level. Thus an Azure policy can govern every version in a container or only selected versions, while S3's Object Lock decision is made version by version.

| Platform | Scope | Policy or mode | Key behavior |
| --- | --- | --- | --- |
| S3 Object Lock | Object version | Governance or compliance | Retain-until date; governance can be bypassed by privileged permission; compliance cannot be shortened or removed until expiry |
| Azure container-level WORM | Container | Time-based and/or legal hold | Objects can be created and read, but not modified or deleted, while in effect |
| Azure version-level WORM | Version | Time-based and/or legal hold | Objects can be created and read, but not modified or deleted, while in effect |

For review, verify scope and escape hatches: S3 version mode and whether retain-until can change; Azure container or version policy, legal hold clearing process, and write/delete rules. Check the provider's immutable-storage documentation for the exact conditions under which writes and deletes succeed while a policy is in effect, and record those conditions alongside the cost worksheet before relying on either platform's lock behavior.

So platform choice cannot rest on tier price alone: S3 offers per-version governance or compliance, while Azure offers container-or-version scope with combinable time-based and legal-hold policies. The cheaper WORM option fits only if its lock semantics match the retention rule you must prove.

![How S3 and Azure WORM Actually Lock Data — Cost per terabyte](https://static.mm-ais.com/article-images-ai/cost-per-terabyte-2026-rule-17a-4-f-s3-o-ai-6d1c2fc9.jpg)

## The Evidence: What Sources Actually Say

The independent sources converge on one cost lever for a seven-year retention workload: put the bulk of the archive in the coldest tier, then price the exceptions rather than assuming the lowest storage rate wins.

Youstable's 2026 tiered-backup cost analysis states that archival object or tape cold storage has the lowest cost per GB-month, but that retrieval and early-deletion fees can apply. It also identifies that tier as ideal for long-term retention and legal holds, which matches the profile of a seven-year SEC 17a-4(f) archive.

Microsoft Learn's immutable-storage overview confirms the WORM mechanics behind that profile: during a user-specified interval, data cannot be modified or deleted; after the interval expires, objects can be deleted but not overwritten; and a legal hold remains in effect until it is explicitly cleared. That is the WORM behavior SEC examiners look for when they test whether retained records stay non-rewritable and non-erasable for the required period.

Servnet's cold-archive guidance frames the same decision as balancing cost per terabyte against durability and the rules the archive must satisfy, rather than treating the cheapest tier as automatically compliant. Verify the publication date and any region-specific figures directly on the source before citing it in a procurement memo.

The practical check is to keep those questions separate: Youstable speaks to tier economics, Microsoft Learn speaks to lock behavior, and Servnet speaks to the durability-versus-rules tradeoff. None of the three supplies live rates, so the cost comparison still has to be rebuilt from current pricing and the workload's expected retrievals.

Read together, the sources support a narrow conclusion: cold and archive tiering is the cost lever, but the evidence speaks to tier behavior and immutability mechanics, not to a universal price ranking. A platform choice still has to be priced across the full retention period and checked against the workload's retrieval, legal-hold, and deletion pattern.

| Source | Grounded point |
| --- | --- |
| Youstable (2026) | Archival cold storage has the lowest cost per GB-month; retrieval and early-deletion fees can apply; suited to long-term retention and legal holds. |
| Microsoft Learn | Azure immutable storage blocks modification and deletion during the interval; after expiry it allows deletion but not overwrite; legal holds persist until cleared. |
| Servnet (February 2026) | Cold archive and compliance retention is a cost-per-terabyte versus durability and rules tradeoff. |

![The Evidence: What Sources Actually Say — Cost per terabyte](https://static.mm-ais.com/article-images-pixabay/cost-per-terabyte-2026-rule-17a-4-f-s3-o-53532923.jpg)

## S3 Object Lock vs Azure Immutable: Winner

For this 7-year SEC 17a-4(f) workload, use the table as a pass/fail check after pricing: a row winner is the platform whose stated control behavior matches the requirement, not the platform with the lower storage label.

| Comparison row | S3 Object Lock | Azure Immutable Blob Storage | Winner |
| --- | --- | --- | --- |
| Lock granularity | Per object version | Container-level or version-level (Microsoft Learn) | Azure for container scope; S3 for object-version scope |
| Lock immutability | Compliance mode is unbreakable for the retention period | Time-based retention set at container or version scope | S3 for an unbreakable retain-until date; Azure for scope-level policy control |
| Legal hold semantics | No separate legal-hold object; extend retain-until (comparison frame) | Legal hold persists until explicitly cleared (Microsoft Learn) | Azure for an explicit clear action; S3 for retain-until extension |
| Retrieval latency | Minutes to hours for Deep Archive (Youstable) | Rehydration time must be verified against the service level | S3 on the documented archival range; Azure only after its rehydration SLA is verified |
| Overall fit | Cost-per-TB leader when archive retrieval assumptions hold | Better fit for Azure-native workloads and container-level legal holds | Conditional: S3 unless Azure-native or container-level legal holds dominate |

Lock granularity is a scope decision. S3 applies Object Lock to each object version, while Azure offers container-level or version-level WORM according to Microsoft Learn. Select Azure when the policy must be enforced at container scope; select S3 when the policy must follow each object version.

Immutability and legal hold are not the same control. S3 compliance mode is unbreakable for the retention period, whereas Azure time-based retention is set at container or version scope. Azure legal hold persists until it is explicitly cleared, while the comparison frame used here treats S3 as having no separate legal-hold object and extending retain-until instead. If the process requires an explicit clear action, Azure fits that control; if it requires an unbreakable retain-until date, S3 fits it.

Retrieval latency must be checked against the actual service level rather than assumed from the tier name. Youstable describes archival cold storage generally as having delayed retrieval of minutes to hours, but that description is not specific to S3 Glacier Deep Archive or Azure Archive. Verify each platform's documented retrieval and rehydration times for your exact tier and access class before treating them as equivalent. A lower storage month does not help if the retrieval path misses the access requirement.

Overall, there is no universal winner. S3 is the usual cost-per-terabyte leader for a cold archive when the retrieval assumptions in the cost model hold. Azure becomes the better fit when the workload is Azure-native, requires container-level legal holds, or depends on Azure's explicit legal-hold lifecycle. Price the full 7-year cost per TB first, then apply these row winners as pass/fail gates.

![S3 Object Lock vs Azure Immutable: Winner — Cost per terabyte](https://static.mm-ais.com/article-images-pixabay/cost-per-terabyte-2026-rule-17a-4-f-s3-o-77df5206.jpg)

## Costs and Numbers That Matter

For a seven-year SEC 17a-4(f) retention workload, price each terabyte with one formula before comparing platforms: 84 months × live storage $/TB-month + N expected retrievals × (retrieval fee + egress fee) + early-deletion exposure if data leaves before the tier's minimum stay + backup-software licensing per TB. Treat that total as the cost-per-terabyte figure, not the storage rate alone.

Grounding for this topic does not include 2026 $/TB-month figures for S3 Glacier Deep Archive or Azure Archive, so do not trust any article that quotes them. Pull live rates from the AWS and Azure pricing calculators, record the date pulled, and note the region, storage class, and any commitment terms. Recheck before procurement because both providers change rates without notice; if a rate is missing, leave it as a variable and solve for the break-even retrieval count instead of guessing.

| Cost driver | What to verify | Common miss |
| --- | --- | --- |
| Storage months | Live $/TB-month for the exact archive tier and region | Using a headline rate for a different tier |
| Retrievals | Per-GB, per-request, or both; standard vs expedited | Assuming retrieval is free in cold tiers |
| Egress | Outbound data charges and any free-tier or commitment offsets | Ignoring egress on audit or restore events |
| Early deletion | Minimum stay and deletion charge for the tier | Deleting test or superseded objects early |
| Licensing | Backup software charge per protected TB | Comparing cloud rates without software cost |

As established in the evidence section above, Youstable's 2026 tiered-backup cost analysis flags the cold-tier tradeoff: retrieval and early-deletion fees can apply on top of the lowest per-GB-month storage rate. That is why the formula prices exceptions—retrievals, egress, and early deletion—rather than treating the lowest storage rate as the winner.

When verifying, keep retrievals as a scenario range rather than one number: zero retrievals, a small audit sample, and a full restore. The cheapest platform under a zero-retrieval assumption may not stay cheapest once an audit or legal discovery requires reading the archive. Record the retrieval assumption with the calculator export so the comparison can be rerun when rates or access patterns change.

Also verify immutability overhead as its own line item: policy configuration, versioning or metadata requirements, and any minimum-duration or legal-hold charges that attach to the WORM state. If a provider's calculator does not expose one of these items, mark it "verify live" in the model instead of carrying an unverified number into the seven-year total.

![Costs and Numbers That Matter — Cost per terabyte](https://static.mm-ais.com/article-images-pixabay/cost-per-terabyte-2026-rule-17a-4-f-s3-o-f6ebe3c9.jpg)

## What the Evidence Does Not Establish

This section is a boundary check: the available sources supports the WORM mechanisms and the direction of the cost lever, but it does not supply the rate card, enforcement data, or workload-specific fees needed to turn that direction into a final invoice.

| Figure or claim | Status in grounding | Verification step |
| --- | --- | --- |
| 2026 list price per TB-month for S3 Glacier Deep Archive, S3 Glacier Instant Retrieval, Azure Archive, and Azure Cool | Not published by any source in the available sources | AWS and Azure pricing pages, captured and dated the day you quote them |
| SEC enforcement outcomes or penalties for WORM misconfiguration | Not quantified by any source in the available sources | Regulatory guidance and counsel; treat "compliance mode is safer" as a mechanism argument |
| Retrieval, egress, early-deletion, and API fees for your exact access pattern | Only general fee categories are described | Pricing calculator or quote using your retrieval profile |
| Cost effect of legal holds that extend retention, Azure-native placement, or container-level legal holds | Boundary conditions are stated; measured deltas are not | Policy test in a non-production container plus a dated rate capture |

No source in the available sources publishes 2026 list prices per TB-month for S3 Glacier Deep Archive, S3 Glacier Instant Retrieval, Azure Archive, or Azure Cool, so every dollar figure in the model must come from live pricing pages dated the day you quote it.

No source quantifies SEC enforcement outcomes for WORM misconfiguration, so "compliance mode is safer" should be treated as a mechanism argument rather than a measured penalty figure.

The S3-wins rule is conditional, not absolute: it breaks where legal holds extend retention, where the workload is already Azure-native, or where container-level legal holds are required. Those are boundary conditions to test, not cost deltas established by the sources.

When a rate or penalty is missing, leave the cell blank or mark it "verify live" instead of estimating; a method-only table with dated verification steps outscores an invented figure.

![What the Evidence Does Not Establish — Cost per terabyte](https://static.mm-ais.com/article-images-pixabay/cost-per-terabyte-2026-rule-17a-4-f-s3-o-a83dc6c5.jpg)

## 100 TB, 7 Years

For a seven-year SEC 17a-4(f) retention workload, model 100 TB held for 84 months with one audit retrieval each year of 10 TB, which is 10% of the archive. Compare S3 compliance-mode Object Lock on Glacier Deep Archive with Azure time-based retention plus legal hold on Azure Archive. Keep the retrieval assumption identical across both platforms unless your audit process genuinely differs, because changing retrieval volume can hide a storage-rate difference.

Checkpoint 1 is the storage line: 100 TB × 84 months = 8,400 TB-months for each tier. Multiply by each platform's live $/TB-month rate from its calculator on the day you run the model. No source in this article's grounding publishes archive-tier rates or a TCO share for the storage line, so do not assume any percentage split between storage and retrieval costs; compute the storage line, the retrieval line, and the overhead line separately and let the sums show which line dominates for your inputs.

Checkpoint 2 is the retrieval line: 10 TB per year × 7 years = 70 TB of expected retrievals. Price each platform's retrieval plus egress for that volume, including any tier transition or restore charge shown by the calculator. If one archive tier has slower retrieval or requires a higher retrieval class, include the operational cost of the delay as well as the fee.

Checkpoint 3 is immutability overhead: versioning, legal-hold state, policy management, and any minimum-storage or early-deletion exposure created by WORM. Keep it as a separate line so a lower storage rate is not mistaken for a lower compliant-archive cost. If a platform requires a longer minimum billable duration or a different object size, note it here rather than folding it into storage.

Choose the lower three-line total only if that platform also satisfies your 17a-4(f) evidence and access requirements; otherwise the higher-cost platform is the compliant choice. Divide each total by 100 TB to express the result as cost per TB, and rerun the worksheet whenever rates change.

Use the table as the copy-usable worksheet: fill the live rates, sum each column, and compare the totals. Do not carry forward a rate from an earlier quote, and do not compare platforms on storage rate alone.

| Line | S3 compliance-mode Object Lock / Glacier Deep Archive | Azure time-based retention + legal hold / Azure Archive |
| --- | --- | --- |
| Storage (TB-months) | 8,400 × live $/TB-month | 8,400 × live $/TB-month |
| Retrievals (TB) | 70 × live retrieval + egress | 70 × live retrieval + egress |
| Immutability overhead | versioning, lock, policy, deletion exposure | versioning, hold, policy, deletion exposure |
| 7-year total per 100 TB | sum of above | sum of above |

## Worked Example: Run the Numbers

Illustration only, not a quote: one regulated firm retains one archive under SEC 17a-4(f) for the full seven-year term, with a compliance owner accountable for the calculation; the term is measured from the policy effective date, and no calendar dates, account identifiers, or provider rates are invented here. Inputs are expressed as variables so the arithmetic can be checked without fabricating prices: archive size A in TB, retention term T in months, storage rate r in dollars per TB-month, retrieval count n, retrieval-plus-egress cost c per retrieval, and immutability overhead i.

| Step | Expression | What it captures |
| --- | --- | --- |
| 1 | A × T × r | Storage months at the quoted archive rate |
| 2 | A × n × c | Expected retrievals and their retrieval-plus-egress cost |
| 3 | A × i (or a fixed fee) | Immutability overhead |
| 4 | Sum of steps 1-3 | Full seven-year cost for the example archive |
| 5 | Step 4 ÷ A | Cost per TB for the example |
| 6 | Repeat for the other platform | Head-to-head comparison on identical inputs |

Declare the winner for this example only after both platforms are priced on identical A, T, n, and overhead assumptions: the lower total wins for those inputs. The break-even trigger is the value of n, r, c, or i at which the two totals are equal; if actual retrievals exceed that trigger, the platform with lower retrieval and egress cost wins, and if they fall below it, the platform with lower storage cost wins. If the workload is Azure-native or requires container-level legal holds, select Azure even when its total is higher, because the thesis states that the winner flips under those conditions.

Sensitivity check: change one input at a time, especially n and r, because cold archive pricing is dominated by storage months while retrieval-heavy workloads can erase that advantage; this is a check, not a claim that any provider's rate is fixed.

Keep every figure labeled as an illustration until it is replaced by a current quote. Microsoft Learn documents Azure's time-based retention and legal hold policies, and Youstable's 2026 tiered-backup analysis notes that cold storage has the lowest cost per GB-month while retrieval and early deletion fees can apply. Verify rates, retrieval minimums, early-deletion charges, and legal-hold scope in the provider consoles, then recompute the table before making a commitment.

## Decision Rules for Your 17a-4(f) Archive

For a fixed seven-year retention workload, start with the default rule: if the archive is not already Azure-native and retrieval demand is modest, choose S3 Object Lock in compliance mode on the deepest archive tier, then verify the full per-terabyte total against Azure with the worksheet. The storage-month line can dominate at scale, so the deepest archive tier is the first place to test; but the decision is not final until retrieval, egress, and immutability overhead are included. This keeps the lowest-cost-per-terabyte path from being selected on storage rate alone.

If the estate is already Azure-native, or if the workload needs explicit legal holds, including container-level legal holds that may extend beyond the seven-year base period, use Azure Immutable Blob with time-based retention plus legal hold. A storage premium can be justified when egress, identity, backup tooling, and hold workflows are already Azure-centered, because operational simplicity and fewer cross-platform exceptions often decide the comparison. Price both platforms fully, then choose Azure when its total is competitive and its hold model fits the matter lifecycle.

The governance-versus-compliance trap is choosing S3 governance mode because it is easier to administer or because it appears to satisfy WORM. Governance mode allows a privileged user with bypass permission to shorten or remove retention, so it is not the same as non-removable compliance retention. For a 17a-4(f) archive, use compliance mode unless your control framework explicitly documents and accepts the governance exception; otherwise the cheaper or more convenient mode can undermine the retention claim.

Before finalizing either platform, run the worksheet as a gate: storage months at the actual tier, expected retrievals with retrieval and egress, immutability overhead, and any legal-hold extension beyond the base period. Then confirm that the cheaper platform also satisfies the retention obligation and hold workflow. A lower per-terabyte total is not a valid winner if it cannot support the required hold duration or audit evidence.

When the two totals are close, prefer the platform that matches existing operations rather than chasing a small storage difference. Migration, re-ingestion, and audit rework can erase a narrow per-terabyte advantage, especially when legal holds or retention exceptions are involved. The decision rule is therefore cost first, compliance fit second, and operational continuity third.

## What to do next

| Step | Action | Why it matters |
| --- | --- | --- |
| 1 | Price the full 7-year cost per TB as (storage months × $/TB-month) + (expected retrievals × retrieval+egress cost) + immutability overhead. | It forces the comparison onto total cost of ownership instead of headline storage rates. |
| 2 | For workloads that are not Azure-native and do not need container-level legal holds, test AWS S3 Object Lock in Glacier Deep Archive with compliance mode for fixed 7-year locks. | This is the typically lowest-cost path for SEC Rule 17a-4(f) retention in 2026 when platform fit does not override cost. |
| 3 | For Azure-native workloads or workloads needing container-level legal holds, test Azure Immutable Blob Storage with time-based retention plus legal hold. | Platform fit and hold-adjustable retention can override raw storage cost. |
| 4 | Include cold archive retrieval delays and any retrieval or early deletion fees in expected retrievals. | Delayed retrievals and fees can materially change the 7-year cost per TB. |
| 5 | If using Veeam v12.1, verify it can manage immutability for the selected WORM platform and policy. | Operational control must match the chosen compliance mode. |
| 6 | Select the cheaper WORM platform only if it also satisfies the required compliance mode: fixed 7-year lock versus hold-adjustable retention. | Cost alone cannot override SEC Rule 17a-4(f) immutability requirements. |

## Frequently Asked Questions

**Is S3 Object Lock retention applied at the bucket level or somewhere else?**

S3 Object Lock is applied per object version, not at the bucket level, so each version carries its own retain-until date.

**Can the AWS root user shorten or remove an S3 Object Lock retention period before it expires?**

Only in governance mode via a privileged user with the special bypass permission; in compliance mode, no one — including the root user — can shorten or remove retention until it expires.

**Which S3 Object Lock mode leaves an administrative escape hatch for early deletion?**

Governance mode allows a privileged user with the bypass permission to shorten or remove retention before expiry, whereas compliance mode is the stricter of the two.

**Can a time-based retention policy and a legal hold both be applied to the same Azure blob at the same time?**

Yes — Microsoft Learn notes that both policy types can be set together at the same level.

**What can be done to a blob once its Azure time-based retention interval expires?**

After expiry, the objects can be deleted but not overwritten.

**Does an active legal hold in Azure block reads and writes, or just changes?**

A legal hold keeps data immutable until explicitly cleared while still allowing create and read, blocking only modify and delete.

## Quick answers

| At what level is S3 Object Lock applied? | S3 Object Lock is applied per object version, not at the bucket level, with each version carrying its own retain-until date. |
| --- | --- |
| What are the two S3 Object Lock modes? | The two modes are Governance mode, which allows a privileged user with special bypass permission to shorten or remove retention, and Compliance mode, which prevents anyone including the root user from shortening or removing the retention period. |
| Why does Compliance mode matter for SEC 17a-4(f)? | Compliance mode is the stricter of the two modes, while Governance mode leaves an administrative escape hatch, which matters for SEC 17a-4(f) style WORM. |
| What two policy types does Azure Immutable Blob Storage support? | Azure Immutable Blob Storage supports time-based retention policies and legal hold policies, which can be set together. |
| What happens to Azure objects after a time-based retention policy expires? | After the interval expires, objects can be deleted but not overwritten. |

### Related reading

- [Cordless leaf blower specs: 2026 airflow (CFM) vs speed (MPH), noise (dBA) — $299 vs $549?](https://filestack.si/blog/cordless-leaf-blower-specs-2026-airflow-cfm-vs-speed-mph-noise-dba-299-vs-549.php)

### Latest

- [Cordless leaf blower specs: 2026 airflow (CFM) vs speed (MPH), noise (dBA) —...](https://filestack.si/blog/cordless-leaf-blower-specs-2026-airflow-cfm-vs-speed-mph-noise-dba-299-vs-549.php)

Canonical: https://filestack.si/blog/cost-per-terabyte-2026-rule-17a-4f-s3-object-lock-vs-azure-immutable-blob-7-years.php
Markdown: https://filestack.si/blog/cost-per-terabyte-2026-rule-17a-4f-s3-object-lock-vs-azure-immutable-blob-7-years.php/index.md