s3 lifecycle rule to ensure objects under a specific prefix (e.g., protected-data/) are never deleted

To ensure objects under a specific prefix (e.g., protected-data/) are never deleted despite having other lifecycle rules that delete objects, you need to understand how S3 Lifecycle rules work with filters.

S3 Lifecycle rules apply only to the objects that match the filter criteria you specify. When you have multiple rules, each rule operates independently on the objects that match its filter. There's no concept of "overriding" rules - instead, you need to ensure your deletion rules don't apply to the protected objects.

Here's how to protect your objects under the "protected-data/" prefix:

1. Review your existing rules: Make sure your current deletion rules are using filters that don't include the protected-data/ prefix.

2. Modify your existing deletion rule: If your current deletion rule applies to all objects in the bucket (empty filter), modify it to use a filter that excludes the protected-data/ prefix. You'll need to create separate rules with specific prefixes for each directory you want the deletion rule to apply to.

For example, if you have these directories:

• data/
• logs/
• protected-data/
• temp/

And you want all except protected-data/ to be subject to deletion, you would:

• Remove the bucket-wide deletion rule
• Create separate rules with prefix filters for "data/", "logs/", and "temp/"

Each rule would specify the same deletion actions (delete after X days, etc.) but would only apply to objects under its specific prefix.

S3 Lifecycle rules can only filter objects based on key prefix, object tags, or object size. There's no way to create an "exclude" filter directly. Instead, you need to be explicit about which prefixes are included in deletion rules.

If your bucket structure is complex with many directories, consider using object tagging as an alternative approach. You could tag objects that should be protected and then configure your deletion rules to only apply to objects without that protection tag.
Sources
Lifecycle configuration elements - Amazon Simple Storage Service
Manage costs for replicated delete markers in a disaster recovery setup on Amazon S3 | AWS Storage Blog
LifecycleRuleFilter - Amazon Simple Storage Service

hi,

In other words:

as s3 lifecycle rule bucket level clean out everything after x number of days as bucket can't have don't rule.

solution rely on each section need to be deleted after x number of days, be very specific about what you want to delete

let's say in you bucket name 'mybucket' have total five folders, data1/, data2/ , data3/, data4/, and donotdeleteme/

you create separate lifecycle rules for each folder you want to delete.

Rule 1

filter prefix: data1/ delete object after n number days.

Rule 2

filter prefix: data2/ delete object after n number day.

follow for each section you want to delete.

so that way donotdeleteme/ has no rule to delete. :-)

Hope it is clear.

https://docs.aws.amazon.com/AmazonS3/latest/API/API_LifecycleExpiration.html

Best

Apart from the previous answers, you can do two more things to make sure the data in the protected prefix is not deleted by lifecycle policy. I don't recommend this for the purpose of working around lifecycle policies but these will work.

I previously suggested "Update bucket policy to deny delete in protected folders. This will deny anyone from deleting data in protected prefix.". Actually, ignore this as it will not work. Lifecycle policy does not follow bucket policy [https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lifecycle-mgmt.html]

Alternatively, apply object lock for the objects under protected prefix. This is disallow anyone from deleting objects in protected prefix. [https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock.html]