Built‑in vs External Artifact Storage: Which Retention Policy Governs Your Backups?

Answer: Retention depends on where the artifact is stored

CircleCI’s built‑in artifact store enforces its own retention period (default 90 days) and automatically deletes objects after that interval. When you upload artifacts to an external bucket (S3, GCS, or Azure Blob), CircleCI treats the bucket as a passive destination and does not apply any expiration or garbage‑collection logic to those objects.

Confirmed facts

• Internal artifact store: configurable retention, automatic deletion after the set period.
• External artifact store: no CircleCI‑initiated expiration; retention is governed solely by the bucket’s lifecycle policies.
• CircleCI provides no UI or API to set an expiration for externally stored artifacts.

Likely explanation (based on current behavior)

If you rely on the default 90‑day expiration but store artifacts externally without matching lifecycle rules, the artifacts may be retained indefinitely (incurring extra cost) or deleted sooner than expected if the bucket’s lifecycle is more aggressive. Therefore, to achieve the same retention as the internal store you must configure the external bucket’s lifecycle to expire or transition objects after the desired period.

Steps needed for this case

1. Identify storage location – Check your .circleci/config.yml for the store_artifacts step; note whether you specify an destination (external) or rely on the default internal store.
2. Review bucket lifecycle
   • For AWS S3: aws s3api get-bucket-lifecycle-configuration --bucket <bucket-name>
   • For GCS: gsutil lifecycle get gs://<bucket-name>
   • For Azure Blob: view lifecycle management rules in the Azure portal or via Azure CLI.
3. Align retention – If you want the same 90‑day behavior, add a lifecycle rule that expires objects after 90 days (or matches your internal retention setting). Example S3 JSON snippet:

   {
     "Rules": [
       {
         "ID": "ExpireAfter90Days",
         "Status": "Enabled",
         "Filter": {},
         "Expiration": { "Days": 90 }
       }
     ]
   }

4. Verify artifact integrity – After a workflow run:
   1. Download the artifact from CircleCI’s internal store (if available) or from the external bucket.
   2. Compute a SHA‑256 checksum: shasum -a 256 <file>.
   3. Compare the checksum to the one recorded in the CircleCI UI/API for the original upload (CircleCI stores the hash when the artifact is stored). Matching hashes confirm identical content.
5. Periodic audit – Schedule a monthly check that the bucket’s lifecycle configuration still matches your desired retention and that a test restoration succeeds.

Note: The behavior described reflects CircleCI’s documented artifact handling as of the 2024‑2025 release series. If you are using a significantly older or newer version, verify that the internal store still applies automatic expiration and that no new external‑artifact garbage‑collection features have been introduced.