S3¶
S3 stores immutable raw event payloads.
Raw layout¶
Default key format (partition-friendly):
raw/source=
/event_type= /event_date= /ingest_date= /hour= /event_id= .json
This supports:
- ad-hoc Athena queries later
- easy browsing by day/source/type
- investigations by ingest-time vs event-time
Immutability¶
We never overwrite existing objects:
- same event_id → same key
- duplicates do not write again (dedupe gate)
Recommended defaults¶
- SSE-S3 or SSE-KMS
- lifecycle policy (e.g., raw events keep 30–180 days depending on needs)