Object Storage

​

Summary

• Create a project-scoped, region-bound S3-compatible endpoint
• Find and filter Object Storage endpoints by region and status
• Manage endpoint access keys and identity policies from the endpoint details page
• Retrieve the endpoint URL after provisioning completes and use it with an S3-compatible client

​

Availability

​

Requirements

• Permissions to create and manage object storage resources
• A target project and region selected for the object storage endpoint
• An identity policy that allows the S3 actions your workload needs
• An S3-compatible client or SDK, such as the AWS CLI

​

Object Storage Lifecycle

​

Identity Policies

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket",
        "s3:GetObject",
        "s3:PutObject"
      ],
      "Resource": "*"
    }
  ]
}

​

S3 API Compatibility

​

Step-by-Step

1. Open Object Storage
   • In the Console, open your project, then go to Storage → Object Storage
   • Use the search field to find an existing endpoint by name
   • Use the Region and Status filters to narrow the list
   
2. Create the Object Storage endpoint
   • Click Create Object Storage
   • Enter an Object Storage Name
   • Select the Project
   • Select an available Region from the region picker
   • Click Create Object Storage and wait for the endpoint to reach Provisioned
3. Open the endpoint details page
   • Select the endpoint from the Object Storage list
   • Confirm the header shows the endpoint name and a Provisioned status badge
   • Use the Overview, Access Keys, and Identity Policies tabs to manage the endpoint
   
4. Add or review identity policies
   • Open the Identity Policies tab
   • To add a policy, click Add Policy
   • Provide a Policy Name and upload a .json custom policy document
   • Click Add Policy
   
5. Create an access key
   • Open the Access Keys tab
   • Click Add Access Key
   • Enter an access key name
   • Click Next: Select Policy
   • Select an existing identity policy, or upload a custom .json policy document and give it a policy name
   • Click Add Access Key
   • Copy the Access Key ID and Secret Access Key immediately from the creation dialog
   
6. Configure your S3 client
   • Set the endpoint URL, access key ID, and secret access key in your S3 client
   • Use any S3-compatible workflow to create buckets and manage objects

export AWS_ACCESS_KEY_ID="<access-key-id>"
export AWS_SECRET_ACCESS_KEY="<secret-access-key>"
export AWS_DEFAULT_REGION="<region-name>"
export EP="https://<endpoint-dns-name>"

aws --endpoint-url "$EP" s3api list-buckets
aws --endpoint-url "$EP" s3 mb s3://example-bucket
aws --endpoint-url "$EP" s3 cp ./data.csv s3://example-bucket/data.csv

​

Share objects with pre-signed URLs

export AWS_ACCESS_KEY_ID="<access-key-id>"
export AWS_SECRET_ACCESS_KEY="<secret-access-key>"
export AWS_DEFAULT_REGION="<region-name>"
export EP="https://<endpoint-dns-name>"
export BUCKET="example-bucket"

# 1. Create a bucket
aws --endpoint-url "$EP" s3 mb "s3://$BUCKET"

# 2. Upload a file
aws --endpoint-url "$EP" s3 cp ./demo.mov "s3://$BUCKET/demo.mov"

# 3. Generate a pre-signed URL that is valid for 1 hour (3600 seconds)
URL=$(aws --endpoint-url "$EP" s3 presign "s3://$BUCKET/demo.mov" --expires-in 3600)
echo "$URL"

# 4. Download the object with the pre-signed URL (no credentials required)
curl -fSL -o downloaded-demo.mov "$URL"

• Sign with a least-privilege key. The signing key must allow s3:GetObject for the object being shared. Consider generating URLs with a dedicated access key whose read-only identity policy is scoped to the objects you want to share.
• Keep expiry times short. Choose the shortest --expires-in value that fits your use case, and treat the URL like a secret while it is valid.
• Revoke access early by deleting the key. Deleting the access key that signed a URL invalidates every URL signed with it, even before they expire.

​

Terraform Example

​

Common Issues / Troubleshooting

1. Symptom: You can’t select a region when creating Object Storage Likely cause: The selected project already has an endpoint in that region. Fix: Choose another project, or delete the existing endpoint for that project/region if it is no longer needed.
2. Symptom: No endpoint URL is shown Likely cause: The endpoint is still provisioning or has not published its public exposure details yet. Fix: Wait for the endpoint status to become ready/provisioned. If the URL still does not appear, check the endpoint health status or contact support.
3. Symptom: You can’t retrieve an access key secret later Likely cause: Secrets are returned only once, when the access key is created. Fix: Create a new access key, update your workload with the new credentials, then delete the old access key.
4. Symptom: S3 requests fail with access denied Likely cause: The access key is attached to an identity policy that does not allow the requested S3 action or bucket/object resource. Fix: Review the policy attached to the access key. Confirm it includes the required s3: actions and the correct bucket/object resources.
5. Symptom: You can’t remove an identity policy Likely cause: One or more access keys still reference that policy. Fix: In the Identity Policies tab, check Keys Using. Delete or recreate the access keys that use the policy, then remove the policy.
6. Symptom: An object uploaded with a public-read ACL still returns access denied for unauthenticated requests Likely cause: Object Storage does not support public (anonymous) access. ACLs such as public-read do not make objects publicly readable. Fix: Generate a pre-signed URL for the object and share that URL instead.

​

Related Resources