Object storage

Object storage keeps files in buckets, reached with the S3 API. Use it for backups, media and anything else you'd keep in Amazon S3. Any S3 tool or library works with it: the AWS CLI, rclone, restic, s3cmd and the AWS SDKs.

Getting it

An organization subscribes to object storage on your account page. Pick a plan under Object storage → Get object storage. You need to be an owner of the organization, or handle its billing.

Each plan sets how much you can keep and how many buckets you can have:

Plan	Storage	Buckets
Starter	250 GB	10
Standard	1 TB	100
Large	5 TB	1,000

The space counts every object and every part of an upload not finished yet.

Buckets and access keys

On your account page, Object storage shows each of your organizations' storage accounts. The organization's owners manage them. On plans with team access (Standard and Large), its admins can too.

Buckets. Make one with a name of 3 to 63 lower-case letters, digits, dots and hyphens, starting and ending with a letter or digit. Names are shared by everyone, as on Amazon S3, so a name someone has taken is refused. A bucket can be removed once it's empty.
Access keys. An access key is an id (starting ZK) and a secret. Tools sign their requests with it. The secret is shown once, when you make the key: copy it then. A key can reach every bucket, or be held to one bucket, or to reading only. Remove a key and anything using it stops at once. A key held to a bucket goes when the bucket does.

Connecting

The Object storage section shows the endpoint and region. Use path-style addressing: the bucket goes in the path, https://ENDPOINT/BUCKET/KEY, not in the host name.

The AWS CLI, with the endpoint shown on your page:

aws configure set aws_access_key_id ZK...
aws configure set aws_secret_access_key ...
aws --endpoint-url https://s3.example.com s3 ls
aws --endpoint-url https://s3.example.com s3 cp backup.tar.gz s3://my-bucket/

rclone (rclone config, or in rclone.conf):

[zappocity]
type = s3
provider = Other
access_key_id = ZK...
secret_access_key = ...
endpoint = https://s3.example.com
force_path_style = true

In the AWS SDKs, set the endpoint and turn on path style (for example UsePathStyle: true in Go, forcePathStyle: true in JavaScript, addressing_style: path in boto3).

What works

Buckets: list, make, check and remove.
Objects: put, get (whole or a range), check, copy, remove one or up to 1,000 at once, and list (with prefixes, delimiters and pages).
Uploads in parts (multipart), for big files. Each part but the last is at least 5 MiB. Parts left unfinished for a week are removed.
Presigned URLs, good for up to 7 days, to share an object or take an upload without giving out a key.
Metadata (x-amz-meta-*) and content headers kept with each object.
Checksums your tools send (CRC32, CRC32C, CRC64NVME, SHA-1, SHA-256, Content-MD5) are checked. An object that doesn't match is not kept.

The largest object is 5 GiB, whether in one upload or in parts. Every request is signed: there are no public buckets yet, so share objects with presigned URLs. Versioning, bucket policies, lifecycle rules and CORS are not offered yet. Tools that ask for them get a "not implemented" answer.

Objects are served so a browser can't run them as a page on our host. An HTML file is shown sandboxed, without its scripts.

Where objects are kept

Objects are kept on our servers. Those not written for a while may move to a storage provider we use (Backblaze B2). Each is encrypted on our servers before it goes, with a key of its own that only we hold, so the provider keeps only scrambled bytes it can't read or change unseen. Nothing changes for you: they're read, listed, copied and removed the same way, and only the first byte may take a moment longer.

If something goes wrong

SignatureDoesNotMatch: the secret is wrong, or your tool isn't using path-style addressing.
InvalidAccessKeyId: the key was removed, or never existed.
AccessDenied: the key is held to another bucket or to reading, or the storage account is suspended (an unpaid invoice).
NoSuchBucket: the bucket isn't one of this account's. Other accounts' buckets look like they don't exist.
QuotaExceeded: the plan's storage is used up. Remove objects or change plans.
RequestTimeTooSkewed: your computer's clock is more than 15 minutes off.