Connecting to Managed Object Storage
A Managed Object Storage service can be reached in two ways. Public access lets you connect over the public internet, from your own computer or from anywhere else. Private access lets Cloud Servers connect over SDN Private Networks that you attach to the service, without going over the public internet. A service can have both. You manage them on the service's Overview tab in the Control Panel, or with the UpCloud API. For step-by-step instructions, see How to connect to Managed Object Storage over an SDN Private Network.
The Utility network doesn't give access to Object Storage. A Cloud Server that isn't on an attached SDN Private Network connects through public access, like any other computer.
Endpoints
Each type of access has its own endpoints. They're listed on the service's Overview tab, under Public access and Private access, and in the endpoints of the service's details in the API.
| Endpoint | Public access | Private access |
|---|---|---|
| S3 | https://abcd1.upcloudobjects.com | https://abcd1-private.upcloudobjects.com |
| IAM | https://abcd1.upcloudobjects.com:4443/iam | https://abcd1-private.upcloudobjects.com:4443/iam |
| STS | https://abcd1.upcloudobjects.com:4443/sts | https://abcd1-private.upcloudobjects.com:4443/sts |
abcd1 stands for the service's own ID. The private endpoints have the same name as the public ones, with -private added. They have valid TLS certificates, so S3 tools connect to them without any extra settings.
Users, policies and access keys are the same whichever endpoint you use. Requests over the private endpoints come from the server's address on the SDN Private Network, so a policy condition on aws:SourceIp has to allow that address or the network's range. For how policies work, see Managed Object Storage users and access control.
Private access
Private access works over SDN Private Networks. A network can be attached to a service if:
- The network is attached to an SDN Router. A network without a router can't be attached.
- The network is in one of the locations that can reach the service's region. For example, an APAC-1 service can use networks in SG-SIN1 and AU-SYD1. For every region, see Object Storage availability.
A service can have several networks attached, and all of them use the same private endpoints. A network can also be attached to more than one service.
The private endpoints' names resolve in public DNS, but only servers on an attached network can reach their addresses. Servers get the route to them from the network's DHCP. A server created after the network was attached gets the route when it starts. A server that was already on the network gets it when it renews its DHCP lease or restarts. Requests from a server without the route time out.
When a network is detached, servers on it can't reach the service any more, even if they still have the route. A network that's attached to a service can't be deleted until it's detached.
Transfer over SDN Private Networks is included and doesn't count toward your Fair Transfer Limit. For details, see Network transfer.
Turning public access off
Public access is on by default. When you turn it off, the service keeps only private access:
- The public endpoints are removed from DNS, and requests to them fail.
- The Control Panel's file manager and bucket policy editor stop working, because they use public access. The Buckets tab still lists the buckets.
- Custom domains and static websites stop working, because they're reached over public access. New custom domains can't be added in the Control Panel.
If you detach the last network while public access is off, nothing can reach the service until you attach a network or turn public access back on.
When you turn public access back on, the public endpoints come back with the same names, and custom domains and static websites work again.