Managed Object Storage S3 compatibility

UpCloud Managed Object Storage is compatible with the Amazon S3 API, except for the features listed under Unsupported S3 APIs. To move your data from AWS S3 or another S3-compatible provider, see How to migrate to Managed Object Storage from AWS S3 or another provider.

Supported S3 APIs

The following S3 features and API operations are supported in Managed Object Storage:

• Bucket operations: CreateBucket, DeleteBucket, HeadBucket, ListBuckets
• Object operations: PutObject, GetObject, HeadObject, DeleteObject, CopyObject, ListObjects, ListObjectsV2
• Multipart upload: CreateMultipartUpload, UploadPart, CompleteMultipartUpload, AbortMultipartUpload, ListParts, ListMultipartUploads
• Access control: Bucket and Object ACLs, Bucket policies
• Versioning: Bucket versioning, Object versioning
• Lifecycle management: Bucket lifecycle policies
• Cross-origin resource sharing (CORS): Bucket CORS configuration

For advice on multipart uploads, parallel requests, retries and other performance topics, see Best practices for UpCloud Managed Object Storage.

For the steps, see Managed Object Storage Guides.

Advanced functionality

In addition to the standard S3 API features listed above, Managed Object Storage supports the following advanced functionality:

• Presigned URLs: A presigned URL gives temporary access to one object, so you can share a file without sharing access keys. For the steps, see How to perform basic Object Storage operations using AWS CLI.

• Chunked uploads: PutObject requests can be sent with Transfer-Encoding: chunked, or as aws-chunked uploads with signed chunks (STREAMING-AWS4-HMAC-SHA256-PAYLOAD).

• S3 Select: SelectObjectContent runs SQL queries on CSV and JSON objects and returns only the matching data.

• Server-side encryption with customer-provided keys (SSE-C): Requests can include their own 256-bit encryption key. Objects uploaded with a key can only be read by requests that include the same key. For the steps, see Encrypt Object Storage data with your own keys.

• SSE-S3 request headers: Requests that set the x-amz-server-side-encryption: AES256 header are accepted. All data is encrypted at rest whether or not the header is set.

• Identity and Access Management (IAM): Users, policies and groups control what each access key can do. For how they work, see Managed Object Storage users and access control.

Conditional writes

PutObject supports conditional writes. With If-None-Match: *, the upload succeeds only if there's no object with that key yet, which lets you create an object only once. With If-Match and an ETag, it succeeds only if the object's current ETag matches, so you don't overwrite a change made since you last read the object. If the condition isn't met, the request fails with 412 Precondition Failed and the object stays as it was.

CopyObject and CompleteMultipartUpload don't check these headers, and they overwrite an existing object. To create an object only once, or to replace it only if it hasn't changed, upload it with a single PutObject.

Unsupported S3 APIs

The following S3 features and API operations are not supported in Managed Object Storage:

Recent versions of the AWS CLI and AWS SDKs send uploads with a trailing checksum by default, and those uploads fail with an XAmzContentSHA256Mismatch error. To avoid this, set request_checksum_calculation and response_checksum_validation to when_required in the tool's configuration, as shown in How to get started with UpCloud Managed Object Storage.

To serve a website from a bucket, use static website hosting instead. For the steps, see How to host a static website on UpCloud Object Storage.