How to get started with UpCloud Managed Object Storage

Last updated on: October 29, 2026

Managed Object Storage stores files as objects in buckets and serves them through an S3-compatible API, so the tools and libraries you already use with Amazon S3 work with it too.

This guide walks you through creating a service in the Control Panel or with the UpCloud API, adding a bucket and a user with access keys, and uploading your first file with the AWS CLI.

Before you start

You need the AWS CLI on the computer you'll upload from. For how to install it, see Connecting to an UpCloud Object Storage instance using AWS CLI.

For the API steps, you need an API token. To create one, see How to get started using the UpCloud API.

For prices, see Managed Object Storage billing and the pricing page.

Choose your options

Before you create the service, decide on these options. They set where your data is kept and how you connect to it. The steps for setting them in the Control Panel or with the API come after, in Create the service.

Region

The region is where the service keeps your data. Each region is in one location, for example EUROPE-1 in FI-HEL2 (Helsinki). Choose the region closest to the people and servers that will use the service. For every region and its location, see Managed Object Storage availability.

Network access

Public access lets you connect to the service over the public internet, from your own computer or from anywhere else. It's on by default, and this guide uses it.

Private access lets Cloud Servers connect over an SDN Private Network that you attach to the service, without going over the public internet. The network can be in any of the locations that Managed Object Storage availability lists for the region. A Cloud Server that isn't on an attached network connects through public access, like any other computer, because the service isn't reachable over the Utility network.

You can attach private networks and turn public access off later. For the steps, see How to connect to Managed Object Storage over an SDN Private Network.

Termination protection

Termination protection is off by default. Turn it on for a service you can't afford to lose by accident: while it's on, the service can't be deleted or shut down until you turn protection off again.

Service name

The service name must be unique within your account, even across regions. It can contain lowercase letters, numbers and dashes, and you can change it later.

Create the service

In the Control Panel, go to Object Storage and click Create Object Storage.
Under Region, select the region. The location of each region is shown under its name.
Under Networks, keep Public access on. To give Cloud Servers private access as well, click Attach private network, select the network under Network and click Attach. For how servers then connect, see How to connect to Managed Object Storage over an SDN Private Network.
Turn on Termination protection if you want it.
Enter a Name and click Create Object Storage.

The service's page opens, and the service is ready to use once its status changes to Running.

This request creates a service with public access. Replace the values with your own:

POST /1.3/object-storage-2

{
  "name": "<service-name>",
  "region": "europe-1",
  "configured_status": "started",
  "networks": [
    {
      "name": "public-access",
      "type": "public",
      "family": "IPv4"
    }
  ],
  "termination_protection": false
}

name: the service name.
region: the region, in lowercase, for example europe-1.
configured_status: started, so the service starts once it's created.
networks: the network access. "type": "public" turns on public access. The name is only for referring to the network in API requests.
termination_protection: termination protection, true for on.

The response includes the service's UUID in uuid. Use it to check on the service: it's ready once GET /1.3/object-storage-2/<service-uuid> returns "operational_state": "running".

Create a bucket

Every object is stored in a bucket. Bucket names must be unique within the service, and they can contain letters, numbers, dots (.), underscores (_) and dashes (-).

Go to Object Storage and open the service.
On the Buckets tab, click Create bucket.
Enter a Bucket name and click Create.

Create a user and access keys

S3 tools sign in to the service with an access key that belongs to a user of the service. A new user can't do anything until it has a policy, so give it one before you use its keys. This guide uses ECSS3FullAccess, a built-in policy that gives full access to every bucket in the service, but no access to users and policies. To give users only the access they need, see How to restrict user access in Managed Object Storage.

The secret key is shown only when you create the access key, so save it somewhere safe straight away. If you lose it, create a new access key.

On the service's Users tab, click Create user, enter a Username and click Create.
On the user's row, click POLICY, select ECSS3FullAccess under Policy and click Attach.
On the user's row, click ACCESS KEY. Copy the Access key and the Secret key with the copy icons next to them, or click Download keys as .txt. Then click Close.

Create the user:

POST /1.3/object-storage-2/<service-uuid>/users

{
  "username": "<username>"
}

Attach the ECSS3FullAccess policy to it:

POST /1.3/object-storage-2/<service-uuid>/users/<username>/policies

{
  "name": "ECSS3FullAccess"
}

Then create an access key:

POST /1.3/object-storage-2/<service-uuid>/users/<username>/access-keys

The response has the access key in access_key_id and the secret key in secret_access_key.

Connect with the AWS CLI

The AWS CLI needs the service's S3 endpoint and the user's access key.

On the service's Overview tab, the S3 endpoint is under Public access, next to S3 endpoint, for example https://abcd1.upcloudobjects.com.

Public access section of the service's Overview tab

GET /1.3/object-storage-2/<service-uuid>

In endpoints, the entry with "type": "public" has the endpoint's domain name in domain_name. The S3 endpoint is that name with https:// in front, for example https://abcd1.upcloudobjects.com.

Create an AWS CLI profile named upcloud for the service. A profile of its own keeps these settings apart from any AWS credentials you already use. Run this command and answer its questions with the access key, the secret key and the service's region. Leave the output format empty by pressing Enter.

aws configure --profile upcloud

Output
Tip: You can deliver temporary credentials to the AWS CLI using your AWS Console session by running the command 'aws login'.

AWS Access Key ID [None]: <access-key>
AWS Secret Access Key [None]: <secret-key>
Default region name [None]: europe-1
Default output format [None]:

The tip about aws login is for AWS accounts, so you can ignore it.

Then point the profile at the service's S3 endpoint, and set the two checksum settings that the service needs:

aws configure set endpoint_url <s3-endpoint> --profile upcloud
aws configure set request_checksum_calculation when_required --profile upcloud
aws configure set response_checksum_validation when_required --profile upcloud

Without the checksum settings, uploads fail with an XAmzContentSHA256Mismatch error.

Check the connection by listing your buckets:

aws s3 ls --profile upcloud

Output
2026-10-27 10:06:59 product-images

Upload a file

Upload any file from your computer to the bucket. This example uploads hello.txt from the current directory:

aws s3 cp hello.txt s3://<bucket-name>/ --profile upcloud

Output
upload: ./hello.txt to s3://product-images/hello.txt

List the bucket's contents to see it there:

aws s3 ls s3://<bucket-name>/ --profile upcloud

Output
2026-10-27 10:09:01         34 hello.txt

Manage files in the Control Panel

You can also work with the bucket's files in the Control Panel's file manager, without the AWS CLI or an access key. On the service's Buckets tab, click the bucket's name to open it. The file you uploaded is listed there.

From the file list, you can:

Click Upload files to add files from your computer.
Click Create directory to add a directory.
Click a file's name to open it in a new browser tab.
Click the bin icon on a file's row to delete the file, then click Delete to confirm.

The file manager's user

The first time you open a bucket in the file manager, the Control Panel adds a user named _upcloud-managed-filebrowser-user and a role named _upcloud-managed-filebrowser-role to the service. The file manager uses them to show and change your files. If you delete them, the Control Panel adds them again the next time you open a bucket in the file manager.

Delete the service

Deleting the service also deletes its buckets and the files in them, and its users and access keys. If termination protection is on, turn it off first.

Go to Object Storage and open the service.
Click the bin icon next to Shut down.
Select Force delete service, enter the service's name under Service name, and click Delete.

Delete service dialog with Force delete service selected

The service disappears from the Object Storage list once it's deleted.

Without Force delete service, the Control Panel deletes only a service that has no buckets, users, policies, groups or roles left. For any other service, it shows Service cannot be deleted as its not empty. Please make sure all buckets and IAM resources were deleted (users, policies, groups, roles).

DELETE /1.3/object-storage-2/<service-uuid>?force=true

The API answers with 204 No Content. While the service is being deleted, GET /1.3/object-storage-2/<service-uuid> still returns it, with an operational_state such as delete-buckets. Once it's gone, the request returns 404.

Without ?force=true, the API refuses to delete a service that still has buckets, users, policies, groups or roles, with Service cannot be deleted as its not empty. Please make sure all buckets and IAM resources were deleted (users, policies, groups, roles).

If termination protection is on, the API refuses the request with Service cannot be deleted if termination protection is enabled. Turn protection off first:

PATCH /1.3/object-storage-2/<service-uuid>

{
  "termination_protection": false
}

Troubleshooting

Unable to locate credentials. You can configure credentials by running "aws login".
The command ran without --profile upcloud, so the AWS CLI looked for a default profile. Add --profile upcloud to the command.
Could not connect to the endpoint URL: "https://s3.europe-1.amazonaws.com/"
The profile has no S3 endpoint, so the AWS CLI tried to reach Amazon S3. Run the aws configure set endpoint_url command from Connect with the AWS CLI.
Could not connect to the endpoint URL: "https://<id>.upcloudobjects.com/"
The S3 endpoint in the profile is wrong. Copy it again from the service's Overview tab and set it with aws configure set endpoint_url.
An error occurred (InvalidAccessKeyId) when calling the ListBuckets operation: The Access Key Id you provided does not exist in our records.
The access key is wrong, or it belongs to another service. Run aws configure --profile upcloud again and enter the access key and secret key of a user of this service.
An error occurred (SignatureDoesNotMatch) when calling the ListBuckets operation: The request signature we calculated does not match the signature you provided.
The secret key is wrong. Run aws configure --profile upcloud again and enter it. If you no longer have it, create a new access key.
An error occurred (AccessDenied) when calling the ListBuckets operation: Access Denied
The user has no policy. Attach ECSS3FullAccess to it, as in Create a user and access keys.
upload failed: ./hello.txt to s3://<bucket-name>/hello.txt An error occurred (XAmzContentSHA256Mismatch) when calling the PutObject operation: The Content-SHA256 you specified did not match what we received
The profile is missing the checksum settings. Run the two aws configure set commands for request_checksum_calculation and response_checksum_validation from Connect with the AWS CLI.

Next steps

Connecting to an UpCloud Object Storage instance using AWS CLI explains how to set up the AWS CLI on Linux, macOS and Windows, and how to use several profiles.
How to perform basic Object Storage operations using AWS CLI shows more commands for working with buckets and files.
Connecting to an UpCloud Object Storage instance using S3cmd shows how to use S3cmd instead of the AWS CLI.
How to set up a public read bucket explains how to share files over HTTPS without credentials.
How to restrict user access in Managed Object Storage explains how to give users only the access they need.
Best practices for UpCloud Managed Object Storage covers security, performance and cost.

Contributed by: Samir Haliru