Object storage (S3)¶

Sunet Cloud exposes an S3-compatible object store backed by Ceph RADOS Gateway. Any tool or SDK that speaks the AWS S3 API works against it. Use it for backups, datasets, build artifacts, static website content, and application data that you read and write over the network.

Endpoint¶


Endpoint URL	`https://s3.orion.sunetvdc.se`
Addressing style	Path-style (`https://s3.orion.sunetvdc.se/<bucket>/<key>`)
Region	Leave empty, or use `us-east-1` if a tool insists on a value

The shorter name https://s3.sunetvdc.se redirects to the endpoint above. Configure your client with the full s3.orion.sunetvdc.se host.

Getting access keys¶

S3 access keys come from your OpenStack project as EC2 credentials, so you need access to a project first (see OpenStack authentication).

From the command line, with your OpenStack credentials loaded:

openstack ec2 credentials create

This prints an access and a secret value. They are scoped to the project and user you created them under. You can also create and view them in the dashboard under Identity → Application Credentials / EC2 Credentials.

Keep the secret safe. To revoke a key, delete the matching EC2 credential:

openstack ec2 credentials list
openstack ec2 credentials delete <access-key>

Configuring common tools¶

AWS CLIs3cmdrclone

aws configure        # paste the access key and secret
aws --endpoint-url https://s3.orion.sunetvdc.se s3 ls
aws --endpoint-url https://s3.orion.sunetvdc.se \
    s3 mb s3://my-bucket
aws --endpoint-url https://s3.orion.sunetvdc.se \
    s3 cp file.tar s3://my-bucket/

~/.s3cfg:

[default]
access_key = YOUR_ACCESS_KEY
secret_key = YOUR_SECRET_KEY
host_base = s3.orion.sunetvdc.se
host_bucket = s3.orion.sunetvdc.se
use_https = True

The host_bucket without a %(bucket)s placeholder keeps s3cmd in path-style mode, which is what the gateway expects.

rclone config section:

[sunet-s3]
type = s3
provider = Ceph
access_key_id = YOUR_ACCESS_KEY
secret_access_key = YOUR_SECRET_KEY
endpoint = https://s3.orion.sunetvdc.se

Then rclone ls sunet-s3:my-bucket.

Buckets, prefixes, and lifecycle¶

Create as many buckets as you need. Bucket names are shared across the whole gateway, so pick names that are unlikely to collide (prefix them with your project or organisation).
There are no real "folders". Keys with / in them are shown as a hierarchy by most tools, but the store is flat.
Versioning, object lifecycle (expiry) rules, and presigned URLs work as they do in AWS S3, through the same API calls your tooling already uses.

Billing¶

Object storage is billed per gigabyte stored per month. Committing to a longer term lowers the rate. See Durability, quotas and billing for current figures.