Object storage

Object storage keeps files (objects) in buckets and serves them over the S3 API, so the tools you already use work: aws-cli, rclone, s3cmd, restic, and every S3 SDK. Objects are kept in three copies on different servers in the region.

To get going, see Store files in a bucket.

The endpoint

Each region has one S3 endpoint. In lab-neo-1:

Setting	Value
Endpoint	https://s3.lab-neo-1.tebibhost.com
Region (for signing)	lab-neo-1
Addressing	path-style: https://s3.lab-neo-1.tebibhost.com/<bucket>/<key>

tebib storage info and the console’s Buckets page show them for your project.

Buckets

• A bucket belongs to one project. Its name is the S3 name, and names are unique in the region: 3-63 lowercase letters, digits and -, starting and ending with a letter or digit (no dots, no --, nothing starting with xn-- or tebib).
• You create and delete buckets in the console, the CLI or the API, not with S3 CreateBucket (aws s3 mb is refused). That keeps every bucket in your project’s list, its quota and its bill.
• Private (the default): only your project’s S3 keys can read or write it.
• Public-read: anyone can download an object by its URL. Listing, uploads and deletes still need a key. Public buckets need a verified account and the IAM action storage:PutBucketPolicy.
• An optional size cap per bucket: uploads that would take it over are refused.
• Deleting: a bucket must be empty, unless you delete it with force, which deletes its objects too. There is no undo. A bucket whose delete is waiting for it to be emptied accepts no new uploads.

S3 keys

An S3 key is an access key ID (TBO..., 20 characters) and a secret access key (40 characters).

• A key belongs to a project and is held by you or a service account of your organization.
• A key can read and write every bucket in its project. Give each person, server and CI job its own key, in the project it needs; use separate projects to keep data apart.
• The secret is shown once, when you create or rotate the key.
• Rotate gives the key a new ID and secret; the old pair keeps working for the time you choose (0 to 168 hours, 24 by default), so you can update your clients without downtime.
• Turn off a key to stop it without deleting it; turning it back on keeps the same secret.
• When a user leaves the organization, or a service account is disabled or deleted, its keys stop working at once.

S3 keys are not API access keys: those drive the TebibHost API and CLI, these drive the S3 endpoint.

Who may do what

IAM decides who may manage buckets and keys (actions storage:*; see IAM policies): storage:CreateBucket, storage:DescribeBucket, storage:UpdateBucket, storage:PutBucketPolicy, storage:DeleteBucket, storage:ForceDeleteBucket, storage:CreateAccessKey, storage:DescribeAccessKey, storage:UpdateAccessKey, storage:RotateAccessKey, storage:DeleteAccessKey and storage:DescribeStorage. Reading and writing objects is decided by the key: a key works on its own project’s buckets, and nothing else.

Quotas

Quota	Default
Buckets per project	10
Stored per project	100 GiB
S3 keys per project	20

Organization totals by tier: new 3 buckets and 10 GiB, payment_verified 20 buckets and 250 GiB, id_verified 50 buckets and 1,000 GiB. Storage quotas are enforced by the object store itself: an upload over the quota is refused with QuotaExceeded.

Billing

Object storage is billed from your prepaid wallet like everything else (see Prepaid billing):

What	Meter	Unit
Data stored	storage.gb	GB-hour (1 GB = 10^9 bytes)
Data downloaded from buckets	storage.egress.gb	GB
Requests of any kind	storage.requests	1,000 requests

See tebib price list for the current prices. Sizes are measured about once a minute; usage shows per bucket on its page and in Usage.

Not yet

Bucket versioning, lifecycle rules, CORS settings, per-bucket keys and virtual-hosted URLs (<bucket>.s3...) are not available yet. Data in buckets is not backed up outside the region: keep copies of anything you can’t lose.