IONOS S3 Object Storage provides multiple features to manage access to your buckets and objects effectively. This allows you to define precisely who may access what. By default, newly created buckets and objects are 'private'. Only the bucket owner can access them.

Share access

Use the following options to share access to a bucket and to all or specific objects in a bucket:

Bucket and Object Access Control Lists (ACLs): Provides a simpler mechanism for controlling access and can be specified for every object if needed, making them more flexible on a per-object basis. You can use ACLs to make a bucket or object public or to share access with certain authorized users by setting the right permissions. ACLs do not offer the ability to restrict access based on conditions like IP address. For more information, see Access Control List.

Bucket Policy: This policy is applied at the bucket level and it offers a robust framework for setting fine-grained access controls to your Object Storage buckets and objects. It is useful for restricting access based on certain conditions like IP addresses or time of access.

With Bucket Policy, you can manage access to specific objects or prefixes within a bucket. However, the size of the policy is limited, which could be a consideration if you have extensive access control requirements. You can use Bucket Policy to make a bucket or object public, or to share access with specific authorized users by defining the necessary permissions within the policy. For more information, see Bucket Policy.

Other access management functions

Pre-Signed URLs: An excellent choice for securely providing temporary access to your objects. Essential for sharing files with someone without requiring them to have an IONOS account, and for granting temporary access to authorized users for a specified period, after which the URL expires. For more information, see Share Objects with Pre-Signed URLs.

Cross-Origin Resource Sharing (CORS): If you allow public access to your bucket, you can specify which domains can make cross-origin requests to your Object Storage using this function. It is useful when you need to serve resources from your bucket to web applications hosted on different domains.

Block Public Access: Overrides any other permissions applicable on buckets and objects. Essential for maintaining your data’s privacy by ensuring your buckets and objects are not accidentally made public and accessible only to authorized individuals or systems. Currently, this feature is available only via the IONOS S3 Object Storage API.

Grant access

IONOS S3 Object Storage allows for comprehensive access management at the bucket and object levels. This allows you to define precisely who may access what.

There are two roles involved in granting access:

Owner: The user who creates the bucket is referred to as the owner.

Grantee: Object Storage defined user groups to whom permissions are granted that specify which buckets and objects they may access. Usually, the grantee is the user under the same contract at IONOS, but it also could be the user under another contract. You need to get the Grantee’s Canonical User ID to share access to the bucket or object. For more information, see Retrieve Canonical User ID.

Permissions: These are the access rights that can be assigned to Grantees. By default, buckets and objects are private and only the bucket owner can access them. The content of a bucket is always accessible (as a list) as soon as the bucket is public, even if the objects it contains are private and can therefore neither be displayed nor downloaded!

In IONOS S3 Object Storage, a bucket is the primary container for data. Think of it like a directory in a file system where you can store files (known as objects). Each object is stored in a bucket and is identified by a unique key, allowing easy retrieval. You can store any number of objects in a bucket and can create up to 500 buckets in a user account.

Bucket region

A region corresponds to a geographical location where the data inside the buckets will be stored. Different regions have different S3 Endpoints, which are URLs to access the Object Storage.

IONOS S3 Object Storage is currently available in 3 regions:

• Berlin, Germany

• Frankfurt, Germany

• Logrono, Spain

Choosing the right bucket region is crucial for optimizing your Cloud storage. Consider the following:

• Proximity: Select a region that is close to your application or user base to reduce latency and costs.

• Redundancy: For backups, consider a region geographically separate from your primary location to ensure data safety during local outages or disasters.

Naming conventions

When naming buckets and folders, the name must adhere to the following rules:

• Be unique throughout the entire IONOS S3 Object Storage.

• Consists of 3 to 63 characters.

• Starts with a letter or a number.

• Consists of lowercase letters (a-z) and numbers (0-9).

• The use of hyphens (-), periods (.), and underscores (_) is conditional. The name must not:

  • End with a period, hyphen, or underscore.

  • Include multiple periods in a row (...).

  • Contain hyphens next to periods.

  • Have the format of an IPv4 address (Example: 192.168.1.4).

  • Contain underscores if the bucket is to be used for auto-tiering later.

Following are a few examples of correct bucket naming:

• data-storage-2023

• userphotos123

• backup-archive

• 1234

Following are a few examples of incorrect bucket naming:

Learn about the key components of IONOS S3 Object Storage, its functions, and capabilities to manage your Object Storage.

IONOS S3 Object Storage authenticates users by using a pair of keys – Access Key and Secret Key. For each user, an Object Storage Key is generated automatically on user creation which is activated when the user is granted permission to use the IONOS S3 Object Storage. You will need the keys to work with Object Storage through supported applications or develop your own using API.

Using the key management section in the IONOS S3 Object Storage, you can view and share your S3 Credentials and manage Access keys.

S3 Credentials

Depending on the selected S3 client, you have various options for sharing buckets, objects, or object versions with users of the IONOS S3 Object Storage. In addition to roles and predefined profiles, you can share the content of your buckets with selected users by using their IONOS S3 Object Storage ID known as ACL Sharing or S3 Sharing.

There are two forms of user identification - Canonical User ID, and Email address. The Canonical User ID is the ID assigned to a user by the IONOS S3 Object Storage. You can Retrieve Canonical User ID and share it with other S3 users to get access to their buckets and objects.

Some S3 clients only require the e-mail address of a registered S3 user for sharing objects as they are capable of converting the e-mail address to the ID required by the object storage.

Access keys

Logging on to IONOS S3 Object Storage requires an access key as part of the authentication process. Your S3 credentials consist of an Access Key and a Secret Key. The web console automatically uses these credentials to set up Object Storage. Hence, deactivating an access key restricts your access through the web interface. These credentials are also required to set up access to IONOS S3 Object Storage using S3 Tools.

Generate object storage keys: A bucket owner can have multiple Object Storage Keys, which can be given to other users or automated scripts. Users using such an additional Object Storage Key to access the IONOS S3 Object Storage automatically inherit credentials and access rights of the bucket owner. This can be useful for allowing users automated (scripted) or temporary access to object storage. For more information, see Generate a Key.

Activate or deactivate keys: A key when generated is in an active state by default. You can change the key status between active and deactivation. When the automated or temporary use of the key is over, the additional Object Storage Key can be deactivated. Deactivating an Object Storage Key will block access to the IONOS S3 Object Storage. You can reactivate the key and restore access to buckets and objects. For more information, see Manage Keys.

Delete: If a key is no longer needed or if it should no longer be possible to gain access to the IONOS S3 Object Storage with this key, it can be deleted. This cannot be undone.

Objects

IONOS S3 Object Storage organizes data as objects. The data could range from documents, pictures, videos, backups, and other types of content. You can store these objects within the buckets and each object can be a maximum of 5 TB in size. An object consists of a key, that represents the name given to the object. This key acts like a unique identifier and you can use it to retrieve the object.

Properties and metadata

Every object uploaded to a bucket includes Object properties and Object metadata.

The properties refer to object details and the metadata are key-value pairs that store additional information about the object. The maximum size of metadata is 2 KB (keys+values). For instance, an object of type 'image' can include metadata such as its photographer, capture date, or camera used. Properly defined metadata aids in filtering and pinpointing objects using specific criteria.

During object storage, its properties and metadata are retrievable alongside the object.

In the web console, for any object under a bucket, the following object properties are displayed:

From the Object Properties page, you can also perform the following actions:

• Download an object.

• Copy the object URL to the clipboard.

• Generate a Pre-Signed URL.

• Delete an object.

Object Functions

• Versions: Versioning objects enables the preservation, retrieval, and restoration of all versions of objects in your bucket. When versioning is enabled for a bucket, it also influences the object upload. For more information, see Versioning.

• Access Control List (ACL): The object Access Control List (ACL) contains access control for each object defining which user accounts can read, write, or modify objects within a bucket. The access permissions defined at the bucket level also influence the object access in a bucket. For more information, see Access Control List.

• Object lock: Object lock allows you to prevent objects from being deleted or overwritten for a specified amount of time or indefinitely. It is beneficial for compliance or regulatory reasons. Currently, enabling Object lock is possible only during the bucket creation. For more information, see Object Lock.

• Multi-part upload: Breaks down a single large object into smaller parts and uploads these objects to the bucket maximizing the upload speed. For more information, see Multi-part upload.

Folders

Folders, also known as Prefixes are containers that help to organize the objects within a bucket. You can create folders within a bucket and upload objects to folders. Object Storage offers a flat data structure instead of a hierarchy such as a file system. Hence, to support the organization of data in a well-structured way, the creation of Folders is allowed within a bucket. You can also create subfolders within a folder and upload objects to subfolders.

Emulating folders with prefixes

Unlike traditional file systems with nested folders, IONOS S3 Object Storage maintains a flat environment. There is no hierarchy of folders or directories. While the structure is flat, you can emulate folders using key naming conventions with slashes (/).

You can use prefix names that contain alphanumeric characters, dashes, and hyphens only.

Example: Instead of saving a report as Annual_Report_2023.pdf, using a key such as reports/2023/Annual_Report.pdf gives the semblance of a folder structure. These virtual folders through prefixes aid in logically grouping related objects.

Following are a few examples of using prefixes for objects to emulate folder structure:

• user_profiles/john_doe/avatar.jpg

• data/backups/June/backup.zip

The S3 (Simple Storage Services) API has been the global standard for object storage for many years. It provides interoperability and compatibility of various object storage systems that adhere to this standard. IONOS S3 Object Storage has one of the highest levels of S3 API support.

For more information, see IONOS S3 Object Storage API documentation.