> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/ovh/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Object Storage

> Store and retrieve files at scale with S3-compatible object storage — ideal for backups, static assets, and data lakes.

OVHcloud Object Storage is a scalable, S3-compatible storage service that lets you store and retrieve any amount of data as objects organised into buckets. It is well suited to backups, static web assets, data lake ingestion, and media archives.

<CardGroup cols={2}>
  <Card title="Getting started" icon="rocket" href="/storage/object-storage#create-your-first-bucket">
    Create a bucket and upload your first objects in a few steps.
  </Card>

  <Card title="Lifecycle policies" icon="clock" href="/storage/object-storage#object-lifecycle-policies">
    Automatically expire or transition objects to reduce storage costs.
  </Card>

  <Card title="Access control" icon="lock" href="/storage/object-storage#bucket-acls-and-user-policies">
    Control who can read and write to your buckets.
  </Card>

  <Card title="Cold Archive" icon="archive" href="/storage/object-storage#cold-archive">
    Long-term, tape-based archival for rarely accessed data.
  </Card>
</CardGroup>

## Key concepts

### Buckets, objects, and access policies

An **object** is a file along with its metadata. Objects are stored inside **buckets**, which are flat namespaces identified by a globally unique name within a region.

By default, all buckets and objects are private — only the user account that creates a resource has access to it. You grant access through two mechanisms:

* **ACLs (Access Control Lists)**: attached directly to a bucket or individual object, granting basic read/write permissions to specific accounts or predefined groups.
* **User policies**: attached to a specific OVHcloud Public Cloud user via IAM, controlling that user's permissions across resources.

<Note>
  OVHcloud Object Storage supports the predefined groups `AllUsers` (anonymous/public), `AuthenticatedUsers` (all OVHcloud Public Cloud users), and `LogDelivery` (used for server access logging).
</Note>

### S3-compatible API

OVHcloud Object Storage is compatible with the S3 API. You can use any S3-compatible client, including the AWS CLI, rclone, s3cmd, or any S3 SDK, by pointing the endpoint at your OVHcloud region.

Endpoints follow this pattern:

```
https://s3.<region>.io.cloud.ovh.net/
```

For example, for the Roubaix (RBX) region:

```
https://s3.rbx.io.cloud.ovh.net/
```

<Note>
  OVHcloud offers two endpoint suffixes per region: `.io.cloud.ovh.net` (recommended, supports lifecycle rules) and `.perf.cloud.ovh.net` (legacy). Lifecycle policies are only available on the `.io` endpoint.
</Note>

***

## Create your first bucket

<Steps>
  <Step title="Create an Object Storage user">
    In the [OVHcloud Control Panel](https://www.ovh.com/manager/), go to **Public Cloud** and select your project. Navigate to **Object Storage** in the left menu, then to the **Object Storage users** tab. Create a user and save the **Access key** and **Secret key** displayed — you will need these to configure the AWS CLI.
  </Step>

  <Step title="Configure the AWS CLI">
    Install the AWS CLI, then run:

    ```bash theme={null}
    aws configure
    ```

    Enter your credentials and region. Then edit `~/.aws/config` to add the OVHcloud endpoint:

    ```ini theme={null}
    [default]
    region = rbx
    output = json
    services = ovh-rbx

    [services ovh-rbx]
    s3 =
      endpoint_url = https://s3.rbx.io.cloud.ovh.net/
      signature_version = s3v4

    s3api =
      endpoint_url = https://s3.rbx.io.cloud.ovh.net/
    ```

    And `~/.aws/credentials`:

    ```ini theme={null}
    [default]
    aws_access_key_id = <your_access_key>
    aws_secret_access_key = <your_secret_key>
    ```
  </Step>

  <Step title="Create a bucket">
    <CodeGroup>
      ```bash AWS CLI (s3) theme={null}
      aws s3 mb s3://my-bucket-name
      ```

      ```bash AWS CLI (s3api) theme={null}
      aws s3api create-bucket --bucket my-bucket-name
      ```
    </CodeGroup>

    Alternatively, from the Control Panel click **Create Object Container**, choose your offer (Standard, High Performance, etc.), select a deployment mode (1-AZ or 3-AZ), and pick a region.
  </Step>

  <Step title="Upload an object">
    <CodeGroup>
      ```bash Upload a file theme={null}
      aws s3 cp /path/to/file.txt s3://my-bucket-name/
      ```

      ```bash Upload and rename theme={null}
      aws s3 cp /path/to/file.txt s3://my-bucket-name/custom-name.txt
      ```
    </CodeGroup>

    <Note>
      `aws s3 cp` uses the STANDARD storage class by default. To upload to the High Performance tier, use `aws s3api put-object` with `--storage-class EXPRESS_ONEZONE`.
    </Note>
  </Step>

  <Step title="Verify the upload">
    <CodeGroup>
      ```bash List bucket contents theme={null}
      aws s3 ls s3://my-bucket-name/
      ```

      ```bash List all buckets theme={null}
      aws s3 ls
      ```
    </CodeGroup>
  </Step>
</Steps>

***

## Common S3 CLI operations

<CodeGroup>
  ```bash Download an object theme={null}
  aws s3 cp s3://my-bucket-name/file.txt .
  ```

  ```bash Sync a local directory to a bucket theme={null}
  aws s3 sync ./local-dir s3://my-bucket-name/
  ```

  ```bash Sync a bucket to a local directory theme={null}
  aws s3 sync s3://my-bucket-name/ ./local-dir
  ```

  ```bash Delete an object theme={null}
  aws s3 rm s3://my-bucket-name/file.txt
  ```

  ```bash Delete a bucket and all its contents theme={null}
  aws s3 rb s3://my-bucket-name --force
  ```
</CodeGroup>

***

## Bucket ACLs and user policies

By default, all resources are private. To make a bucket publicly readable, apply the `public-read` predefined ACL:

```bash theme={null}
aws s3api create-bucket --bucket my-bucket-name --acl public-read
```

To verify the ACL currently applied to a bucket:

```bash theme={null}
aws s3api get-bucket-acl --bucket my-bucket-name
```

To grant write permissions to a specific user in another OVHcloud Public Cloud account:

```bash theme={null}
aws s3api put-bucket-acl \
  --bucket my-bucket-name \
  --grant-write id=<project_name>:<user_name>
```

### Supported permissions

| Permission     | Bucket level                         | Object level                                |
| -------------- | ------------------------------------ | ------------------------------------------- |
| `READ`         | List all objects in the bucket       | Read an object and its metadata             |
| `WRITE`        | Create, delete, or overwrite objects | n/a                                         |
| `READ_ACP`     | Read the bucket ACL                  | Read the object ACL                         |
| `WRITE_ACP`    | Modify the bucket ACL                | Modify the object ACL                       |
| `FULL_CONTROL` | All of the above on the bucket       | READ + READ\_ACP + WRITE\_ACP on the object |

### Predefined ACLs

| ACL                  | Who gets access                                     |
| -------------------- | --------------------------------------------------- |
| `private`            | Owner only (default)                                |
| `public-read`        | Owner has full control; everyone can read           |
| `public-read-write`  | Owner has full control; everyone can read and write |
| `authenticated-read` | Owner has full control; all OVHcloud users can read |
| `log-delivery-write` | OVHcloud log delivery service can write             |

<Warning>
  ACLs and policies can be combined. The principle of least privilege always applies: access is denied unless there is an explicit allow and no explicit deny.
</Warning>

***

## Object lifecycle policies

Lifecycle rules let you automatically expire or transition objects to lower-cost storage tiers. Rules are applied asynchronously, typically within 24 hours.

### Apply a lifecycle configuration

Create a JSON file with your rules:

```json theme={null}
{
  "Rules": [
    {
      "ID": "expire-old-logs",
      "Status": "Enabled",
      "Filter": {
        "Prefix": "logs/"
      },
      "Expiration": {
        "Days": 30
      }
    }
  ]
}
```

Upload the configuration to your bucket:

```bash theme={null}
aws s3api put-bucket-lifecycle-configuration \
  --bucket my-bucket-name \
  --lifecycle-configuration file://lifecycle.json
```

### Transition objects between storage tiers

You can transition objects from a higher-cost tier to a lower-cost tier automatically. The minimum transition delay is 30 days.

```json theme={null}
{
  "Rules": [
    {
      "ID": "move-to-standard-after-30-days",
      "Status": "Enabled",
      "Filter": {},
      "Transitions": [
        {
          "Days": 30,
          "StorageClass": "STANDARD"
        }
      ]
    }
  ]
}
```

### Supported storage tier transitions

| From              | To High Performance | To Standard | To Infrequent Access | To Cold Archive |
| ----------------- | ------------------- | ----------- | -------------------- | --------------- |
| High Performance  | —                   | Yes         | Yes                  | Yes             |
| Standard          | No                  | —           | Yes                  | Yes             |
| Infrequent Access | No                  | No          | —                    | Yes             |

<Note>
  Objects smaller than 128 KB are not automatically transitioned. Use an `ObjectSizeGreaterThan` filter to explicitly include or exclude small objects.
</Note>

### Abort incomplete multipart uploads

Large file uploads that fail part-way through leave stored parts that accrue charges. Use a lifecycle rule to clean them up:

```json theme={null}
{
  "Rules": [
    {
      "ID": "abort-incomplete-mpus",
      "Status": "Enabled",
      "Filter": {},
      "AbortIncompleteMultipartUpload": {
        "DaysAfterInitiation": 7
      }
    }
  ]
}
```

***

## Cold Archive

Cold Archive is a storage class designed for long-term retention of rarely accessed data. It uses magnetic tape storage, providing:

* Durability of 99.999%
* Immutability by design (WORM — Write Once, Read Many)
* Data retrieval within 48 hours
* Minimum archival duration of 180 days

Cold Archive is accessible via the standard S3 API and can be used as a lifecycle destination. You can transition objects to the Cold Archive class directly from an existing Object Storage bucket using lifecycle rules, or upload objects directly into the Cold Archive storage class.

<Tip>
  Cold Archive is certified HDS and ISO 27001, making it suitable for healthcare, financial, and regulatory archiving workloads.
</Tip>

### Use cases

* Regulatory and compliance archiving
* Media asset preservation
* Scientific data storage
* Healthcare and financial record archiving

***

## Shared responsibility model

OVHcloud and you share responsibility for the Object Storage service.

| Responsibility                                     | You | OVHcloud |
| -------------------------------------------------- | --- | -------- |
| Choosing storage class and region                  | Yes |          |
| Managing access policies and ACLs                  | Yes |          |
| Configuring lifecycle rules                        | Yes |          |
| Encrypting data (SSE-C)                            | Yes |          |
| Maintaining physical infrastructure and hardware   |     | Yes      |
| Operating the S3-compatible control plane          |     | Yes      |
| Ensuring durability and replication of stored data |     | Yes      |
| Certifications (HDS, ISO 27001)                    |     | Yes      |

<Note>
  OVHcloud manages infrastructure durability and availability. You are responsible for access control, encryption choices, and data organisation within your buckets.
</Note>

***

## Related guides

<CardGroup cols={2}>
  <Card title="Block Storage" icon="hard-drive" href="/storage/block-storage">
    Attach persistent volumes to Public Cloud instances for databases and file systems.
  </Card>

  <Card title="vRack — Private Network" icon="network" href="/network/vrack">
    Connect Object Storage to other OVHcloud services over a private Layer 2 network.
  </Card>
</CardGroup>