Skip to main content

S3 buckets

Beta

Being rolled out. The interface described here is the one of the next release: it may still change, and may not be enabled on your tenant yet.

A bucket stores your files (images, backups, exports) behind an S3-compatible API: every usual S3 tool works (AWS CLI, SDKs, rclone…). This guide shows how to declare a bucket, get keys, use it, and what happens when you delete it.

Prerequisites​

  • The sng CLI signed in (sng sso login) and a tenant session (sng tenant use acme).
  • The right to apply manifests (deploy:write, included in readwrite).

1. Pick a service level​

sng s3 classes

The command lists the storage classes and regions on offer. The two common classes:

ClassWhat you get
standardYour data is stored on one site.
multi-zoneYour data is copied across several sites of the region.

A bucket's region cannot be changed after creation.

2. Declare the bucket​

sng template gen VirtualBucket photos > photos.yml
photos.yml
apiVersion: s3.stackngo.io/v1alpha1
kind: VirtualBucket
metadata:
  name: photos
spec:
  storageClassName: multi-zone
  region: eu-west
sng apply photos.yml

The bucket's global name is <tenant>-photos (for example acme-photos). You can choose another with spec.bucketName; it must then be unique across the whole platform.

3. Get temporary keys​

There is no permanent access key: your session is exchanged for keys valid for one hour at most, renewed automatically by tools that support it.

~/.aws/config
[profile stackngo]
credential_process = sng s3 credentials
endpoint_url = https://s3.dev.stackngo.fr
region = eu-west
aws --profile stackngo s3 cp ./photo.jpg s3://acme-photos/2026/photo.jpg
aws --profile stackngo s3 ls s3://acme-photos/

For a tool without credential_process:

eval "$(sng s3 credentials --format env)"

--duration 15m to --duration 1h sets the keys' lifetime.

4. Manage permissions​

Permissions come from your tenant's policies: s3:read, s3:write, s3:delete and s3:list on bucket/<name> or on a prefix, bucket/<name>/<prefix>*. Without a policy, access is denied. A tenant never reaches another tenant's buckets.

5. Delete a bucket​

sng kind delete VirtualBucket photos
Deletion is permanent

Deleting the manifest also deletes every object in the bucket, with no recycle bin. The global name is then released. Removing the files can take a few minutes for a large bucket; copy what you want to keep first.

Limits​

  • The bucket is reachable path-style (https://s3.dev.stackngo.fr/acme-photos) or virtual-host style (https://acme-photos.s3.dev.stackngo.fr).
  • A bucket's region is immutable; to change it, create a new bucket and copy the data.

See also​