Set up S3 credentials for Object Storage

Object Storage offers compatibility with the S3 protocol through credentials. Generate an access key and a secret key for any bucket that you own to allow specific operations for each access verified with the credential.

View as Markdown

Azion Object Storage offers compatibility with the S3 protocol through credentials. When you create a credential for any bucket that you own, you’ll get an access key and a secret key to set up permissions for operations. Access to your bucket through the S3 protocol will be verified using the credential.

The S3 protocol allows you to access buckets and objects using an Object Storage URL. This configuration facilitates file operations through command line interface (CLI) tools, such as s3cmd, database services, or functions.

Create a credential via API

  1. Run the following POST request in your terminal, replacing [TOKEN VALUE] with your personal token:
curl --request POST \
--url https://api.azion.com/v4/workspace/storage/credentials \
--header 'Accept: application/json' \
--header 'Authorization: Token [TOKEN VALUE]' \
--header 'Content-Type: application/json' \
--data {
"name": "full-access",
"capabilities": [
"listAllBucketNames",
"listBuckets",
"listFiles",
"readFiles",
"writeFiles",
"deleteFiles"
]
}
KeyDescription
nameDefines a string value as the name of the credential
capabilitiesAccepts a list of capabilities to allow the execution of operations
bucketOptional. Restricts the use of the credential to the specified bucket only
expiration_dateSets the time for the credential to expire. The datetime format must be in UTC ISO 8601 standard: YYYY-MM-DDT00:00:00Z
  1. You should receive a response similar to this:
{
"state": "executed",
"data": {
"name": "full-access",
"access_key": "<s3_credential_access_key>",
"secret_key": "<s3_credential_secret_key>", // this value can no longer be accessed in future requests
"capabilities": [
"listAllBucketNames",
"listBuckets",
"listFiles",
"readFiles",
"writeFiles",
"deleteFiles"
],
"bucket": null,
"expiration_date": null,
"last_editor": "editor@email.com",
"last_modified": "2025-11-05T19:55:31.542240Z"
}
}

The bucket field is optional. If it is not provided and the credential has the capabilities listAllBucketNames and listBuckets, it can be used to access all buckets in the account. However, if the bucket field is specified, access will be restricted to the indicated bucket.

  1. Copy the values of the access_key and secret_key to set up access through the S3 protocol.

Configure access to the bucket through s3cmd

s3cmd is a command line interface (CLI) tool for managing S3 and other cloud storage services. It can be used to manage objects on Object Storage and other S3-compatible storage services.

To use s3cmd to manage your Object Storage bucket, follow these steps:

  1. Download and install s3cmd package through the official website.
  2. Make sure s3cmd is added to your system’s PATH.
  3. Run s3cmd --configure and enter the access key and secret key.
  4. Enter the default region for the Object Storage region: us-east-005.
  5. Enter the endpoint URL for Object Storage: s3.us-east-005.azionstorage.net.
  6. Use the default DNS template: %(bucket).s3.us-east-005.azionstorage.net.
  7. Inform an encryption password and a path to GPG program if needed.

Gnu Privacy Guard (GPG) is a free and open-source encryption software that provides an additional layer cryptographic privacy and authentication for S3 protocol communication. See the GnuPG documentation for more information.

  1. Activate the HTTPS protocol by typing true.
  2. Inform HTTP proxy servers if needed.
  3. Press y to test access.

If your access and secret keys are correct, you should get the following success message:

Please wait, attempting to list all buckets...
Success. Your access key and secret key worked fine :-)

You can save your settings into an .s3cfg file if needed and modify them again using s3cmd --configure. Run the command s3cmd --help to see all available commands.

s3cmd commands to manage objects on Object Storage

Once you’ve configured access to the bucket through s3cmd, you can execute operations to manage your objects on Object Storage using the available commands.

ScopeDescription
s3cmd lsList all your buckets
s3cmd mb s3://my-new-bucket-nameCreate a new bucket. Bucket names must be unique and best practices for naming buckets include specifying what types of objects are stored and the type of permissions for the objects
s3cmd ls s3://my-new-bucket-nameList the contents of the bucket
s3cmd put file.xml s3://my-new-bucket-name/file.xmlUpload a file into the bucket
​​s3cmd get s3://my-new-bucket-name/file.xml file-2.xmlRetrieve the file back and verify that it hasn’t been corrupted
s3cmd del s3://my-new-bucket-name/addrbook.xml s3://my-new-bucket-name/storage.jpgDelete the object
s3cmd rb s3://logix.cz-testRemove the bucket. Only empty buckets can be removed

If any files were deleted within the last 24 hours from the specified bucket, attempting to delete the entire bucket would be blocked. It’s recommended to wait for at least 24 hours after deleting files before attempting to delete the entire bucket.

For more details on S3 protocol and s3cmd commands, check the official documentation. You can also visit the Object Storage reference.