Concepts — S3 Buckets
Architecture
The Hikube Object Storage service is S3-compatible. Data is automatically replicated across 3 geographically distinct datacenters, which keeps it available even if an entire datacenter is lost.
Terminology
| Term | Description |
|---|---|
| Bucket | Object storage space created from the console (Infrastructure → S3 Buckets menu). |
| Bucket name (console) | Name chosen at creation. It identifies the bucket in the console and cannot be changed. |
| S3 Bucket Name | Actual name of the bucket on the S3 side, generated by the platform as bucket-<identifier>. This is the name your S3 clients must use: with the console name, they receive AccessDenied. It is displayed on the bucket page once the bucket has a user. |
| S3 Endpoint | Address of the S3 service (for example prod.s3.hikube.cloud), displayed on the bucket page. |
| S3 user | Identity attached to a bucket, with a Read-only or Read / Write permission. A bucket can have several users. |
| Access Key ID / Secret Access Key | A user's S3 authentication key pair, generated when the user is created. The secret key is displayed only once. |
| Locking (WORM) | Object Lock (Write Once, Read Many): each object is locked for 365 days after it is written, in COMPLIANCE mode; no one can modify or delete it before then. |
| Encryption at rest (LUKS) | Encryption of the data stored on disk. |
How it works
Creation
A bucket is created with the Create a bucket wizard. Only the name is required; two options can be enabled at creation:
- Enable Object Lock (WORM)
- Enable encryption at rest (LUKS)
The wizard also asks you to create at least one S3 user. At the end, the console displays, for each user, the S3 Bucket Name, the Access Key, the Secret Key and the API Endpoint (S3).
The name, locking and encryption are chosen at creation. The console does not let you change them afterwards.
Users and permissions
| Permission | Console label | Effect |
|---|---|---|
| Read / write | Read / Write | List, read, write and delete objects in the bucket |
| Read-only | Read-only | List and read objects only |
A user's permission can be changed at any time with Edit access, in both directions: unchecking Read-only access switches the user back to Read / Write. A user's keys cannot be displayed again: to get new keys, create a new user and then delete the old one.
Key scope
A user's keys give access only to the bucket the user is attached to. They do not allow listing all the buckets of the endpoint: commands must always target the bucket (s3://<s3-bucket-name>/).
Deletion
Deleting a bucket is confirmed by entering its name. What happens to the objects depends on locking:
| Bucket | Effect of the deletion |
|---|---|
| Without locking | The bucket and all its objects are permanently deleted, even if it is not empty. |
| Locked (WORM) | The bucket is removed from the console, but the platform keeps its storage and all its objects. Each object stays locked for 365 days after it was written (COMPLIANCE mode). |
The confirmation window states which case applies.
Multi-datacenter replication
| Datacenter | Location |
|---|---|
| Region 1 | Geneva |
| Region 2 | Gland |
| Region 3 | Lucerne |
Replication is transparent: there is nothing for you to configure.
Pricing
The wizard displays an Estimated Cost per GB per month (and per hour). The rate depends on encryption: an encrypted bucket uses a different rate from a standard bucket.
Compatible tools
| Tool | Use case |
|---|---|
| AWS CLI | Command-line file management |
| MinIO Client (mc) | S3-compatible client |
| rclone | Data synchronization and migration |
| s3cmd | Alternative S3 management |
| Velero | Kubernetes cluster backup |
| Restic | File and database backup |
| SDK | boto3 (Python), AWS SDK (Go, Java, Node.js) |
Limits
| Parameter | Value |
|---|---|
| Bucket name | 3 to 16 characters: lowercase letters, digits and hyphens; starts with a letter, ends with a letter or a digit |
| S3 username | 3 to 16 characters, same rules; some names are reserved |
| Users per bucket | At least one at creation |
| Replication | 3 datacenters, automatic |
Further reading
- Overview: service presentation
- Quick start: create your first bucket
- Manage users and access keys