FAQ — S3 Buckets
What is the Hikube S3 endpoint?
The endpoint is displayed on each bucket's page, in the Access & Configuration card, Endpoint field (for example prod.s3.hikube.cloud). It is also shown with the keys when a user is created.
Prefix it with https:// in your S3 clients.
Why is the bucket's S3 name different from the name I chose?
The name chosen in the console identifies the bucket in your project. The actual S3 name, of the form bucket-<identifier>, is generated by the platform to guarantee its uniqueness on the endpoint. Always use the Bucket name displayed in Access & Configuration in your commands and SDKs: with the name chosen in the console, an S3 client receives AccessDenied.
Which tools are compatible?
All tools compatible with the S3 API:
| Tool | Configuration |
|---|---|
| aws-cli | aws --endpoint-url https://<endpoint> s3 ls s3://<bucket>/ |
| mc (MinIO Client) | mc alias set hikube https://<endpoint> <access-key> <secret-key> |
| rclone | s3 type remote with the Hikube endpoint |
| s3cmd | host_base and host_bucket pointing to the Hikube endpoint |
| Velero | Kubernetes backup to Hikube S3 |
| Restic | File backup to Hikube S3 |
Any AWS S3-compatible library (boto3, aws-sdk-js, etc.) also works.
How do credentials work?
Credentials are attached to the bucket's S3 users. When created, each user receives an Access Key ID and a Secret Access Key, along with the bucket's S3 name and the endpoint. A bucket can have several users, each Read-only or Read / Write.
See Manage users and access keys.
I lost a user's secret key. What should I do?
The secret key is displayed only once and cannot be recovered. Create a new user (Add User button), update your applications, then delete the old user.
Can I have several buckets?
Yes. Create as many buckets as you need with Create a bucket. Each bucket has its own S3 name and its own users; the keys of one bucket do not give access to the others.
Can I list all my buckets with an S3 client?
No. A user's keys are limited to their bucket: aws s3 ls without a bucket name returns AccessDenied. The list of your buckets is visible in the console, on the Object Storage Buckets page.
What is locking (WORM) for?
The Enable Object Lock (WORM) option locks each object for 365 days after it is written. The platform applies this retention in COMPLIANCE mode: no one can modify or delete an object, or shorten its retention, before it expires. WORM retention is set by the platform: 365 days in COMPLIANCE mode. It cannot be changed, either at creation or afterwards. The option is used for regulatory archiving or to protect backups against accidental or malicious deletion. It is chosen when the bucket is created and cannot be removed afterwards. Deleting a locked bucket removes it from the console but does not delete its objects: they stay locked until their retention expires.
Can encryption be enabled afterwards?
No. Enable encryption at rest (LUKS) is chosen at creation and cannot be changed afterwards. To encrypt existing data, create a new encrypted bucket and copy the objects into it (for example with rclone sync or mc mirror).
How durable is the data?
Data is replicated across three datacenters (Geneva, Gland, Lucerne). This architecture maintains data availability and durability, even if an entire datacenter fails.
How is a bucket billed?
The creation wizard displays an Estimated Cost per GB per month (and per hour). The rate for an encrypted bucket is different from that of a standard bucket.