Object storage buckets
Create S3-compatible application buckets with scoped credentials and independent retention.
Object buckets store application objects through a regional S3-compatible endpoint. They are separate from block volumes and from externally configured backup destinations.
Create a bucket
Open Storage → Object buckets in a project. Select a region, unique bucket name, encryption domain, and versioning policy. Names use lowercase DNS-compatible labels and must be available in that endpoint's namespace. Creation does not make objects public.
Infra returns the service endpoint, bucket ID, and region used for signed object requests. Use an S3 client with that endpoint and issued object-storage credentials. A control-plane bearer token is not an S3 access key.
Access and public objects
Use the object-credential operation to issue credentials for a named service account and restrict them to required buckets, prefixes, and operations. A bucket policy can narrow that authority. Read permission does not imply listing or deletion permission.
Public access is disabled by default. An explicit public policy requires organization approval where configured. A presigned URL grants its specified operation until expiry or credential revocation; it must be treated as a credential by the application generating and logging it.
Versions and cleanup
Enabling versioning retains previous object versions. Deleting the current object can create a delete marker while older versions continue consuming capacity. A lifecycle rule must address noncurrent versions separately when retention permits.
Multipart uploads can also retain data before an object is completed. Configure abandoned-upload cleanup without aborting transfers still owned by an active application or backup run.
Object locks and holds can block physical deletion. Removing an application, credential, or bucket policy does not remove those retention requirements.
Recovery and removal
Bucket redundancy is not an independent application backup. Configure permitted replication or export when a recovery plan requires another region or archive. The application must account for which versions were copied and when.
A nonempty bucket cannot be deleted through ordinary project cleanup. List current objects, versions, delete markers, retained uploads, and holds before removal. Use Object Storage API for management and backup destinations when a bucket is a recovery archive rather than an application data service.