Frostmoln Docs

English

Svenska
Suomi
Norsk

English

Svenska
Suomi
Norsk

Appearance

Object Storage ​

Object storage provides S3-compatible buckets for files, backups, media, and static assets. Objects are stored on Ceph RGW, exclusively in the EU/EEA, and are reachable over the S3 API at https://s3.sweden.frostmoln.cloud (region sweden).

Create a bucket ​

Under Storage → Object Storage, create a bucket with a globally-unique name (3–63 chars, lowercase letters, numbers, hyphens). You can enable versioning and pick a storage class at creation.

bash
fm storage bucket create my-bucket --region sweden --versioning
fm storage bucket list
fm storage bucket delete my-bucket            # --force to delete a non-empty bucket
hcl
resource "frostmoln_bucket" "assets" {
  name       = "my-bucket"
  versioning = "enabled"
}

S3 access credentials ​

Object storage uses S3 access keys scoped to your tenant. Create a credential and you receive an Access Key ID and a Secret Key — the secret is shown once, so save it immediately.

bash
fm storage s3-credential create \
  --name app \
  --allowed-bucket my-bucket \
  --allowed-action s3:GetObject --allowed-action s3:PutObject \
  --ip 203.0.113.0/24

fm storage s3-credential list
fm storage s3-credential rotate <access-key-id>   # revokes the old key immediately
fm storage s3-credential delete <access-key-id>

Each credential can be scoped — and the limits are enforced server-side, not advisory:

  • Allowed buckets — restrict to specific buckets (empty = all your buckets).
  • Allowed actions — restrict to specific S3 actions (e.g. s3:GetObject, s3:PutObject, s3:ListBucket; empty = all).
  • Source IPs — restrict use to given CIDR ranges.
  • Expiry — optional automatic expiry.

Save the secret key

The Secret Key is returned only at creation (and on rotate). Store it in Secrets or a secret manager — never in source control. Rotating or deleting a credential revokes the old key immediately (no grace period).

Use it with any S3 client ​

Point any S3-compatible tool or SDK at the endpoint and region (SigV4):

bash
aws s3 ls --endpoint-url https://s3.sweden.frostmoln.cloud --region sweden s3://my-bucket/
aws s3 cp ./file.txt s3://my-bucket/ --endpoint-url https://s3.sweden.frostmoln.cloud --region sweden

rclone, s3cmd, mc, and the AWS SDKs all work the same way — multipart uploads, byte-range GETs, and object metadata are standard S3.

Features ​

  • Versioning — toggle per bucket; previous versions are retained and listable.
  • Presigned URLs — generate time-limited signed GET/PUT/DELETE links so a browser or client can transfer an object directly without holding credentials.
  • CORS — browser uploads from the portal work out of the box; custom CORS, object lifecycle rules, and static-website hosting are available through the S3 API for advanced use.

INFO

Buckets and their data stay within the selected EU/EEA region. The S3 API is the supported interface (Swift is not offered).