Bucket visibility and access
Understand private and public buckets, which roles can manage buckets, how signed upload and download links work, and when to rotate the Temp-URL key.
Who can read a bucket's objects depends on three things: the bucket's visibility, the roles of the people and tokens that use your project, and the signed links that the console and the API create for single objects.
Roles and API tokens
Your role's access to Block & Object Storage, on the subscription or the project, decides what you can do with buckets. Custom roles work the same way as the built-in roles in the examples:
| Access to Block & Object Storage | What you can do |
|---|---|
| Manage, as in the Owner and Contributor roles | Create, change, and delete buckets; upload and delete objects; rotate the Temp-URL key. |
| Read, as in the Reader role | View buckets and their settings, browse and refresh object listings, and download objects. |
| None, as in the Billing Operator role | No access to buckets. |
API tokens need the storage:read scope to read buckets and download objects, and the storage:write scope for every change. For example, a reporting job that only downloads files needs a token with storage:read alone. See Service accounts and API tokens.
Private and public buckets
You choose whether a bucket is private or public. A new bucket is private unless you choose otherwise.
- Private. The bucket's objects can be read only with access to your project, such as the console, the API, or a signed link.
- Public. Anyone on the internet can read every object in the bucket and list its contents, without credentials. Uploading and deleting still need access to your project.
For example, make a bucket public to serve the images of a public website, and keep everything else private.
Visibility applies to the whole bucket. You can't make a single object public.
Change a bucket's visibility
In the console, go to StorageObject Storage, and select the bucket's name.
At the top of the page, select Make public or Make private.
To make the bucket public, read the warning, and select Make public. Making a bucket private doesn't ask for confirmation.
The bucket's visibility changes at once in the console, and the object store applies it in the background. The bucket's Activity tab lists the change as an operation, with its result.
Through the API
To make a bucket public with PATCH/scopes/{scopeId}/storage/buckets/{bucketId}/policies, send "visibility": "Public" and, unless the bucket already has it, "blockPublicPolicy": false in the same request. A public visibility while blockPublicPolicy is on is refused with 409. The console sends both for you.
Signed links
A signed link is a URL that allows one action on one object: an upload (PUT) or a download (GET). It expires 15 minutes after it's created. A signed link needs no sign-in, so anyone who has it can use it until it expires. Treat it like a password.
- In the console. Every upload and download uses its own signed link. Your browser sends the data directly to or from the object store.
- Through the API. POST
/scopes/{scopeId}/storage/buckets/{bucketId}/uploadsreturns a signed upload link for a key, and POST/scopes/{scopeId}/storage/buckets/{bucketId}/exportsreturns a signed download link for an object in the bucket's listing. Each response states the link's expiry inexpiresAt. The upload request needsstorage:write; the download request needsstorage:read.
The console has no action to share a link to an object.
Signed links are signed with your project's Temp-URL key. The platform creates the key the first time it signs a link.
If the platform operator suspends your tenant, signed links stop working. After the operator reactivates the tenant, links that haven't expired yet work again.
Rotate the Temp-URL key
When a member leaves, rotate the key. Rotating it invalidates every signed link.
After a member is removed from your tenant, the Object Storage page shows a notice that advises you to rotate the key. To rotate the key:
In the console, go to StorageObject Storage.
In the notice, select Rotate key.
Read the confirmation, and select Rotate key.
Caution
Every signed link created with the current key — including links other members shared — stops working immediately. Links created in the console afterwards keep working. You can't bring the old key back.
Rotation replaces all of the project's Temp-URL keys with one new key. When the rotation succeeds, the notice disappears. With the Reader role, you see the notice without the button.
You can rotate the key at any time through POST/scopes/{scopeId}/storage/temp-url-key/actions/rotate.
Browser access from other origins
To let scripts on web pages from other origins call a bucket, add CORS rules that allow those origins. See Configure CORS rules.