Skip to main content
Live. This area is documented as current, user-reliable behavior.

​
Goal

Complete a safe first upload and download through the production S2 endpoint.

​
Prerequisites

  • A StackShift API token
  • AWS CLI v2 or another Signature V4-compatible client

​
Workflow

1
Create a private bucket with a unique lowercase name.
2
Store the returned secret access key immediately; it is not returned by later reads.
3
Export the returned endpoint, region, access key ID, and secret only in the current shell or a secret manager.
4
Upload, list, download, and delete a test object.
5
Remove the temporary local file and shell credentials when verification is complete.

​
Create through the control plane

The management API uses your StackShift bearer token. The returned S3 credentials are scoped to the created bucket and are separate from the bearer token.
Create a private bucket

​
Verify with the AWS CLI

Substitute values from the create response. Environment variables keep the example profile-free, but a production workload should load them from its secret manager.
Upload and read an object

​
Use prefixes as directories

  • Use predictable keys such as tenant-id/resource-id/filename when one application serves many customers.
  • List with prefix=customers/42/ to stay inside one logical directory.
  • Use delimiter=/ to ask S2 for immediate child prefixes instead of every nested object.
  • Do not rely on empty folders. A folder appears when at least one key uses its prefix unless you deliberately create a zero-byte marker object.

​
Expected result

The client can write and read an object through https://storage.stackshift.cloud using only the new bucket-scoped key.

​
Common failures

  • Dropping the secret from the create response. Create another bucket key and revoke the lost one; secrets cannot be read back.
  • Signing with a hard-coded AWS region instead of the region returned with the S2 credentials.
  • Using virtual-host-only client settings. Configure path-style access when the client does not infer it for a custom endpoint.
  • Calling an operation outside the documented S2 compatibility surface. S2 supports PUT, GET, HEAD, DELETE, ListObjectsV2, byte-range downloads, and multipart uploads; manage buckets and access keys through the StackShift API.

S2 object storage overview

Understand the S3-compatible S2 surface, its bucket model, security boundaries, data controls, and application workflows.

Access keys, encryption, isolation, and quotas

Operate S2 credentials, encryption, visibility, tenant isolation, request limits, and customer-plan quotas safely.

Manage S2 buckets with Terraform

Declare an S2 bucket, handle its one-time credentials, import existing buckets, and control destructive cleanup.