Skip to content

Object Storage (Ceph)

Note

This is the primary Infomaniak Object Storage platform. It is sometimes referred to as S3aaS internally.

Infomaniak's Ceph Object Storage provides native Amazon S3-compatible object storage built on the Ceph distributed storage platform. It offers high durability, scalability, and performance for unstructured data storage.

Features

  • Native S3 API: Full compatibility with AWS S3 SDK, CLI, and tools
  • Object Lock: WORM (Write Once Read Many) compliance with retention periods and legal holds
  • Multipart Upload: Supports large object uploads via multipart API
  • Public Buckets: Bucket-level access policies for anonymous read access
  • Multi-Region: Available in multiple geographic regions
  • High Performance: Optimized for high-throughput workloads
  • Multi-Tenancy: Isolated tenant namespaces with Keystone authentication
  • Server-Side Encryption: SSE-C with customer-provided keys
  • Versioning: Object versioning with full lifecycle management
  • CORS: Cross-origin resource sharing for web applications
  • Lifecycle Policies: Automated object expiration and cleanup
  • Requester Pays: Cross-tenant cost attribution

Architecture

Our Ceph Object Storage is built on a cluster of RadosGW (RGW) daemons fronting Ceph OSDs (Object Storage Daemons). Each region runs multiple RGWs for load balancing and high availability.

Region Endpoint
gva1 (Geneva Datacenter 3) s3.gva1.infomaniak.cloud
gva2 (Geneva Datacenter 4) s3.gva2.infomaniak.cloud

Multi-site Replication

Data can be replicated across multiple sites using Ceph's native multi-site synchronization for disaster recovery.

Direct access to replicated data is not possible. Replicated data will be served only if the primary zone fails.

Authentication

Ceph Object Storage uses Keystone for authentication. Each tenant (project) has its own isolated namespace.

See the Authentication page for:

  • Obtaining Keystone tokens via CLI and curl
  • Getting your user ID and project ID
  • Creating EC2 credentials (S3 access keys)
  • Token expiration and application credentials

Obtaining Credentials

Create a Public Cloud project to obtain your credentials, then follow the instructions in the Object Storage product manager. You will obtain:

  • Access Key ID
  • Secret Access Key
  • Tenant ID (for public URL construction)
  • Endpoint URL (e.g., https://s3.gva2.infomaniak.cloud)

Endpoints

Region Endpoint Protocols
gva1 https://s3.gva1.infomaniak.cloud HTTPS (443)
gva2 https://s3.gva2.infomaniak.cloud HTTPS (443)

For anonymous public access, you must include the tenant ID in the URL path using the tenant:bucket syntax. e.g., https://<endpoint>/<tenant>:<bucket>/<object> (path-style)

Limitations & Notes

  • DNS wildcard: Endpoints support wildcard SSL certificates for virtual-hosted style access (*.s3.gva2.infomaniak.cloud)
  • Tenanted buckets: All buckets are created within a tenant namespace
  • Object Lock: Once enabled on a bucket, it cannot be disabled
  • Rate limits: see Quick Start for details

Compatible Tools

Any S3-compatible tool works with Infomaniak Ceph Object Storage:

  • AWS CLI v2
  • s3cmd
  • Rclone
  • Cyberduck
  • S3 Browser
  • And any SDK (boto3, AWS SDK for Java/Go/JS, etc.)