Skip to content

Object Storage Quick Start Guide

Get connected to Infomaniak Ceph Object Storage in seconds.

1. Connect in 10 Seconds

Option A: Environment Variables

export AWS_ACCESS_KEY_ID="your_access_key"
export AWS_SECRET_ACCESS_KEY="your_secret_key"
export AWS_ENDPOINT_URL="https://s3.gva2.infomaniak.cloud"

Then test with AWS CLI: 

aws s3 ls s3://

Option B: Create a Configuration File

s3cmd: Create ~/.s3cfg_gva2: 

[default]
access_key = your_access_key
secret_key = your_secret_key
host_base = s3.gva2.infomaniak.cloud
host_bucket = %(bucket)s.s3.gva2.infomaniak.cloud
use_https = True

AWS CLI: Create profile: 

aws configure set aws_access_key_id your_access_key --profile infomaniak-s3aas
aws configure set aws_secret_access_key your_secret_key --profile infomaniak-s3aas
aws configure set endpoint_url https://s3.gva2.infomaniak.cloud --profile infomaniak-s3aas

Then use your client: 

# s3cmd
s3cmd -c ~/.s3cfg_gva2 ls s3://

# AWS CLI
aws s3 ls s3:// --profile infomaniak-s3aas

2. Public Buckets: Use Path-Style Only

Virtual-hosted style does NOT work for public access due to multi-tenancy isolation. You must use path-style URLs.

When a bucket is configured with a public-read policy, anonymous users must access it using the tenant prefix in the URL path.

Correct public URL format

https://s3.gva2.infomaniak.cloud/<tenant_id>:<bucket>/<object>

Example: 

https://s3.gva2.infomaniak.cloud/a580cdc8810649c8885a28192c4c4c4c:mybucket/testfile.txt

Setting a bucket public

Create a policy file public-read-policy.json: 

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "PublicReadGetObject",
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::mybucket/*"
    }
  ]
}

Apply with s3cmd: 

s3cmd -c ~/.s3cfg_gva2 setpolicy public-read-policy.json s3://mybucket

Apply with AWS CLI: 

aws s3api put-bucket-policy \
  --bucket mybucket \
  --policy file://public-read-policy.json \
  --endpoint-url https://s3.gva2.infomaniak.cloud

Generate a time-limited signed URL without making the bucket public.

With s3cmd: 

s3cmd -c ~/.s3cfg_gva2 signurl s3://mybucket/file.txt $(date -d '+1 hour' +%s)

With AWS CLI: 

aws s3 presign s3://mybucket/file.txt --expires 3600 --profile infomaniak-s3aas

This produces a URL like: 

https://s3.gva2.infomaniak.cloud/mybucket/file.txt?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=...

Pre-signed URLs carry the tenant context in the signature, so they work with both virtual-hosted and path-style access.

3. How Rate Limits Work (Token Bucket)

Each S3 frontend applies limits using a token bucket algorithm. Think of it as a bucket that starts full and receives a constant drip of new tokens.

The mechanism

  • Burst capacity: Your full minute-limit is available immediately.
  • Example: if max-read-ops = 4000, you can send 4000 GET requests in the first second.
  • Refill rate: The bucket refills at limit / 60 every second.
  • Example: 4000 / 60 ≈ 67 new tokens per second.
  • Blocking: If tokens are exhausted, you receive 503 SlowDown until the bucket refills.

Practical example

Scenario Result
Send 2000 requests in 2 seconds Pass – within the 4000 burst
Then send 50 requests/second Pass – 50 is below the 67/sec refill
Then send 500 requests/second Blocked after ~10 seconds – you drain faster than you refill

What is limited

Parameter Type Default per RGW Default cluster-wide (×24 RGW)
max-read-ops GET and HEAD requests 4 000/min 96 000/min (1 600/s)
max-write-ops PUT, POST, DELETE requests 4 000/min 96 000/min (1 600/s)
max-read-bytes Data downloaded 2,5 GB/min 60 GB/min (1 GB/s)
max-write-bytes Data uploaded 2,5 GB/min 60 GB/min (1 GB/s)

Important: Limits are per RGW daemon. With 24 RGWs, total cluster capacity is 24× the configured value.

Quick Summary

  1. Endpoint: https://s3.gva2.infomaniak.cloud
  2. Config: ~/.s3cfg_gva2 (s3cmd) or ~/.aws/credentials (AWS CLI)
  3. Public access (anonymous): https://<endpoint>/<tenant>:<bucket>/<object> (path-style)
  4. Presigned URL (temporary access): s3cmd signurl or aws s3 presign
  5. Rate limit: burst = full limit, then refill at limit/60 per second