Public Objects

Objects are private by default: every request has to be signed with an access key of the bucket’s project. You can make an object or a bucket publicly readable with the usual S3 controls, such as the public-read canned ACL.

Public URLs Include a Tenant Prefix

Bucket names are unique within your organization, not across all of Nirvana, so two organizations can each have a bucket called my-bucket. An unsigned request doesn’t say whose bucket it means, so the URL of a publicly readable object names it with a tenant prefix ahead of the bucket name, separated by a colon:

https://s3.sva2.nirvanacloud.io/<tenant>:<bucket>/<key>

Use path-style URLs for public objects.

Private Access Is Unaffected

Signed requests don’t use the prefix. Clients configured with an access key, as in the Quickstart, address the bucket by its plain name, and the bucket’s url in the API is the plain path-style URL.

To share an object for a limited time without making it public, use a presigned URL instead. A presigned URL is signed with your access key, so it uses the plain bucket name:

aws s3 presign s3://my-bucket/report.pdf --expires-in 3600 \
  --endpoint-url https://s3.sva2.nirvanacloud.io --profile nirvana