---
title: "Configuring S3 after an update"
sidebar_label: "Configuring storage after an update"
description: "What needs to be done to continue working with S3 after it is updated"
sidebar_position: 1
---

import Formbricks from '@theme/MDXComponents/Formbricks'
import Tabs from '@theme/Tabs'
import TabItem from '@theme/TabItem'
import {CustomTable} from '@selectel/docux/components'
import TrashIcon from '@selectel/docux/icons/trash'
import CopyIcon from '@selectel/docux/icons/copy'
import {TabItemLabel} from '@selectel/docux/components'

# Configuring S3 after an update

:::warning

29.09.2023 a major S3 update was released. Previously created users, calls to [Swift API (old](/api/object-storage-swift-old/)) and [Object Storage API (old](/api/selectel-storage-old/)), etc., will stop working on 05.10.2027 at 11:00 (UTC+3). Some features will no longer be supported; see the [Unavailable functionality](#unavailable-features) section for more details.

We recommend using [S3 API](/api/object-storage-s3/). Update your storage settings in advance.

:::

If you had buckets created before the S3 update, [migrate them to a project](#transfer-bucket-to-project) to continue working with S3 in the Control panel.

The most significant changes in storage operation are:

* new authentication for all [storage APIs](/api/) and new access endpoints;
* a new [public bucket domain](/s3/manage/domains.mdx#bucket-public-domain) (a domain like `<uuid>.selstorage.ru`). This domain replaces the personal account domain (a domain like ` * ****.selcdn.ru`);
* moving S3 to [projects](/access-control/projects/about-projects.mdx);
* a new [access management](/s3/about/manage-access.mdx) model: full support for the role-based model and the introduction of bucket access policies;
* [unavailability of some legacy features](#unavailable-features).

## Migrate buckets to a project \{#transfer-bucket-to-project}

Without migrating to a [project](/access-control/projects/about-projects.mdx), you will not be able to work with the storage in the Control panel.

You can migrate your storage only once and as a whole (to one project). It is not possible to distribute old buckets across different projects. You will be able to create new buckets in different projects.

If you already have a project, you can migrate the buckets to it or create a new one.

<Tabs queryString="project">
  <TabItem value="existing" default>
    <TabItemLabel>
      To an existing project
    </TabItemLabel>

    1. In the [Control panel](https://my.selectel.ru/storage/), in the top menu, click **Products** and select **S3**. The first time you navigate to this section after 29.09.2023, a page for migrating buckets will open.
    2. Select **Use existing project**.
    3. Select the project you want to migrate your buckets to and click **Migrate**.
  </TabItem>

  <TabItem value="new">
    <TabItemLabel>
      To a new project
    </TabItemLabel>

    1. In the [Control panel](https://my.selectel.ru/storage/), in the top menu, click **Products** and select **S3**. The first time you navigate to this section after 29.09.2023, a page for migrating buckets will open.
    2. Select **Create new project**.
    3. Enter a project name and click **Migrate**.
  </TabItem>
</Tabs>

## Configure S3 \{#configure-s3}

1. [Configure storage access for users](#configure-storage-access-for-users).
2. [Configure the bucket policy](#configure-bucket-policy).
3. If you use API or FTP, [update your access keys and URLs](#update-access-keys-and-url).
4. If you use a CDN, [change the CDN resource](#edit-cdn-resource).
5. [Verify](#check-domains) that you have replaced the domains with the new ones.
6. [Delete legacy storage users](#delete-legacy-users).

### 1. Configure storage access for users \{#configure-storage-access-for-users}

S3 now supports [user types and roles](/access-control/access-management.mdx):

* S3 access via the control panel will be available to [panel users](/access-control/user-types.mdx#panel-users) whose role allows access to the entire account or project to which the buckets were moved;
* API access is provided via [service users](/access-control/user-types.mdx#service-users) instead of storage users (created in the **S3** →  **Users** section). Legacy users will continue to work and will be disabled later. It is no longer possible to create new users of this type.

[Add new users](/access-control/manage/add-user.mdx) in the **Panel Users** and **Service Users** sections.

For users with [`object_storage_user`](/access-control/role-reference.mdx#object-storage-user), [`s3.user`](/access-control/role-reference.mdx#s3-user), and [`s3.bucket.user`](/access-control/role-reference.mdx#s3-bucket-user) roles, access is determined solely by the access policy — if it is not configured, the user will not have access to the bucket. Learn more about how different storage roles work in the [Managing Access in S3](/s3/about/manage-access.mdx) guide.

### 2. Configure a bucket policy \{#configure-bucket-policy}

[You can create a bucket policy](/s3/buckets/bucket-policy/create-policy.mdx) via the Control panel. To create a bucket policy via API, use the [AWS S3 documentation](https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketPolicy.html).

When configuring a policy, consider access within the role-based model; for more details, see the [Managing Access in S3](/s3/about/manage-access.mdx).

Read more about bucket policies in the [Bucket policy](/s3/buckets/bucket-policy/) section.

### 3. Update access keys and URL \{#update-access-keys-and-url}

<Tabs queryString="api">
  <TabItem value="s3" default>
    <TabItemLabel>
      S3 API
    </TabItemLabel>

    Read more about authentication in the [S3 API documentation](/api/object-storage-s3/).

    1. [Issue an S3 key](/access-control/manage/edit-user-data-or-role.mdx#issue-s3-key) to a service user. You can also issue a key via the [IAM API](/api/users-and-roles/).
    2. In your requests, replace the URL and use the key to authenticate using the new scheme:

       * `AWS_ACCESS_KEY_ID` — the value of the **Access key** field from an [S3 key](/access-control/manage/edit-user-data-or-role.mdx#issue-s3-key);
       * `AWS_SECRET_KEY` — the value of the **Secret key** field from an [S3 key](/access-control/manage/edit-user-data-or-role.mdx#issue-s3-key);
       * `URL` — `s3.<pool>.storage.selcloud.ru`, where `<pool>` is the [pool](/infrastructure/locations.mdx#pool) where S3 is located (e.g., `ru-1`).
  </TabItem>

  <TabItem value="swift">
    <TabItemLabel>
      Swift API
    </TabItemLabel>

    Read more about authentication in the [Swift API documentation](/api/object-storage-swift/).

    1. For authentication, use the username and password of a [service user](/access-control/user-types.mdx).
    2. In your requests, replace the URL and the credentials:

       * `OS_USERNAME` — the service user username. You can view the username in the [Control panel](https://my.selectel.ru/iam/service-users): in the top menu, click **IAM** → **Service Users** section;
       * `OS_PASSWORD` — the service user password. If you have forgotten the password, [change it](/access-control/manage/edit-user-data-or-role.mdx#change-service-user-password);
       * `OS_AUTH_URL` — `https://cloud.api.selcloud.ru/identity/v3`;
       * `OS_TENANT_ID` — the [project](/access-control/projects/about-projects.mdx) ID; you can find it in the [control panel](https://my.selectel.ru/storage/): in the **S3** section, open the project menu (current project name) → in the required project row, click <CopyIcon />;
       * `URL` — `swift.<pool>.storage.selectel.org/v1/<project_id>`, where:

         * `<pool>` — the [pool](/infrastructure/locations.mdx#pool) where S3 is located (e.g., `ru-1`);
         * `<project_id>` — the [project](/access-control/projects/about-projects.mdx) ID.
  </TabItem>

  <TabItem value="ftp">
    <TabItemLabel>
      FTP
    </TabItemLabel>

    1. [Issue an S3 key](/access-control/manage/edit-user-data-or-role.mdx#issue-s3-key) to the service user. You can also issue a key via [IAM API](/api/users-and-roles/).
    2. Replace the URL with `ftp.<pool>.storage.selcloud.ru`, where `<pool>` is the [pool](/infrastructure/locations.mdx#pool) where S3 is located.
  </TabItem>
</Tabs>

### 4. Change the CDN resource \{#edit-cdn-resource}

If you use S3 as a content source for [CDN](/cdn/), change the CDN resource.

1. In the [control panel](https://my.selectel.ru/cdn-v3), on the top menu, click **Products** and select **CDN**.
2. In the **CDN Resources** section, open the CDN resource page → **Origin** tab.
3. In the **Domain** field, replace the specified domain with the [public bucket domain](/s3/manage/domains.mdx#bucket-public-domain) in the format `<uuid>.selstorage.ru`.
4. In the **Hostname** block, in the **Hostname when requesting origin** field, specify the public bucket domain without the protocol and port. By default, port 80 is used.

### 5. Check domains \{#check-domains}

Make sure you are using the new domains everywhere.

Learn more about domains in the [Domains in S3](/s3/manage/domains/) guide.

<CustomTable>
  <table>
    <thead>
      <tr>
        <th>Used for</th><th>Old domain</th><th>New domain</th>
      </tr>
    </thead>

    <tbody>
      <tr>
        <th>Public access</th><td>` *****.selcdn.ru`</td><td>`<uuid>.selstorage.ru`</td>
      </tr>

      <tr>
        <th>Swift API</th><td>`api.selcdn.ru`</td><td>`swift.<pool>.storage.selcloud.ru`</td>
      </tr>

      <tr>
        <th>S3 API</th>

        <td>
          * `s3.storage.selcloud.ru/<bucket_name>` (Path-Style)
          * `<bucket_name>.s3.storage.selcloud.ru` (Virtual Hosted)
        </td>

        <td>
          * `s3.<pool>.storage.selcloud.ru/<bucket_name>` (Path-Style)
          * `<bucket_name>.s3.<pool>.storage.selcloud.ru` (Virtual Hosted)
        </td>
      </tr>

      <tr>
        <th>FTP</th><td>`ftp.selcdn.ru`</td><td>`ftp.<pool>.storage.selcloud.ru`</td>
      </tr>

      <tr>
        <th>Domain for DNS records</th><td>` *****.selcdn.ru`</td><td>`access.<pool>.storage.selcloud.ru`</td>
      </tr>
    </tbody>
  </table>
</CustomTable>

### 6. Delete legacy storage users \{#delete-legacy-users}

1. In the [control panel](https://my.selectel.ru/storage/), on the top menu, click **Products** and select **S3**.
2. Go to the **Panel Users** section.
3. In the user card, click <TrashIcon /> → **Delete**.

## Unavailable features \{#unavailable-features}

Calls to [Swift API (old](/api/object-storage-swift-old/)) and [Object Storage API (old](/api/selectel-storage-old/)) methods will stop working on 05.10.2027 at 11:00 (UTC+3). Use alternative options in [S3 API](/api/object-storage-s3/), [Object Storage API](/api/object-storage/), or the control panel.

<Tabs queryString="unavailable-features">
  <TabItem value="swift-api-old" default>
    <TabItemLabel>
      Swift API (old)
    </TabItemLabel>

    <CustomTable>
      <table data-sticky>
        <thead>
          <tr>
            <th />

            <th>Unavailable features</th><th>Alternative</th>
          </tr>
        </thead>

        <tbody>
          <tr>
            <th rowspan="2">Authentication</th><td>Authorization via v1.0 protocol (`GET /auth/v1.0`, `X-Auth-User` and `X-Auth-Key` headers)</td><td rowspan="2">Use AWS Signature V4 or AWS Signature Version 2 and S3 keys in the [S3 API](/api/object-storage-s3/)</td>
          </tr>

          <tr>
            <td>Authorization via v2.0 protocol (`POST /v2.0/tokens`, `passwordCredentials`)</td>
          </tr>

          <tr>
            <th rowspan="2">Traffic statistics</th><td>Statistics on the volume of uploaded and downloaded data at the account and container level, response headers `X-Received-Bytes` and `X-Transfered-Bytes`</td><td rowspan="2">Get a [log](/s3/manage/logs.mdx) export via the control panel or [Object Storage API](/api/object-storage/)</td>
          </tr>

          <tr>
            <td>`rx_bytes` and `tx_bytes` fields in the JSON response when retrieving a list of containers</td>
          </tr>

          <tr>
            <th>Managing HTTP object headers</th>

            <td>
              * `Access-Control-Allow-Origin` — allowed source for cross-domain requests;
              * `Access-Control-Max-Age` — preflight request caching time;
              * `Access-Control-Allow-Methods` — allowed HTTP methods for CORS;
              * `Access-Control-Allow-Credentials` — permission to transmit credentials;
              * `Access-Control-Expose-Headers` — headers accessible to the client;
              * `Access-Control-Allow-Headers` — allowed request headers;
              * `Strict-Transport-Security` — forced HTTPS usage for the container
            </td>

            <td>Use [CORS](/s3/buckets/cors.mdx) in the control panel or via [S3 API](/api/object-storage-s3/) (Bucket CORS). CORS configuration is performed at the bucket level</td>
          </tr>

          <tr>
            <th>Domains</th><td>Public account domain `( * ****.selcdn.ru`) — domain with cached content distribution</td><td>Use [S3 API domains](/s3/manage/domains.mdx)</td>
          </tr>

          <tr>
            <th>Temporary download links</th><td>Generation of temporary signed links for downloading via HMAC-SHA1 (`temp_url_sig`, `temp_url_expires`, secret key via `X-Account-Meta-Temp-URL-Key` / `X-Container-Meta-Temp-URL-Key`)</td><td>Use Presigned URL in [S3 API](/api/object-storage-s3/), which uses a different signing mechanism (AWS Signature V4). Rewriting the code that uses TempURL will be required</td>
          </tr>

          <tr>
            <th rowspan="2">File query parameters</th><td>Query parameter `?filename=file_name` — forced file download by the browser instead of opening (header `Content-Disposition: attachment`)</td><td>✗</td>
          </tr>

          <tr>
            <td>XML response format when requesting a file list (`?format=xml`)</td><td>✗</td>
          </tr>
        </tbody>
      </table>
    </CustomTable>
  </TabItem>

  <TabItem value="object-storage-api-old">
    <TabItemLabel>
      Object Storage API (old)
    </TabItemLabel>

    <CustomTable>
      <table data-sticky>
        <thead>
          <tr>
            <th />

            <th>Unavailable features</th><th>Alternative</th>
          </tr>
        </thead>

        <tbody>
          <tr>
            <th>Cache</th><td>Storage cache clearing (`POST /v1/storage/purge`)</td><td>Manage [caching](/s3/manage/cache.mdx) in the control panel</td>
          </tr>

          <tr>
            <th>Bucket types</th><td>Creating a gallery-type bucket (`X-Container-Meta-Type: gallery`) — image demonstration in a gallery format</td><td>✗</td>
          </tr>

          <tr>
            <th rowspan="2">Download as archive</th><td>Downloading bucket contents as a ZIP archive (`?download-all-as-zip=archive_name`)</td><td>✗</td>
          </tr>

          <tr>
            <td>Download folder as ZIP archive</td><td>✗</td>
          </tr>

          <tr>
            <th>Unpacking archives</th><td>Automatic archive extraction (`.tar`, `.tar.gz`, `.gzip`) upon upload (`?extract-archive=tar.gz`)</td><td>✗</td>
          </tr>

          <tr>
            <th rowspan="2">Symbolic links</th><td>One-time symbolic links (`Content-Type: x-storage/onetime-symlink`)</td><td>✗</td>
          </tr>

          <tr>
            <td>Password protection for symbolic links (`x-storage/symlink+secure`, `x-storage/onetime-symlink+secure`, `X-Object-Meta-Link-Key` header with SHA1 password hash)</td><td>✗</td>
          </tr>

          <tr>
            <th>Temporary download links</th><td>Generation of temporary signed links for downloading via HMAC-SHA1 (`temp_url_sig`, `temp_url_expires`, secret key via `X-Account-Meta-Temp-URL-Key` / `X-Container-Meta-Temp-URL-Key`)</td><td>Use Presigned URL in [S3 API](/api/object-storage-s3/), which uses a different signing mechanism (AWS Signature V4). Rewriting the code that uses TempURL will be required</td>
          </tr>

          <tr>
            <th rowspan="2">Upload links for third-party users (Sendmefile)</th><td>Creating links for third-party file uploads (`PUT .../upload`, `Content-Type: x-storage/sendmefile+*`) with modes: `inplace`, `timepostfix`, `autopostfix`, `folderday`, `folderhour`, `folderuniq`</td><td rowspan="2">Use Presigned URL in [S3 API](/api/object-storage-s3/), which uses a different signing mechanism (AWS Signature V4)</td>
          </tr>

          <tr>
            <td>
              Sendmefile limitations:

              * maximum file size (`X-Object-Meta-Sendmefile-Max-Size`);
              * password (`X-Object-Meta-Sendmefile-Secret`);
              * overwrite permission (`X-Object-Meta-Sendmefile-Allow-Overwrite`);
              * web interface (`X-Object-Meta-Sendmefile-Disable-Web`)
            </td>
          </tr>

          <tr>
            <th>Versioning (legacy mechanism)</th><td>Versioning with explicit bucket specification for storing versions via `X-Versions-Location`</td><td>Use [versioning](/s3/buckets/versioning.mdx) in the control panel or via [S3 API](/api/object-storage-s3/) (`Bucket Versioning`)</td>
          </tr>

          <tr>
            <th rowspan="2">Special pages</th><td>Template parameters for the 404 error page: `{container}`, `{path}` — passing information about the originally requested file</td><td>[Configure error page](/s3/buckets/website.mdx#configure-error-page) in the control panel</td>
          </tr>

          <tr>
            <td>File listing sorting (`X-Container-Meta-Web-Listings-Sort`: `name_asc`, `name_desc`, `date_asc`, `date_desc`, `size_asc`, `size_desc`)</td><td>[Configure web listing](/s3/buckets/website.mdx#configure-weblisting) in the control panel</td>
          </tr>

          <tr>
            <th>Managing users via API</th>

            <td>
              * viewing user list (`GET /v1/users`);
              * adding a new user (`PUT /v1/users/{username}`) with settings: password, activity status, access rights (ACL for reading and writing containers), S3 password;
              * deleting a user (`DELETE /v1/users/{username}`);
              * changing the main user password (`POST /v1/users`)
            </td>

            <td>
              Use:

              * [access management](/s3/about/manage-access.mdx) (users) in the control panel or via [IAM API](/api/users-and-roles/);
              * managing [access policies](/s3/buckets/bucket-policy/) in the control panel or via [S3 API](/api/object-storage-s3/)
            </td>
          </tr>

          <tr>
            <th>Managing SSL certificates via API</th>

            <td>
              * retrieving a list of all certificates (`GET /v1/ssl`);
              * retrieving information about a specific certificate (`GET /v1/ssl/{cert}`);
              * adding a new certificate (`PUT /v1/ssl/{cert_name}`);
              * deleting a certificate (`DELETE /v1/ssl/{cert}`)
            </td>
          </tr>
        </tbody>
      </table>
    </CustomTable>
  </TabItem>
</Tabs>

<Formbricks />