Configuring S3 after an update

Last update: June 09 2026

warning

A major S3 update was released on 29.09.2023. Previously created users, Swift API (old) and Object Storage API (old) method calls, etc. will stop working on 15.09.2026. Some features will no longer be supported; see the Unavailable functionality subsection for more details.

We recommend using S3 API. Change your storage settings in advance.

If you had buckets created before the S3 update, migrate them to a project to continue working with S3 in the Control panel.

The most significant changes in storage operation are:

• new authentication for all storage APIs and new access endpoints;
• a new public bucket domain (a domain like <uuid>.selstorage.ru). This domain replaces the personal account domain (a domain like * ****.selcdn.ru);
• moving S3 to projects;
• a new access management model: full support for the role-based model and the introduction of bucket policies;
• unavailability of some legacy features.

Migrate buckets to a project

Without migrating to a project, you will not be able to work with the storage in the Control panel.

You can migrate your storage only once and as a whole (to one project). It is not possible to distribute old buckets across different projects. You will be able to create new buckets in different projects.

If you already have a project, you can migrate the buckets to it or create a new one.

To an existing project

1. In the Control panel, in the top menu, click Products and select S3. The first time you navigate to this section after 29.09.2023, a page for migrating buckets will open.
2. Select Use existing project.
3. Select the project you want to migrate your buckets to and click Migrate.

To a new project

1. In the Control panel, in the top menu, click Products and select S3. The first time you navigate to this section after 29.09.2023, a page for migrating buckets will open.
2. Select Create new project.
3. Enter a project name and click Migrate.

Configure S3

1. Configure storage access for users.
2. Configure the bucket policy.
3. If you use API or FTP, update your access keys and URLs.
4. If you use a CDN, change the CDN resource.
5. Verify that you have replaced the domains with the new ones.
6. Delete legacy storage users.

1. Configure storage access for users

S3 now supports user types and roles:

• access to S3 via the Control panel is granted to users whose role allows access to the entire account or the project to which the buckets were migrated;
• API access is provided via service users instead of storage users (created in the S3 → Users section). Legacy users will continue to work and will be disabled later. It is no longer possible to create new users of this type.

You can add new users in the Users and Service Users sections.

For users with object_storage_user, s3.user and s3.bucket.user roles, access is determined solely by the access policy — if it is not configured, the user will not have access to the bucket. Learn more about how different storage roles work in the Manage Access to S3 guide.

2. Configure a bucket policy

You can create a bucket policy via the Control panel. To create a bucket policy via API, use the AWS S3 documentation.

When configuring a policy, take into account access levels within the role-based model; read more in the Managing Access to S3 guide.

Read more about bucket policies in the Bucket policy section.

3. Update access keys and URL

S3 API

Read more about authentication in the S3 API documentation.

1. Issue an S3 key to a service user. You can also issue a key via the IAM API.

2. In your requests, replace the URL and use the key to authenticate using the new scheme:

   • AWS_ACCESS_KEY_ID — the value of the Access key field from the S3 key;
   • AWS_SECRET_KEY — the value of the Secret key field from the S3 key;
   • URL — s3.<pool>.storage.selcloud.ru, where <pool> is the pool where S3 is located (e.g., ru-1).

Swift API

Read more about authentication in the Swift API documentation.

1. For authentication, use the username and password of a service user.

2. In your requests, replace the URL and the credentials:

   • OS_USERNAME — the service user username. You can view the username in the Control panel: in the top menu, click IAM → Service Users section;

   • OS_PASSWORD — the service user password. If you have forgotten the password, change it;

   • OS_AUTH_URL — https://cloud.api.selcloud.ru/identity/v3;

   • OS_TENANT_ID — the project ID; you can view it in the Control panel: in the S3 section, open the project menu (name of the current project) → in the required project row, click ;

   • URL — swift.<pool>.storage.selectel.org/v1/<project_id>, where:

     • <pool> — the pool where S3 is located (e.g., ru-1);
     • <project_id> — the project ID.

FTP

1. Issue an S3 key to a service user. You can also issue a key via the IAM API.
2. Replace the URL with ftp.<pool>.storage.selcloud.ru, where <pool> is the pool where S3 is located.

4. Change the CDN resource

If you use S3 as an origin for a CDN, change the CDN resource.

1. In the Control panel, click Products in the top menu and select CDN.
2. In the CDN resources section, open the CDN resource page → Origin tab.
3. In the Domain field, replace the specified domain with the public bucket domain as <uuid>.selstorage.ru.
4. In the Hostname block, in the Hostname when requesting origin field, specify the public bucket domain without the protocol and port. Port 80 is used by default.

5. Check domains

Make sure you are using the new domains everywhere.

Read more about domains in the Domains in S3 guide.

Used for	Old domain	New domain
Public access	*****.selcdn.ru	<uuid>.selstorage.ru
Swift API	api.selcdn.ru	swift.<pool>.storage.selcloud.ru
S3 API	s3.storage.selcloud.ru/<bucket_name> (Path-Style) <bucket_name>.s3.storage.selcloud.ru (Virtual Hosted)	s3.<pool>.storage.selcloud.ru/<bucket_name> (Path-Style) <bucket_name>.s3.<pool>.storage.selcloud.ru (Virtual Hosted)
FTP	ftp.selcdn.ru	ftp.<pool>.storage.selcloud.ru
Domain for DNS records	*****.selcdn.ru	access.<pool>.storage.selcloud.ru

6. Delete legacy storage users

1. In the Control panel, click Products in the top menu and select S3.
2. Go to the Users section.
3. In the user card, click → Delete.

Unavailable features

Swift API (old) and Object Storage API (old) method calls will stop working on 09/15/2026. Use alternative options in S3 API, Object Storage API or the Control Panel.

Swift API (old)

	Unavailable features	Alternative
Authentication	V1 protocol authorization (GET /auth/v1.0, X-Auth-User and X-Auth-Key headers)	Use AWS Signature V4 or AWS Signature Version 2 signatures and S3 keys in the S3 API
	V2 protocol authorization (POST /v2.0/tokens, passwordCredentials)
Traffic statistics	Volume statistics for uploaded and downloaded data at the account and container level, X-Received-Bytes and X-Transfered-Bytes response headers	Get an export of logs via the Control panel or Object Storage API
	rx_bytes and tx_bytes fields in the JSON response when retrieving a list of containers
Managing HTTP object headers	Access-Control-Allow-Origin — an allowed origin for cross-domain requests; Access-Control-Max-Age — preflight request caching time; Access-Control-Allow-Methods — allowed HTTP methods for CORS; Access-Control-Allow-Credentials — permission to transmit credentials; Access-Control-Expose-Headers — headers available to the client; Access-Control-Allow-Headers — allowed headers in the request; Strict-Transport-Security — forced HTTPS usage for the container	Use CORS in the Control panel or via the S3 API (Bucket CORS). CORS configuration is performed at the bucket level
Domains	Public account domain ( * ****.selcdn.ru) — a domain with caching of the distributed content	Use S3 API domains
Temporary download links	Generation of temporary signed download links via HMAC-SHA1 (temp_url_sig, temp_url_expires, secret key via X-Account-Meta-Temp-URL-Key / X-Container-Meta-Temp-URL-Key)	Use Presigned URLs in the S3 API, which uses a different signature mechanism (AWS Signature V4). Code that uses TempURL will need to be refactored
File query parameters	?filename=file_name query parameter — forced browser file download instead of opening (Content-Disposition: attachment) header	✗
	XML response format when requesting a file list (?format=xml)	✗

Object Storage API (old)

	Unavailable features	Alternative
Cache	Storage cache purging (POST /v1/storage/purge)	Manage caching in the Control panel
Bucket types	Creating a gallery-type bucket (X-Container-Meta-Type: gallery) — displaying images as a gallery	✗
Download as archive	Downloading bucket content as a ZIP archive (?download-all-as-zip=archive_name)	✗
	Download folder as ZIP archive	✗
Unpacking archives	Automatic archive unpacking (.tar, .tar.gz, .gzip) upon upload (?extract-archive=tar.gz)	✗
Symbolic links	One-time symbolic links (Content-Type: x-storage/onetime-symlink)	✗
	Symbolic link password protection (x-storage/symlink+secure, x-storage/onetime-symlink+secure, X-Object-Meta-Link-Key header with SHA1 hash of the password)	✗
Temporary download links	Generation of temporary signed download links via HMAC-SHA1 (temp_url_sig, temp_url_expires, secret key via X-Account-Meta-Temp-URL-Key / X-Container-Meta-Temp-URL-Key)	Use Presigned URLs in the S3 API, which uses a different signature mechanism (AWS Signature V4). Code that uses TempURL will need to be refactored
Upload links for third-party users (Sendmefile)	Creating upload links for third-party users (PUT .../upload, Content-Type: x-storage/sendmefile+*) with settings: inplace, timepostfix, autopostfix, folderday, folderhour, folderuniq	Use Presigned URLs in the S3 API, which uses a different signature mechanism (AWS Signature V4)
	Sendmefile limitations: maximum file size (X-Object-Meta-Sendmefile-Max-Size); password (X-Object-Meta-Sendmefile-Secret); overwrite permission (X-Object-Meta-Sendmefile-Allow-Overwrite); web interface (X-Object-Meta-Sendmefile-Disable-Web)
Versioning (legacy mechanism)	Versioning with an explicit bucket specification for version storage via X-Versions-Location	Use versioning in the Control panel or via the S3 API (Bucket Versioning)
Special pages	Template parameters for the 404 error page: {container}, {path} — information transfer about the initially requested file	Configure the error page in the Control panel
	File listing sorting (X-Container-Meta-Web-Listings-Sort: name_asc, name_desc, date_asc, date_desc, size_asc, size_desc)	Configure web listing in the Control panel
Managing users via API	view user list (GET /v1/users); adding a new user (PUT /v1/users/{username}) with settings: password, status, access rights (ACL for reading/writing containers), S3 password; deleting a user (DELETE /v1/users/{username}); changing the main user password (POST /v1/users)	Use: Access management (users) in the Control panel or via the IAM API; manage access policies in the Control panel or via the S3 API
Managing SSL certificates via API	retrieve a list of all certificates (GET /v1/ssl); retrieve info about a specific certificate (GET /v1/ssl/{cert}); adding a new certificate (PUT /v1/ssl/{cert_name}); deleting a certificate (DELETE /v1/ssl/{cert})