Configuring S3 after an update

Last update: September 07 2026Open in Markdown

warning

29.09.2023 a major S3 update was released. Previously created users, calls to Swift API (old) and Object Storage API (old), etc., will stop working on 05.10.2027 at 11:00 (UTC+3). Some features will no longer be supported; see the Unavailable functionality section for more details.

We recommend using S3 API. Update your storage settings in advance.

If you had buckets created before the S3 update, migrate them to a project to continue working with S3 in the Control panel.

The most significant changes in storage operation are:

• new authentication for all storage APIs and new access endpoints;
• a new public bucket domain (a domain like <uuid>.selstorage.ru). This domain replaces the personal account domain (a domain like * ****.selcdn.ru);
• moving S3 to projects;
• a new access management model: full support for the role-based model and the introduction of bucket access policies;
• unavailability of some legacy features.

Migrate buckets to a project

Without migrating to a project, you will not be able to work with the storage in the Control panel.

You can migrate your storage only once and as a whole (to one project). It is not possible to distribute old buckets across different projects. You will be able to create new buckets in different projects.

If you already have a project, you can migrate the buckets to it or create a new one.

To an existing project

1. In the Control panel, in the top menu, click Products and select S3. The first time you navigate to this section after 29.09.2023, a page for migrating buckets will open.
2. Select Use existing project.
3. Select the project you want to migrate your buckets to and click Migrate.

To a new project

1. In the Control panel, in the top menu, click Products and select S3. The first time you navigate to this section after 29.09.2023, a page for migrating buckets will open.
2. Select Create new project.
3. Enter a project name and click Migrate.

Configure S3

1. Configure storage access for users.
2. Configure the bucket policy.
3. If you use API or FTP, update your access keys and URLs.
4. If you use a CDN, change the CDN resource.
5. Verify that you have replaced the domains with the new ones.
6. Delete legacy storage users.

1. Configure storage access for users

S3 now supports user types and roles:

• S3 access via the control panel will be available to panel users whose role allows access to the entire account or project to which the buckets were moved;
• API access is provided via service users instead of storage users (created in the S3 → Users section). Legacy users will continue to work and will be disabled later. It is no longer possible to create new users of this type.

Add new users in the Panel Users and Service Users sections.

For users with object_storage_user, s3.user, and s3.bucket.user roles, access is determined solely by the access policy — if it is not configured, the user will not have access to the bucket. Learn more about how different storage roles work in the Managing Access in S3 guide.

2. Configure a bucket policy

You can create a bucket policy via the Control panel. To create a bucket policy via API, use the AWS S3 documentation.

When configuring a policy, consider access within the role-based model; for more details, see the Managing Access in S3.

Read more about bucket policies in the Bucket policy section.

3. Update access keys and URL

S3 API

Read more about authentication in the S3 API documentation.

1. Issue an S3 key to a service user. You can also issue a key via the IAM API.

2. In your requests, replace the URL and use the key to authenticate using the new scheme:

   • AWS_ACCESS_KEY_ID — the value of the Access key field from an S3 key;
   • AWS_SECRET_KEY — the value of the Secret key field from an S3 key;
   • URL — s3.<pool>.storage.selcloud.ru, where <pool> is the pool where S3 is located (e.g., ru-1).

Swift API

Read more about authentication in the Swift API documentation.

1. For authentication, use the username and password of a service user.

2. In your requests, replace the URL and the credentials:

   • OS_USERNAME — the service user username. You can view the username in the Control panel: in the top menu, click IAM → Service Users section;

   • OS_PASSWORD — the service user password. If you have forgotten the password, change it;

   • OS_AUTH_URL — https://cloud.api.selcloud.ru/identity/v3;

   • OS_TENANT_ID — the project ID; you can find it in the control panel: in the S3 section, open the project menu (current project name) → in the required project row, click ;

   • URL — swift.<pool>.storage.selectel.org/v1/<project_id>, where:

     • <pool> — the pool where S3 is located (e.g., ru-1);
     • <project_id> — the project ID.

FTP

1. Issue an S3 key to the service user. You can also issue a key via IAM API.
2. Replace the URL with ftp.<pool>.storage.selcloud.ru, where <pool> is the pool where S3 is located.

4. Change the CDN resource

If you use S3 as a content source for CDN, change the CDN resource.

1. In the control panel, on the top menu, click Products and select CDN.
2. In the CDN Resources section, open the CDN resource page → Origin tab.
3. In the Domain field, replace the specified domain with the public bucket domain in the format <uuid>.selstorage.ru.
4. In the Hostname block, in the Hostname when requesting origin field, specify the public bucket domain without the protocol and port. By default, port 80 is used.

5. Check domains

Make sure you are using the new domains everywhere.

Learn more about domains in the Domains in S3 guide.

Used for	Old domain	New domain
Public access	*****.selcdn.ru	<uuid>.selstorage.ru
Swift API	api.selcdn.ru	swift.<pool>.storage.selcloud.ru
S3 API	s3.storage.selcloud.ru/<bucket_name> (Path-Style) <bucket_name>.s3.storage.selcloud.ru (Virtual Hosted)	s3.<pool>.storage.selcloud.ru/<bucket_name> (Path-Style) <bucket_name>.s3.<pool>.storage.selcloud.ru (Virtual Hosted)
FTP	ftp.selcdn.ru	ftp.<pool>.storage.selcloud.ru
Domain for DNS records	*****.selcdn.ru	access.<pool>.storage.selcloud.ru

6. Delete legacy storage users

1. In the control panel, on the top menu, click Products and select S3.
2. Go to the Panel Users section.
3. In the user card, click → Delete.

Unavailable features

Calls to Swift API (old) and Object Storage API (old) methods will stop working on 05.10.2027 at 11:00 (UTC+3). Use alternative options in S3 API, Object Storage API, or the control panel.

Swift API (old)

	Unavailable features	Alternative
Authentication	Authorization via v1.0 protocol (GET /auth/v1.0, X-Auth-User and X-Auth-Key headers)	Use AWS Signature V4 or AWS Signature Version 2 and S3 keys in the S3 API
	Authorization via v2.0 protocol (POST /v2.0/tokens, passwordCredentials)
Traffic statistics	Statistics on the volume of uploaded and downloaded data at the account and container level, response headers X-Received-Bytes and X-Transfered-Bytes	Get a log export via the control panel or Object Storage API
	rx_bytes and tx_bytes fields in the JSON response when retrieving a list of containers
Managing HTTP object headers	Access-Control-Allow-Origin — allowed source for cross-domain requests; Access-Control-Max-Age — preflight request caching time; Access-Control-Allow-Methods — allowed HTTP methods for CORS; Access-Control-Allow-Credentials — permission to transmit credentials; Access-Control-Expose-Headers — headers accessible to the client; Access-Control-Allow-Headers — allowed request headers; Strict-Transport-Security — forced HTTPS usage for the container	Use CORS in the control panel or via S3 API (Bucket CORS). CORS configuration is performed at the bucket level
Domains	Public account domain ( * ****.selcdn.ru) — domain with cached content distribution	Use S3 API domains
Temporary download links	Generation of temporary signed links for downloading via HMAC-SHA1 (temp_url_sig, temp_url_expires, secret key via X-Account-Meta-Temp-URL-Key / X-Container-Meta-Temp-URL-Key)	Use Presigned URL in S3 API, which uses a different signing mechanism (AWS Signature V4). Rewriting the code that uses TempURL will be required
File query parameters	Query parameter ?filename=file_name — forced file download by the browser instead of opening (header Content-Disposition: attachment)	✗
	XML response format when requesting a file list (?format=xml)	✗

Object Storage API (old)

	Unavailable features	Alternative
Cache	Storage cache clearing (POST /v1/storage/purge)	Manage caching in the control panel
Bucket types	Creating a gallery-type bucket (X-Container-Meta-Type: gallery) — image demonstration in a gallery format	✗
Download as archive	Downloading bucket contents as a ZIP archive (?download-all-as-zip=archive_name)	✗
	Download folder as ZIP archive	✗
Unpacking archives	Automatic archive extraction (.tar, .tar.gz, .gzip) upon upload (?extract-archive=tar.gz)	✗
Symbolic links	One-time symbolic links (Content-Type: x-storage/onetime-symlink)	✗
	Password protection for symbolic links (x-storage/symlink+secure, x-storage/onetime-symlink+secure, X-Object-Meta-Link-Key header with SHA1 password hash)	✗
Temporary download links	Generation of temporary signed links for downloading via HMAC-SHA1 (temp_url_sig, temp_url_expires, secret key via X-Account-Meta-Temp-URL-Key / X-Container-Meta-Temp-URL-Key)	Use Presigned URL in S3 API, which uses a different signing mechanism (AWS Signature V4). Rewriting the code that uses TempURL will be required
Upload links for third-party users (Sendmefile)	Creating links for third-party file uploads (PUT .../upload, Content-Type: x-storage/sendmefile+*) with modes: inplace, timepostfix, autopostfix, folderday, folderhour, folderuniq	Use Presigned URL in S3 API, which uses a different signing mechanism (AWS Signature V4)
	Sendmefile limitations: maximum file size (X-Object-Meta-Sendmefile-Max-Size); password (X-Object-Meta-Sendmefile-Secret); overwrite permission (X-Object-Meta-Sendmefile-Allow-Overwrite); web interface (X-Object-Meta-Sendmefile-Disable-Web)
Versioning (legacy mechanism)	Versioning with explicit bucket specification for storing versions via X-Versions-Location	Use versioning in the control panel or via S3 API (Bucket Versioning)
Special pages	Template parameters for the 404 error page: {container}, {path} — passing information about the originally requested file	Configure error page in the control panel
	File listing sorting (X-Container-Meta-Web-Listings-Sort: name_asc, name_desc, date_asc, date_desc, size_asc, size_desc)	Configure web listing in the control panel
Managing users via API	viewing user list (GET /v1/users); adding a new user (PUT /v1/users/{username}) with settings: password, activity status, access rights (ACL for reading and writing containers), S3 password; deleting a user (DELETE /v1/users/{username}); changing the main user password (POST /v1/users)	Use: access management (users) in the control panel or via IAM API; managing access policies in the control panel or via S3 API
Managing SSL certificates via API	retrieving a list of all certificates (GET /v1/ssl); retrieving information about a specific certificate (GET /v1/ssl/{cert}); adding a new certificate (PUT /v1/ssl/{cert_name}); deleting a certificate (DELETE /v1/ssl/{cert})