S3 API compatibility of Cloider buckets
Cloider buckets implement the S3 REST API, so tools and SDKs written for Amazon S3 work with them once pointed at Cloider's endpoint. This page lists what is supported, what is handled by Cloider's own tools instead of the S3 API, what isn't offered, and the differences from Amazon S3 to keep in mind.
Connection
| Endpoint | https://s3.eu-central-2.cloider.com |
| Region | eu-central-2. Sign requests for this region |
| Protocol | HTTPS |
| Authentication | AWS Signature Version 4, in the Authorization header or as a presigned query string. Anonymous requests for downloads from public buckets |
| Addressing | Virtual hosted style (https://<bucket>.s3.eu-central-2.cloider.com/<key>) and path style (https://s3.eu-central-2.cloider.com/<bucket>/<key>) |
| Credentials | Access keys created in Cloider. AWS IAM users, roles, STS and session tokens don't exist on Cloider |
Supported S3 operations
These operations work with an access key that has the needed permission (read only keys can do the reading ones, read and write keys all of them):
| Area | Operations |
|---|---|
| Objects | PutObject, GetObject (including range requests), HeadObject, CopyObject, DeleteObject, DeleteObjects |
| Listing | ListObjectsV2, ListObjects, ListObjectVersions |
| Multipart uploads | CreateMultipartUpload, UploadPart, CompleteMultipartUpload, AbortMultipartUpload, ListMultipartUploads, ListParts |
| Object tags | PutObjectTagging, GetObjectTagging, DeleteObjectTagging |
| Object metadata | GetObjectAttributes, user metadata (x-amz-meta-*), Content-Type, Cache-Control, Content-Disposition, Content-Encoding |
| Versioning | GetBucketVersioning, PutBucketVersioning, and versionId on reads and deletes |
| Lifecycle | GetBucketLifecycleConfiguration, PutBucketLifecycleConfiguration, DeleteBucketLifecycle |
| CORS | GetBucketCors, PutBucketCors, DeleteBucketCors |
| Bucket | GetBucketLocation, HeadBucket |
| Presigned URLs | Presigned GET and PUT |
Versioning, lifecycle and CORS changes made through the S3 API show up in the dashboard and the CLI. Lifecycle rules that use options Cloider's tools don't show are kept until rules are saved from those tools, see Lifecycle rules. CORS rules set through the S3 API don't keep the dashboard's uploads working, see CORS.
Managed with Cloider's tools, not the S3 API
These are bucket level controls that access keys can't use. Manage them in the dashboard, with the cloider CLI, Terraform, the REST API or MCP:
| What | S3 operations that are refused | Cloider's way |
|---|---|---|
| Creating and deleting buckets | CreateBucket, DeleteBucket | Create a bucket, Delete a bucket |
| Public access | ACL and public access block operations | Public and private buckets |
| Bucket policies | PutBucketPolicy, GetBucketPolicy, DeleteBucketPolicy | Bucket policies |
| Credentials | IAM and STS | Access keys |
This keeps a leaked access key from making a bucket public, rewriting its policy or deleting it.
Not offered
| Feature | Notes |
|---|---|
| Object Lock, retention, legal hold | Not offered. See Data protection for alternatives |
| Storage classes and lifecycle transitions | Not available. Lifecycle rules delete data, they don't move it |
| Website configuration through the S3 API | S3 website calls such as PutBucketWebsite don't set up a website. Turn on a static website with Cloider's tools instead, and serve it on a domain with a target. Redirect and routing rules aren't offered |
| Default upload checksums of new AWS SDKs | Set checksum calculation to when_required, see below |
Differences from Amazon S3
Checksums with AWS tools from 2025
The AWS CLI from version 2.23 and AWS SDKs released since January 2025 add CRC checksums to every upload by default. Cloider's storage doesn't accept them, so set request_checksum_calculation = when_required and response_checksum_validation = when_required (or the environment variables AWS_REQUEST_CHECKSUM_CALCULATION and AWS_RESPONSE_CHECKSUM_VALIDATION). See Checksum errors on upload.
Bucket names
Bucket names follow Amazon's rules with two differences: dots aren't allowed, and the names are unique across Cloider rather than across AWS. See Choose a bucket name.
Object keys in Cloider's tools
S3 tools can use any valid S3 key. The dashboard, the cloider CLI and the REST API refuse keys that start with / or contain //, because different S3 clients turn those into different paths. Such keys created by S3 tools still exist, but are best avoided.
Single uploads up to 5 GB
As on Amazon S3, a single PutObject takes up to 5 GB. Larger files need a multipart upload, which the AWS CLI, rclone and the SDKs' upload managers do automatically.
Restoring versions with CopyObject
CopyObject with a versionId in the copy source can occasionally report success while the previous version stays current on a versioned bucket. To make an earlier version current, download it and upload it again (what the dashboard's Restore does), or check the result with ListObjectVersions. See Versioning.
CORS without rules
A bucket without CORS rules answers every website, where Amazon S3 refuses cross-origin requests. Rules narrow it down to the origins they list. See CORS.
Bucket policies
Policies use AWS's JSON, but principals are Cloider access key ids instead of IAM ARNs, Allow statements can only grant object actions, and a few condition keys aren't available. See the policy reference.
Tested tools
The examples in these docs cover:
- AWS CLI, rclone, s3cmd, MinIO client, Cyberduck and restic,
- the AWS SDKs for JavaScript, Python, Go, PHP, Java, Ruby and .NET,
- Terraform's
awsprovider for objects and thes3state backend, see Terraform state backend.
Frequently asked questions
Is Cloider fully compatible with Amazon S3?
Cloider buckets support the S3 operations applications use: objects, listing, multipart uploads, tags, versioning, lifecycle rules, CORS rules and presigned URLs, with Signature Version 4. Bucket creation, deletion, public access, policies and static websites are managed with Cloider's own tools instead of the S3 API, and object lock and storage classes aren't offered.
Does Cloider support path style S3 requests?
Yes. Both path style (https://s3.eu-central-2.cloider.com/<bucket>/<key>) and virtual hosted style (https://<bucket>.s3.eu-central-2.cloider.com/<key>) work.
Which signature version does Cloider use?
AWS Signature Version 4, in the Authorization header or as presigned URL query parameters, signed for the region eu-central-2.
Can I host a static website in a Cloider bucket?
Yes. Make the bucket public and turn on its static website in the dashboard, with cloider bucket website <bucket> on, or with Terraform. It is served at https://<bucket>.s3-website.eu-central-2.cloider.com with index and error documents, and a Bucket target serves it on your own domain. The website is set up with Cloider's tools, not with the S3 website API.