Buckets

Using Object Storage with Atlas Buckets

Atlas Storage is S3-compatible, allowing you to use the AWS CLI for managing buckets and objects. You can also create and manage buckets via the Atlas Cloud web interface.

Administrator privileges

Listing, creating, updating, and deleting buckets requires the Atlas Admin role; Atlas User and Atlas ReadOnly accounts cannot see or manage buckets. See Create a new user for account roles and Credentials below for why.

S3 API Compatibility lists which S3 operations the endpoint implements and the points where its behaviour differs from AWS S3. Check it before writing application code against the API.

The endpoint at https://s3.atlascloud.is is the single access path, reached the same way from inside Atlas Cloud and from the internet.

Via UI

Creating a Bucket

1. Log in to the Atlas Cloud Platform.
2. Navigate to the Storage section.
3. Click “Create Bucket”.
4. Enter a unique bucket name.
5. Set the quota (e.g., 1 GiB).
6. Choose access policy, Public for web hosting, Private for secure storage (default).
7. Click “OK”.

Uploading Files

1. In the bucket’s detail page, go to the “Browse” tab.
2. Click “Upload”.
3. Select files or folders from your local machine.
4. Confirm the upload.

Accessing Bucket Objects

Objects in public buckets are accessed directly over HTTPS using virtual-hosted addressing, where the bucket name is a subdomain of s3.atlascloud.is:

https://your-bucket.s3.atlascloud.is/object-key

Each bucket resolves to its own subdomain, so the browser treats every bucket as a separate origin and isolates hosted sites from one another. The *.s3.atlascloud.is wildcard certificate covers these subdomains, so they serve over HTTPS with no extra client setup.¹

Bucket naming

Name buckets with lowercase letters, digits, and hyphens only. The *.s3.atlascloud.is wildcard certificate matches exactly one subdomain label, so a name containing dots cannot be served over HTTPS with virtual-hosted addressing.

Setting Bucket Access

1. In the bucket’s detail page, go to the “Details” tab.
2. Edit the “Access Policy” (Public for web access, Private for secure storage).
3. Save changes.

Note: For fine-grained permissions, use bucket policies via CLI.

Generating Pre-signed URLs

Generate a pre-signed URL from the bucket’s object view in the Atlas UI, or with the CLI as shown below.

Browser access and CORS

PutBucketCors stores a CORS configuration per bucket and GetBucketCors returns it. Browsers send an automatic OPTIONS request, called a preflight, before a cross-origin request; Atlas answers that preflight from the stored configuration, so browser uploads and deletes work once the bucket’s rules allow the origin and method.

Therefore we suggest reading public objects straight from the bucket subdomain. For writes from browser script, allow your origin in the bucket’s CORS rules and upload with presigned URLs generated in your own backend. That is where the access key belongs: one shipped to the browser is readable by every visitor.

To set the rules, save a cors.json naming your app’s origin:

{
  "CORSRules": [
    {
      "AllowedOrigins": ["https://app.example.com"],
      "AllowedMethods": ["GET", "PUT", "HEAD"],
      "AllowedHeaders": ["*"],
      "ExposeHeaders": ["ETag"]
    }
  ]
}

and apply it to the bucket:

aws s3api put-bucket-cors --bucket your-bucket-name --cors-configuration file://cors.json --profile atlas

Credentials

Each bucket exposes an access key and secret key on its “Details” tab (Storage > Buckets > “your bucket” > Details). Use these to authenticate the AWS CLI and other S3 clients.

The keys are scoped per account, not per bucket: every bucket created under the same account shares the same access key and secret key. To use separate credentials, create buckets in different accounts within the domain.

The same key and secret authenticate against every bucket in the account, so listing buckets exposes them and grants full read, write, and delete access account-wide. That is why bucket management is Atlas Admin only: Atlas User and Atlas ReadOnly accounts never see these keys.

Via CLI

Prerequisites

• AWS CLI installed on your local machine.
• Access key and secret key from your bucket in Atlas Cloud (found in Storage > Buckets > “your bucket” > Details).

Alternatives to AWS CLI

The clients below point at the https://s3.atlascloud.is endpoint.

s3cmd

s3cmd is another tool for S3-compatible storage. Download from s3tools.org/s3cmd.

• Configure: s3cmd --configure (enter access key, secret, endpoint)
• Upload: s3cmd put --recursive ./path/to/files s3://bucket/
• Sync: s3cmd sync ./path/to/files s3://bucket/

s5cmd

s5cmd is a fast alternative. Download from github.com/peak/s5cmd.

• Set env vars: export AWS_ACCESS_KEY_ID=... AWS_SECRET_ACCESS_KEY=... S3_ENDPOINT_URL=https://s3.atlascloud.is
• Upload: s5cmd --endpoint-url https://s3.atlascloud.is cp --recursive ./path/to/files s3://bucket/
• Sync: s5cmd --endpoint-url https://s3.atlascloud.is sync ./path/to/files s3://bucket/

Configure AWS CLI

1. Open your terminal and configure the AWS CLI with your Atlas credentials:

   aws configure --profile atlas

   • AWS Access Key ID: Enter your bucket access key.
   • AWS Secret Access Key: Enter your bucket secret key.
   • Default region name: Leave blank, or enter us-east-1 for a tool that requires one. The endpoint accepts any signing region; see S3 API Compatibility.
   • Default output format: Leave blank or enter json.

2. Set the endpoint URL for Atlas Storage and select virtual-hosted addressing:

   aws configure set endpoint_url https://s3.atlascloud.is --profile atlas
   aws configure set s3.addressing_style virtual --profile atlas

   Alternatively, you can manually edit the AWS config files:

   Example ~/.aws/config:

   [profile atlas]
   endpoint_url = https://s3.atlascloud.is
   s3 =
       addressing_style = virtual

   Example ~/.aws/credentials:

   [atlas]
   aws_access_key_id = YOUR_ACCESS_KEY
   aws_secret_access_key = YOUR_SECRET_KEY

   Then run commands without --profile atlas or set the profile as an environment variable export AWS_PROFILE=atlas. Verify by listing your buckets:

   aws s3 ls --profile atlas

Creating a Bucket with aws CLI

To create a new bucket:

aws s3 mb s3://your-bucket-name --profile atlas

Uploading Files with aws CLI

To upload your static files to the bucket:

aws s3 cp ./path/to/your/static/files s3://your-bucket-name/ --recursive --profile atlas

Replace ./path/to/your/static/files with the path to your local static files directory, your-bucket-name with your bucket name.

To sync and update your files (uploads new/changed files, deletes removed ones):

aws s3 sync ./path/to/your/static/files s3://your-bucket-name/ --profile atlas

Setting Bucket Access with aws CLI

Buckets are private by default. To make objects publicly accessible, set a bucket policy (note "Effect": "Allow").

The policy below grants anonymous s3:GetObject on every object in the bucket (Principal: "*"), so every current object and anything uploaded later becomes world-readable. Apply it only to buckets dedicated to public assets. Keep private and state buckets private. To expose only part of a bucket, scope the Resource to a prefix, for example arn:aws:s3:::your-bucket-name/public/*:

aws s3api put-bucket-policy --bucket your-bucket-name --policy '{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::your-bucket-name/*"
    }
  ]
}' --profile atlas

To remove public access (make private):

aws s3api delete-bucket-policy --bucket your-bucket-name --profile atlas

Generating Pre-signed URLs with aws CLI

Create a temporary URL (expires in 1 hour by default):

aws s3 presign s3://your-bucket-name/path/to/file --expires-in 3600 --profile atlas

For more AWS CLI commands, refer to the AWS CLI S3 documentation.

Hosting a static website

A public bucket with a website configuration serves a static site over HTTPS at https://<bucket>.sites.atlascloud.is/, with index and error documents and no server to run. Website hosting on a static S3 bucket walks through the whole flow, from upload to the live site.

Footnotes

1. Path-style requests, which carry the bucket in the URL path, are supported for compatibility but strongly discouraged. See AWS on the two addressing styles and the path-style deprecation plan. ↩