Buckets

Using Object Storage with Atlas Buckets

Atlas Storage is S3-compatible, allowing you to use the AWS CLI for managing buckets and objects. You can also create and manage buckets via the Atlas Cloud web interface.

Accessing S3 from inside Atlas Cloud

Hosts and networks inside Atlas Cloud reach the object storage endpoint through a static hosts entry that maps s3.runatlas.is to 149.126.81.1. Add the entry on each host that needs bucket access.

Linux

Edit /etc/hosts as root:

echo "149.126.81.1  s3.runatlas.is" | sudo tee -a /etc/hosts

Windows

Open an editor as Administrator and edit C:\Windows\System32\drivers\etc\hosts, then add the line:

149.126.81.1  s3.runatlas.is

Then flush the DNS cache:

ipconfig /flushdns

Virtual-hosted addressing on static-mapped hosts

Virtual-hosted URLs use a per-bucket subdomain (your-bucket.s3.runatlas.is). A host that resolves the endpoint through a static mapping needs one entry per bucket pointing the subdomain at the same address:

echo "149.126.81.1  your-bucket.s3.runatlas.is" | sudo tee -a /etc/hosts

Removing the entry

To stop routing s3.runatlas.is through the static mapping, delete the line from the hosts file.

Via UI

Creating a Bucket

1. Log in to the Atlas Cloud Platform.
2. Navigate to the Storage section.
3. Click “Create Bucket”.
4. Enter a unique bucket name.
5. Set the quota (e.g., 1 GiB).
6. Choose access policy, Public for web hosting, Private for secure storage (default).
7. Click “OK”.

Uploading Files

1. In the bucket’s detail page, go to the “Browse” tab.
2. Click “Upload”.
3. Select files or folders from your local machine.
4. Confirm the upload.

Accessing Bucket Objects

Objects in public buckets are accessed directly over HTTPS using virtual-hosted addressing, where the bucket name is a subdomain of s3.runatlas.is:

https://your-bucket.s3.runatlas.is/object-key

Each bucket resolves to its own subdomain, so the browser treats every bucket as a separate origin and isolates hosted sites from one another. The *.s3.runatlas.is wildcard certificate covers these subdomains, so they serve over HTTPS with no extra client setup.¹

Bucket naming

Name buckets with lowercase letters, digits, and hyphens only. The *.s3.runatlas.is wildcard certificate matches exactly one subdomain label, so a name containing dots cannot be served over HTTPS with virtual-hosted addressing.

Setting Bucket Access

1. In the bucket’s detail page, go to the “Details” tab.
2. Edit the “Access Policy” (Public for web access, Private for secure storage).
3. Save changes.

Note: For fine-grained permissions, use bucket policies via CLI.

Generating Pre-signed URLs

Pre-signed URLs are not supported in the Atlas UI. Use the CLI method below.

Credentials

Each bucket exposes an access key and secret key on its “Details” tab (Storage > Buckets > “your bucket” > Details). Use these to authenticate the AWS CLI and other S3 clients.

The keys are scoped per account, not per bucket: every bucket created under the same account shares the same access key and secret key. To use separate credentials, create buckets in different accounts within the domain.

Via CLI

Prerequisites

• AWS CLI installed on your local machine.
• Access key and secret key from your bucket in Atlas Cloud (found in Storage > Buckets > “your bucket” > Details).

Alternatives to AWS CLI

The clients below point at the https://s3.runatlas.is endpoint.

s3cmd

s3cmd is another tool for S3-compatible storage. Download from s3tools.org/s3cmd.

• Configure: s3cmd --configure (enter access key, secret, endpoint)
• Upload: s3cmd put --recursive ./path/to/files s3://bucket/
• Sync: s3cmd sync ./path/to/files s3://bucket/

s5cmd

s5cmd is a fast alternative. Download from github.com/peak/s5cmd.

• Set env vars: export AWS_ACCESS_KEY_ID=... AWS_SECRET_ACCESS_KEY=... S3_ENDPOINT_URL=https://s3.runatlas.is
• Upload: s5cmd --endpoint-url https://s3.runatlas.is cp --recursive ./path/to/files s3://bucket/
• Sync: s5cmd --endpoint-url https://s3.runatlas.is sync ./path/to/files s3://bucket/

Configure AWS CLI

1. Open your terminal and configure the AWS CLI with your Atlas credentials:

   aws configure --profile atlas

   • AWS Access Key ID: Enter your bucket access key.
   • AWS Secret Access Key: Enter your bucket secret key.
   • Default region name: Leave blank.
   • Default output format: Leave blank or enter json.

2. Set the endpoint URL for Atlas Storage and select virtual-hosted addressing:

   aws configure set endpoint_url https://s3.runatlas.is --profile atlas
   aws configure set s3.addressing_style virtual --profile atlas

   Alternatively, you can manually edit the AWS config files:

   Example ~/.aws/config:

   [profile atlas]
   endpoint_url = https://s3.runatlas.is
   s3 =
       addressing_style = virtual

   Example ~/.aws/credentials:

   [atlas]
   aws_access_key_id = YOUR_ACCESS_KEY
   aws_secret_access_key = YOUR_SECRET_KEY

   Then run commands without --profile atlas or set the profile as an environment variable export AWS_PROFILE=atlas. Verify by listing your buckets:

   aws s3 ls --profile atlas

Creating a Bucket with aws CLI

To create a new bucket:

aws s3 mb s3://your-bucket-name --profile atlas

Uploading Files with aws CLI

To upload your static files to the bucket:

aws s3 cp ./path/to/your/static/files s3://your-bucket-name/ --recursive --profile atlas

Replace ./path/to/your/static/files with the path to your local static files directory, your-bucket-name with your bucket name.

To sync and update your files (uploads new/changed files, deletes removed ones):

aws s3 sync ./path/to/your/static/files s3://your-bucket-name/ --profile atlas

Setting Bucket Access with aws CLI

Buckets are private by default. To make objects publicly accessible, set a bucket policy (note "Effect": "Allow").

The policy below grants anonymous s3:GetObject on every object in the bucket (Principal: "*"), so every current object and anything uploaded later becomes world-readable. Apply it only to buckets dedicated to public assets. Keep private and state buckets private. To expose only part of a bucket, scope the Resource to a prefix, for example arn:aws:s3:::your-bucket-name/public/*:

aws s3api put-bucket-policy --bucket your-bucket-name --policy '{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::your-bucket-name/*"
    }
  ]
}' --profile atlas

To remove public access (make private):

aws s3api delete-bucket-policy --bucket your-bucket-name --profile atlas

Generating Pre-signed URLs with aws CLI

Create a temporary URL (expires in 1 hour by default):

aws s3 presign s3://your-bucket-name/path/to/file --expires-in 3600 --profile atlas

For more AWS CLI commands, refer to the AWS CLI S3 documentation.

Footnotes

1. Path-style requests, which carry the bucket in the URL path, are supported for compatibility but strongly discouraged. See AWS on the two addressing styles and the path-style deprecation plan. ↩