S3 API compatibility
Atlas Storage speaks the S3 API at https://s3.atlascloud.is. The endpoint supports virtual-host-style addressing (https://your-bucket.s3.atlascloud.is/object-key) as well as path-style, including presigned URLs in either style. AWS SDKs, the aws CLI and other S3 clients work against it with an endpoint override and nothing else. This page lists what the endpoint implements and where it differs from AWS S3, so you can check a dependency before building on it. For credentials and client setup, see Buckets.
The endpoint does not enforce the SigV4 signing region: requests authenticate with any region value in the credential scope, and with none configured at all. A tool that insists on a region setting works with us-east-1, the value AWS SDKs fall back to when only an endpoint is configured. Tools that validate region names against the AWS list, such as the Terraform S3 backend, additionally need their validation switched off; see Setting up Remote Terraform State.
✅ behaves exactly like AWS S3, including error responses · ⚠️ works, with the caveat in the third column · ❌ not implemented
Buckets
| Operation | Status | |
|---|---|---|
CreateBucket, DeleteBucket, ListBuckets, HeadBucket | ✅ | |
GetBucketLocation | ✅ | |
PutBucketPolicy, GetBucketPolicy, DeleteBucketPolicy | ✅ | Use the Bucket Policy to grant public read |
PutBucketAcl, GetBucketAcl | ✅ | |
PutBucketVersioning, GetBucketVersioning, ListObjectVersions | ✅ | |
PutBucketLifecycleConfiguration, GetBucketLifecycleConfiguration | ✅ | |
PutBucketTagging, GetBucketTagging | ✅ | |
PutBucketNotificationConfiguration | ✅ | |
PutBucketRequestPayment | ✅ | |
PutBucketCors, GetBucketCors | ✅ | Worked example in Buckets |
PutPublicAccessBlock | ✅ | |
PutBucketWebsite, GetBucketWebsite, DeleteBucketWebsite | ✅ | The configured site is served at https://<bucket>.sites.atlascloud.is, see Website hosting on a static S3 bucket |
Objects
| Operation | Status | |
|---|---|---|
PutObject, GetObject, HeadObject, DeleteObject, DeleteObjects | ✅ | |
CopyObject | ✅ | |
CreateMultipartUpload, UploadPart, UploadPartCopy, CompleteMultipartUpload, AbortMultipartUpload, ListMultipartUploads, ListParts | ✅ | |
ListObjectsV2, ListObjects, ListObjectVersions | ✅ | |
PutObjectAcl, GetObjectAcl | ✅ | |
PutObjectTagging, GetObjectTagging, DeleteObjectTagging | ✅ | |
POST Object | ✅ |
Request features
Headers and qualifiers that apply across operations rather than being operations themselves.
| Feature | Status | |
|---|---|---|
| Presigned URLs (SigV4 query auth) | ✅ | Sign for the URL’s addressing style (path-style or virtual-hosted); the host is part of the signature, so a URL signed for one style fails against the other |
x-amz-storage-class | ❌ | Only STANDARD exists; PutObject naming another class is rejected rather than falling back to STANDARD |
Conditional writes (If-Match, If-None-Match) | ✅ | On PutObject, DeleteObject and CopyObject, see below |
Upload checksums (Content-MD5, x-amz-checksum-*) | ⚠️ | A checksum value sent without its algorithm header is ignored instead of checked, see below |
| Server-side encryption | ⚠️ | SSE-C works; SSE-S3 and SSE-KMS return InvalidArgument, see below |
Differences worth knowing
Conditional writes
Conditional writes work as on AWS: If-Match guards PutObject, DeleteObject and CopyObject against a stale entity tag (412 Precondition Failed), and If-None-Match: * creates only when the key is absent.
Public access block
BlockPublicAcls, IgnorePublicAcls, BlockPublicPolicy, and RestrictPublicBuckets behave as on AWS. Buckets are private without a public access block, so control public exposure with a bucket policy.
Upload integrity
Content-MD5 is verified, and so are the x-amz-checksum-* headers the AWS SDKs and the aws CLI attach: a mismatch fails the upload with BadDigest. A client that supplies a precomputed checksum value on its own, without the x-amz-sdk-checksum-algorithm header naming the algorithm, has that value ignored rather than checked. Send the algorithm header alongside the value, or send Content-MD5.
Server-side encryption
SSE-C is supported: the client supplies its own AES-256 key on every request, and the object is unreadable without it. Atlas-managed encryption (SSE-S3, SSE-KMS) is not implemented; encrypt in your application where SSE-C does not fit.
Browser access
Reads of public objects work directly from browser script; writes need the bucket’s CORS rules to allow your origin and method. Setup and a copy-pasteable configuration are in Buckets.