Clusterward creates Scaleway buckets, mints a dedicated IAM key per application with a matching bucket policy and copies existing S3 buckets into them. Only empty buckets are ever deleted.
Object Storage in Clusterward is the management of Scaleway S3 buckets from the cockpit. A provider is a Scaleway project, registered by its IAM key; the key determines which project buckets are created in. Buckets are created as private or public and, on request, get a dedicated IAM key consisting of an IAM application, a project policy and an API key. The bucket policy admits exactly that application and, for public buckets, anonymous reads. One key can serve several buckets of the same application.
Enter the project’s IAM key; Clusterward verifies it with ListBuckets and detects the project and organization.
Choose name, region and visibility. An existing bucket is never silently taken over.
A new dedicated key or an existing one of the same application.
Bucket policy with the application, the provider principal and, optionally, anonymous reads.
Copy access key, secret key, endpoint and region in the cockpit.
The IAM details that easily go wrong on Scaleway are solved properly here, once.
The IAM key is verified via ListBuckets before saving, stored encrypted and never displayed. Clusterward detects the project, organization and principal via the IAM API.
IAM application, policy and API key are created together. One key serves both the public and the private bucket of the same application.
Scaleway needs both sides: an IAM policy and a bucket policy. The policy names the application, the provider and your console users – otherwise the Files tab stays empty.
A public bucket gets the public-read ACL and anonymous reads in its policy. Visibility is set at creation.
Copy objects from an external S3 bucket under a prefix into a bucket of your own, with progress and cancellation. Copy and overwrite, never delete.
During tenant offboarding, a bucket that still holds data is uploaded as a ZIP to your backup bucket and only then emptied. Without a confirmed archive, it stays in place.
Signed requests straight to the Scaleway endpoints, tested against the AWS test vectors.
Applications, policies and API keys via the IAM API.
Version 2023-04-17, with a console access statement for your users.
Objects are copied as a stream, Content-Type included.
The import runs in the Clusterward service because Object Storage is publicly reachable. The limits keep it predictable.
| Limit | Value | Behavior |
|---|---|---|
| Single object | up to 5 TB | Over 2 GiB copied in parts, with progress per part |
| Total volume | approx. 20 GiB per run | Above that, the run is rejected before it starts |
| Object count | approx. 50,000 per run | Above that, the run is rejected before it starts |
| Parallelism | 2 copies at a time | Additional runs wait in the queue |
| Rerun | Copy and overwrite | A second run is idempotent |
In a pipeline, the bucket building block creates a bucket pair with its own key for each tenant and hands over the credentials only at runtime, as described under Tenant pipelines. The credentials end up in the encrypted variables of the deployment.
Database dumps and bucket archives from offboarding are stored in your workspace’s backup bucket, see Managed databases.
Every bucket is backed up at night with Object Lock by the S3 backups, in a project of its own and a region you choose – with a monthly restore test and evidence for the compliance page.
Customer onboarding from building blocks, live in under a minute.
Go to Tenant pipelinesBuckets copied every night with Object Lock, tested monthly.
Go to S3 backupsRoles, mandatory 2FA, audit log and IP allowlist.
Go to Security & accessA Scaleway project, registered by its IAM key. Because an IAM key belongs to exactly one Object Storage project, registering the key is also selecting the project. Clusterward verifies the key via ListBuckets, stores it encrypted and shows the project and organization on the card.
Can’t find your question? Write to us – we usually reply on the same business day.
Ask a questionWe register your project, create a bucket pair with its own key and check the policy in the Scaleway console.
