Clusterward creates Scaleway buckets, mints a dedicated IAM key per application with a matching bucket policy and copies existing S3 buckets into them. Only empty buckets are ever deleted.
Object Storage in Clusterward is the management of Scaleway S3 buckets from the cockpit. A provider is a Scaleway project, registered by its IAM key; the key determines which project buckets are created in. Buckets are created as private or public and, on request, get a dedicated IAM key consisting of an IAM application, a project policy and an API key. The bucket policy admits exactly that application and, for public buckets, anonymous reads. One key can serve several buckets of the same application.
Enter the project’s IAM key; Clusterward verifies it with ListBuckets and detects the project and organization.
Choose name, region and visibility. An existing bucket is never silently taken over.
A new dedicated key or an existing one of the same application.
Bucket policy with the application, the provider principal and, optionally, anonymous reads.
Copy access key, secret key, endpoint and region in the cockpit.
The IAM details that easily go wrong on Scaleway are solved properly here, once.
The IAM key is verified via ListBuckets before saving, stored encrypted and never displayed. Clusterward detects the project, organization and principal via the IAM API.
IAM application, policy and API key are created together. One key serves both the public and the private bucket of the same application.
Scaleway needs both sides: an IAM policy and a bucket policy. The policy names the application, the provider and your console users – otherwise the Files tab stays empty.
A public bucket gets the public-read ACL and anonymous reads in its policy. Visibility is set at creation.
Copy objects from an external S3 bucket under a prefix into a bucket of your own, with progress and cancellation. Copy and overwrite, never delete.
During tenant offboarding, a bucket that still holds data is uploaded as a ZIP to your backup bucket and only then emptied. Without a confirmed archive, it stays in place.
Signed requests straight to the Scaleway endpoints, tested against the AWS test vectors.
Applications, policies and API keys via the IAM API.
Version 2023-04-17, with a console access statement for your users.
Objects are copied as a stream, Content-Type included.
The import runs in the Clusterward service because Object Storage is publicly reachable. The limits keep it predictable.
| Limit | Value | Behavior |
|---|---|---|
| Single object | 2 GiB | Larger objects are skipped and counted |
| Total volume | approx. 20 GiB per run | Above that, the run is rejected before it starts |
| Object count | approx. 50,000 per run | Above that, the run is rejected before it starts |
| Parallelism | 2 copies at a time | Additional runs wait in the queue |
| Rerun | Copy and overwrite | A second run is idempotent |
In a pipeline, the bucket building block creates a bucket pair with its own key for each tenant and hands over the credentials only at runtime, as described under Tenant pipelines. The credentials end up in the encrypted variables of the deployment.
Database dumps and bucket archives from offboarding are stored in your workspace’s backup bucket, see Managed databases.
Customer onboarding from building blocks, live in under a minute.
Go to Tenant pipelinesPostgres and MySQL connected privately, one database per service.
Go to Managed databasesRoles, mandatory 2FA, audit log and IP allowlist.
Go to Security & accessCan’t find your question? Write to us – we usually reply on the same business day.
Ask a questionWe register your project, create a bucket pair with its own key and check the policy in the Scaleway console.
