Retrieves the Access Control List (ACL) of a bucket.

Permissions

Make sure you have one of the following permissions:

• You are the owner of the bucket.
• You possess READ_ACP access for the bucket using Bucket ACL.
• You are authorized to execute the s3:GetBucketAcl operation using Bucket Policies.

A bucket owner can grant this permission to others by using Bucket ACL or Bucket Policies.

Sets the permissions for an existing bucket using Access Control Lists (ACL).

You can use one of the following two ways to set a bucket's permissions:

• Specify the ACL in the request body.
• Specify permissions using request headers

Note: You cannot specify access permission using both the body and the request headers.

Permissions

Make sure you have one of the following permissions:

• You are the owner of the bucket.
• You possess WRITE_ACP access for the bucket using Bucket ACL.
• You are authorized to execute the s3:PutBucketAcl operation using Bucket Policies.

A bucket owner can grant this permission to others by using Bucket ACL or Bucket Policies.

Returns the access control list (ACL) of an object.

Permissions

Make sure you have one of the following permissions:

• You are the owner of the bucket.
• You possess READ_ACP access for the object using Bucket ACL.
• You are authorized to execute the s3:GetObjectAcl operation using Bucket Policies.

A bucket owner can grant this permission to others by using Bucket ACL or Bucket Policies.

S3 API Compatibility

• The versionId query variable is not supported.

Sets the permissions for an existing object using Access Control Lists (ACL).

You can use one of the following two ways to set an object's permissions:

• Specify the ACL in the request body.
• Specify permissions using request headers

Note: You cannot specify access permission using both the body and the request headers.

Permissions

Make sure you have one of the following permissions:

• You are the owner of the bucket.
• You possess WRITE_ACP access for the object using Bucket ACL.
• You are authorized to execute the s3:PutObjectAcl operation using Bucket Policies.

A bucket owner can grant this permission to others by using Bucket ACL or Bucket Policies.

S3 API Compatibility

• The versionId query variable is not supported.

Creates a copy of an object that is already stored in IONOS S3 Object Storage.

Creates a new S3 bucket. To create a bucket, you must register with IONOS S3 Object Storage and have a valid Access Key ID to authenticate requests. Anonymous requests are never allowed to create buckets. By creating the bucket, you become the bucket owner.

Not every string is an acceptable bucket name. For information about bucket naming restrictions, see Bucket naming rules.

Buckets are created in the location specified in the endpoint used to make the request. Once a bucket is created, it can be accessed at that location. Any requests targeting an existing bucket using an endpoint with an incorrect location will result in a 404 NoSuchkey.

When creating a bucket using this operation, you can optionally specify the accounts or groups that should be granted specific permissions on the bucket. There are two ways to grant the appropriate permissions using the request headers.

• Specify a canned ACL using the x-amz-acl request header. IONOS S3 Object Storage supports a set of predefined ACLs, known as canned ACLs. Each canned ACL has a predefined set of grantees and permissions. For more information, see Canned ACL.

• Specify access permissions explicitly using the x-amz-grant-read, x-amz-grant-write, x-amz-grant-read-acp, x-amz-grant-write-acp, and x-amz-grant-full-control headers. These headers map to the set of permissions IONOS S3 Object Storage supports in an ACL.

  You specify each grantee as a type=value pair, where the type is one of the following:

  • id – if the value specified is the canonical user ID of an IONOS S3 Object Storage account

  • uri – if you are granting permissions to a predefined group

  • emailAddress – if the value specified is the email address of an IONOS S3 Object Storage account

Deletes the bucket. All objects (including all object versions and delete markers) in the bucket must be deleted before the bucket itself can be deleted.

Retrieves metadata and verifies the existence of a specific bucket. This operation checks for the presence of the specified bucket without returning the actual content of the bucket.

Bucket names are globally unique across all users of the service. If the bucket exists and the requester has permission to access it, the server returns a 200 OK HTTP status code with no accompanying response body. If the bucket does not exist or if the requester does not have permission to access it, the server returns a relevant error code:

• 403 Forbidden: The requester does not have permission to access the bucket.
• 404 Not Found: The bucket does not exist.

Permissions

You must be the bucket owner to perform this operation. If not, the bucket owner can grant you permission to perform the s3:ListBucket operation using Bucket Policies.

Returns some or all (up to 1,000) of the objects in a bucket. You can use the request parameters as selection criteria to return a subset of the objects in a bucket. A 200 OK response can contain valid or invalid XML. Be sure to design your application to parse the contents of the response and handle it appropriately.

This API is used to issue a preflight request to the IONOS S3 Object Storage to determine if it can send an actual request with the specific origin, HTTP method, and headers.

The POST operation adds an object to a specified bucket using HTML forms. POST is an alternate form of PUT that enables browser-based uploads of objects into buckets. Parameters passed to PUT via HTTP Headers are instead passed to POST as form fields in the multipart/form-data encoded message body.

Removes the null version (if there is one) of an object and inserts a delete marker, which becomes the latest version of the object. This operation is final - there is no way to recover a deleted object. Data stored in IONOS S3 Object Storage is erasure coded and distributed to multiple individual storage devices in multiple data centers. When data is deleted, various mechanisms exist which prevent recovery or reconstruction of the deleted objects.

Deletion of an object undergoes various stages. First, the metadata is marked to indicate the object is deleted, then, the data is removed. Eventually, deleted metadata is overwritten and the deleted data blocks are overwritten with new data in the course of normal operations. As soon as the metadata is marked deleted, it is not possible to read an object remotely.

Retrieves objects from IONOS S3 Object Storage. To use GET, you must have READ access to the object. If you grant READ access to the anonymous user, you can return the object without using an authorization header.

An IONOS S3 Object Storage bucket has no directory hierarchy such as you would find in a typical computer file system. You can, however, create a logical hierarchy by using object key names that imply a folder structure. For example, instead of naming an object test.jpg, you can name it photos/2022/July/test.jpg.

To get an object from such a logical hierarchy, specify the full key name for the object in the GET operation. For a virtual hosted-style request example, if you have the object photos/2022/July/test.jpg, specify the resource as /photos/2022/July/test.jpg. For a path-style request example, if you have the object photos/2022/July/test.jpg in the bucket named examplebucket, specify the resource as /examplebucket/photos/2022/July/test.jpg.

This operation returns an InvalidObjectStateError error.

If you encrypt an object by using server-side encryption with customer-provided encryption keys (SSE-C) when you store the object in IONOS S3 Object Storage, then when you GET the object, you must use the following headers:

• x-amz-server-side-encryption-customer-algorithm

• x-amz-server-side-encryption-customer-key

• x-amz-server-side-encryption-customer-key-MD5

Assuming you have the relevant permission to read object tags, the response also returns the x-amz-tagging-count header that provides the count of number of tags associated with the object.

Permissions

You need the relevant read object (or version) permission for this operation. If the object you request does not exist, the error IONOS S3 Object Storage returns depends on whether you also have the ListBucket permission.

• If you have the ListBucket permission on the bucket, IONOS S3 Object Storage will return an HTTP status code 404 ("no such key") error.

• If you don’t have the ListBucket permission, IONOS S3 Object Storage will return an HTTP status code 403 ("access denied") error.

Versioning

By default, the GET operation returns the current version of an object. To return a different version, use the versionId subresource.

Overriding Response Header Values

There are times when you want to override certain response header values in a GET response. For example, you might override the Content-Disposition response header value in your GET request.

You can override values for a set of response headers using the following query parameters. These response header values are sent only on a successful request, that is, when status code 200 OK is returned. The set of headers you can override using these parameters is a subset of the headers that IONOS S3 Object Storage accepts when you create an object. The response headers that you can override for the GET response are Content-Type, Content-Language, Expires, Cache-Control, Content-Disposition, and Content-Encoding. To override these header values in the GET response, you use the following request parameters.

• partNumber

• versionId

• response-content-type

• response-content-language

• response-expires

• response-cache-control

• response-content-disposition

• response-content-encoding

Additional Considerations about Request Headers

If both of the If-Match and If-Unmodified-Since headers are present in the request as follows: If-Match condition evaluates to true, and; If-Unmodified-Since condition evaluates to false; then, S3 returns 200 OK and the data requested.

If both of the If-None-Match and If-Modified-Since headers are present in the request as follows: If-None-Match condition evaluates to false, and; If-Modified-Since condition evaluates to true; then, S3 returns 304 Not Modified response code.

For more information about conditional requests, see RFC 7232.

The HEAD operation retrieves metadata from an object without returning the object itself. This operation is useful if you're only interested in an object's metadata. To use HEAD, you must have READ access to the object.

A HEAD request has the same options as a GET operation on an object. The response is identical to the GET response except that there is no response body. Because of this, if the HEAD request generates an error, it returns a generic 404 Not Found or 403 Forbidden code. It is not possible to retrieve the exact exception beyond these error codes.

If you encrypt an object by using server-side encryption with customer-provided encryption keys (SSE-C) when you store the object in IONOS S3 Object Storage, then when you retrieve the metadata from the object, you must use the following headers:

• x-amz-server-side-encryption-customer-algorithm = AES256

• x-amz-server-side-encryption-customer-key

• x-amz-server-side-encryption-customer-key-MD5

Request headers are limited to 8 KB in size.

Consider the following when using request headers:

• Consideration 1 – If both of the If-Match and If-Unmodified-Since headers are present in the request as follows:

  • If-Match condition evaluates to true, and;

  • If-Unmodified-Since condition evaluates to false;

  Then IONOS S3 Object Storage returns 200 OK and the data requested.

• Consideration 2 – If both of the If-None-Match and If-Modified-Since headers are present in the request as follows:

  • If-None-Match condition evaluates to false, and;

  • If-Modified-Since condition evaluates to true;

  Then IONOS S3 Object Storage returns the 304 Not Modified response code.

For more information about conditional requests, see RFC 7232.

Permissions

You need the relevant read object (or version) permission for this operation. If the object you request does not exist, the error IONOS S3 Object Storage returns depends on whether you also have the ListBucket permission.

• If you have the ListBucket permission on the bucket, IONOS S3 Object Storage returns an HTTP status code 404 ("no such key") error.

• If you don’t have the ListBucket permission, IONOS S3 Object Storage returns an HTTP status code 403 ("access denied") error.

Adds an object to a bucket. You must have WRITE permissions on a bucket to add an object to it.

IONOS S3 Object Storage never adds partial objects; if you receive a success response, IONOS S3 Object Storage added the entire object to the bucket.

IONOS S3 Object Storage is a distributed system. If it receives multiple write requests for the same object simultaneously, it overwrites all but the last object written. IONOS S3 Object Storage does not provide object locking; if you need this, make sure to build it into your application layer or use versioning instead.

To ensure that data is not corrupted traversing the network, use the Content-MD5 header. When you use this header, IONOS S3 Object Storage checks the object against the provided MD5 value and, if they do not match, returns an error. Additionally, you can calculate the MD5 while putting an object to IONOS S3 Object Storage and compare the returned ETag to the calculated MD5 value.

Versioning

If you enable versioning for a bucket, IONOS S3 Object Storage automatically generates a unique version ID for the object being stored. IONOS S3 Object Storage returns this ID in the response. When you enable versioning for a bucket, if IONOS S3 Object Storage receives multiple write requests for the same object simultaneously, it stores all of the objects.

Access Control List (ACL)-Specific Request Headers

You can use headers to grant ACL- based permissions. By default, all objects are private. Only the owner has full access control. When adding a new object, you can grant permissions to individual IONOS S3 Object Storage accounts or to predefined groups defined by IONOS S3 Object Storage. These permissions are then added to the ACL on the object.

Server-side Encryption with IONOS S3 managed keys (SSE-S3)

You can optionally request server-side encryption. With server-side encryption, IONOS S3 Object Storage encrypts your data as it writes it to disks in its data centers and decrypts the data when you access it.

• the SSE-S3 encryption can be set as the default encryption for the bucket using PutBucketEncryption. This way all the newly created objects will be protected with SSE-S3 encryption even it was not specified in the PutObject operation.
• the SSE-S3 encryption can be applied to the object at the time of upload by setting `x-amz-server-side-encryption` header to AES256. This can be skipped if the default encryption has been set up for the bucket as described in the previous clause.

Server-side Encryption with customer managed keys (SSE-C)

• x-amz-server-side-encryption-customer-algorithm = AES256
• x-amz-server-side-encryption-customer-key — the 256-bit, base64-encoded encryption key to use to encrypt and decrypt your data. You might use these commands to generate it:
  1. to create the file with a key: openssl rand 32 -out my-key.key
  2. to get base64-encoded string: openssl enc -base64 -in my-key.key, the example of the output: 4ZRNYBCCvL0YZeqo3f2+9qDyIfnLdbg5S99R2XWr0aw=.

NOTE:

• The SSE-C encryption will override the SSE-S3 encryption if the last one was enabled as a default encryption for the bucket.
• In the response, IONOS S3 returns the encryption algorithm and MD5 of the encryption key that you specified when uploading the object. The ETag that is returned is not the MD5 of the object.

This operation enables you to delete multiple objects from a bucket using a single HTTP request. If you know the object keys that you want to delete, then this operation provides a suitable alternative to sending individual delete requests, reducing per-request overhead.

The request contains a list of up to 1000 keys that you want to delete. In the XML, you provide the object key names, and optionally, version IDs if you want to delete a specific version of the object from a versioning-enabled bucket. For each key, IONOS S3 Object Storage performs a delete operation and returns the result of that delete, success, or failure, in the response. Note that if the object specified in the request is not found, IONOS S3 Object Storage returns the result as deleted.

The operation supports two modes for the response: verbose and quiet. By default, the operation uses verbose mode in which the response includes the result of deletion of each key in your request. In quiet mode the response includes only keys where the delete operation encountered an error. For a successful deletion, the operation does not return any information about the delete in the response body.

Lists all the buckets owned by the authenticated sender of the request. This operation does not list the buckets shared with you by other users.

Permissions

To use this operation, you must have the s3:ListAllMyBuckets permission. The bucket owner has it by default.

Retrieves a partial or complete list (with a maximum of 1000 objects per request) from a specified bucket. The request parameters can serve as selection criteria to filter and return a subset of objects from the bucket.

A 200 OK response can contain either valid or invalid XML, so it's crucial to construct your application in such a way that it can correctly parse and handle the response content. In the resulting list, objects are organized in ascending order according to their key names.

Permissions

Make sure you have one of the following permissions:

• You are the owner of the bucket.
• You possess READ access for the bucket using Bucket ACL.
• You are authorized to execute the s3:ListBucket operation using Bucket Policies.

A bucket owner can grant this permission to others by using Bucket ACL or Bucket Policies.

Restores an archived copy of an object back into IONOS S3 Object Storage

This operation performs the following types of requests:

• select - Perform a select query on an archived object

• restore an archive - Restore an archived object

To use this operation, you must have permissions to perform the RestoreObject operation. The bucket owner has this permission by default and can grant this permission to others.

Deletes the CORS configuration information set for the bucket.

To use this operation, you must have permission to perform the PutBucketCORS operation. The bucket owner has this permission by default and can grant this permission to others.

Returns the cors configuration information set for the bucket.

To use this operation, you must have permission to perform the GetBucketCORS operation. By default, the bucket owner has this permission and can grant it to others.

Sets the CORS configuration for your bucket. If the configuration exists, it will be overwritten and replaced.

To use this operation, you must be allowed to perform the PutBucketCORS operation. By default, the bucket owner has this permission and can grant it to others.

You set this configuration on a bucket so that the bucket can service cross-origin requests. For example, you might want to enable a request whose origin is http://www.example.com to access your IONOS S3 Object Storage bucket at my.example.bucket.com by using the browser's XMLHttpRequest capability.

To enable cross-origin resource sharing (CORS) on a bucket, you add the cors subresource to the bucket. The cors subresource is an XML document in which you configure rules that identify origins and the HTTP methods that can be executed on your bucket. The document is limited to 64 KB in size.

When IONOS S3 Object Storage receives a cross-origin request (or a pre-flight OPTIONS request) against a bucket, it evaluates the cors configuration on the bucket and uses the first CORSRule rule that matches the incoming browser request to enable a cross-origin request. For a rule to match, the following conditions must be met:

• The request's Origin header must match AllowedOrigin elements.

• The request method (for example, GET, PUT, HEAD, and so on) or the Access-Control-Request-Method header in case of a pre-flight OPTIONS request must be one of the AllowedMethod elements.

• Every header specified in the Access-Control-Request-Headers request header of a pre-flight request must match an AllowedHeader element.

This implementation of the DELETE operation removes default encryption from the bucket.

In the current version, only the bucket owner is allowed to perform this operation. We currently do not support the use of bucket policies to extend bucket encryption permissions to users other than the bucket owner.

Returns the default encryption configuration for the bucket.

In the current version, only the bucket owner is allowed to perform this operation. We currently do not support the use of bucket policies to extend bucket encryption permissions to users other than the bucket owner.

If the bucket does not have a default encryption configuration, GetBucketEncryption returns 404 ServerSideEncryptionConfigurationNotFoundError.

Sets the AES256 server-side encryption for a bucket with IONOS S3 managed keys (SSE-S3).

With server-side encryption, S3 encrypts a newly uploaded object in the bucket before saving it to disk and decrypts it when you download the object. Encryption doesn't change the way that you access data as an authorized user. It only further protects your data.

In the current version, only the bucket owner is allowed to perform this operation. We do not currently support the use of bucket policies to extend bucket encryption permissions to users other than the bucket owner.

IONOS S3 confirms that your object is stored with SSE-S3 encryption by returning the response header `x-amz-server-side-encryption` for the Object Read operation.

You can also apply encryption with a customer-provided key (SSE-C) to each object at the time of uploading. In this case, SSE-C encryption will override the SSE-S3 encryption.

Deletes the lifecycle configuration from the specified bucket. As a result, objects within the bucket will neither expire nor be automatically deleted based on any rules from the deleted configuration.

Permissions

You must be the bucket owner to perform this operation. If not, the bucket owner can grant you permission to perform the s3:PutLifecycleConfiguration operation using Bucket Policies.

Note: A brief delay may occur before the lifecycle configuration deletion is fully propagated across all IONOS S3 Object Storage systems. During this time, lifecycle rules may remain temporarily active.

Returns the lifecycle configuration for the specified S3 bucket.

Permissions

You must be the bucket owner to perform this operation. If not, the bucket owner can grant you permission to perform the s3:GetLifecycleConfiguration operation using Bucket Policies.