Using buckets

Available in Classic and VPC

A bucket is a space to store objects. To use Object Storage, at least 1 bucket must be created. You can create buckets easily and manage them conveniently in the NAVER Cloud Platform console.

Create bucket

To create a bucket after completing the subscription to Object Storage:

1. In the NAVER Cloud Platform console, navigate to > Services > Storage > Object Storage.
2. Click [Create bucket].
3. Enter the name of the bucket you're going to create, then click [Next].
   • Only lower case letters or numbers are allowed for the first and last characters. Enter between 3 and 63 characters.
   • A period (.) and a hyphen (-) are allowed, but the name in the form of an IP address cannot be used.
   • You can't change the name of the bucket once it is created. You should carefully select bucket names as they are used when creating object domains.
   • You cannot register an identical bucket name within the Region. Please enter a unique name for the bucket you are registering.
4. (Japan Region only) Select whether to enable bucket versioning, if necessary.
   • The bucket versioning feature cannot be disabled once it has been enabled.
   • If you do not use a bucket lock, you can temporarily suspend the bucket versioning feature. (Temporarily suspend object version creation.)
5. Select whether to lock bucket, if necessary.
   1. Non-Japan Regions (Korea, U.S. West, Singapore, Germany)
      • If you lock your bucket, the corresponding object is not changed or deleted during the set period, and early termination and membership withdrawal are not allowed, so please select carefully.
      • The bucket is unlocked by default. For individual customers, if you want to set up a bucket lock, apply separately through Customer Support.
      • If you have activated lock, set the following items:
        • Maximum retention period: You can set the maximum retention period allowed for the bucket between 0 and 365 days.
        • Default retention period: You can set the default retention period for objects stored in the bucket between 0 and 365 days.
          • Retention period can be set for each file when saving objects later.
   2. Japan Region
      • Object locking only works on versioned buckets. Enabling object lock automatically enables bucket versioning.
      • Bucket lock settings allow you to specify the retention period for objects. For objects with a specified retention period, the corresponding version object is not changed or deleted during the set period, and early termination and membership withdrawal are not allowed, so please select carefully.
      • If you have activated lock, set the following items:
        • Retention mode selection: Selectable from the following two modes:
          • Governance mode: NCP_OBJECT_STORAGE_MANAGER or Change/ * Users with permission can overwrite or delete protected object versions during the retention period.
          • Compliance mode: No user can overwrite or delete protected object versions during the retention period.
        • Default retention period: You can set the default retention period for objects stored in the bucket between 1 and 365 days. (You can set a longer period when using the API.)
          • Retention period can be set for each file when saving objects later.
6. Select whether to set encryption of bucket, if necessary. (Not available for Japan Region.)
   • For more information about how to set encryption, see Encryption settings (KMS).
   • By default, no encryption is set.
   • If encryption is enabled, select the encryption key management method and encryption key.
     • NCP-managed key: Key managed by NCP.
     • KMS master key: You can use AES256 or RSA-2048 keys created in Key Management Service. However, AES256 key with convergence encryption cannot be selected.
7. (Japan Region only) Select zone settings under Manage available zone.
   • Single-zone: Available to select JP4 and JP5 Zones and data is saved in the selected zone.
   • Multi-zone: Data is distributed and stored in JP4 and JP5 Zones. It provides higher availability compared to single-zone.
   • Single-zone and multi-zone are billed at different rates. For more information, see Pricing information page.
8. Click [Next].
9. Select whether to make the bucket disclosed.
   • When Disclosure is selected, the list of folders/files stored in the bucket is disclosed. Whether to disclose each file can be set when uploading the file.
10. If necessary, grant the bucket use permissions to other accounts and click [Next].

• Only the account that completed the Object Storage subscription can be added.
• You can optionally grant bucket list view, file upload, and Access Control List (ACL) view and edit permissions.

11. After confirming the information you entered, click [Create bucket].

Encryption settings (KMS)

If you set bucket encryption, you can control access to the bucket and protect stored objects by connecting with Key Management Service of NAVER Cloud Platform.
Once encryption is set, it cannot be cancelled, and the following features cannot be used:

• Lock setting.
• Host a static website.
• Set disclosure status.
• Grant permissions to other accounts.
• Lifecycle Management settings.

Manage bucket

While operating the created bucket, you may encounter situations where you need to change the bucket options set during creation. Object Storage enables you to change the settings of the created bucket conveniently.
To manage the bucket that was created and is in use:

1. In the NAVER Cloud Platform console, navigate to > Services > Storage > Object Storage.

2. Place the mouse cursor on besides the bucket name.

3. Click the necessary management task.
   

   • Bucket information
   • Delete bucket
   • Cancel bucket deletion
   • Access control (VPC)
   • Manage permissions
   • Manage log
   • Bucket versioning (available only in Japan Region)
   • Manage lock
   • Host a static website
   • Manage events (support for the Japan Region coming soon)
   Note

   Some items may not be displayed in the list depending on the Region or platform.

Bucket information

When the bucket information interface is displayed, you can view the bucket details or set the bucket using feature buttons.
The available features and the information displayed in the list are as follows:

Item	Description
Feature buttons	[Bucket information]: View details of the selected bucket. [Delete bucket]: Delete the selected bucket. [Cancel bucket deletion]: Cancel bucket deletion that is in progress. [Access control]: Define servers that are allowed to access the bucket (displayed only in VPC environments). [Manage permissions]: Configure whether the bucket is disclosed and grant bucket permissions to other accounts. [Lock management]: Configure object lock. [Log management]: Configure the bucket to store access logs. [Static website hosting]: Host a static website using the bucket. [Event management]: Send notifications when specific events occur in the bucket (integrated with Cloud Functions).
Bucket list	Select a bucket to view its details, then click in each component to change settings. Name/bucket name: Bucket name. Size: Bucket size. Creation (upload) date: Date when the bucket was first created. Zone: Zone where the bucket is located (available only in Japan Region). Event management: List of event notifications configured for the bucket. Access control: List of servers allowed to access the bucket (displayed only in VPC environments). Manage permissions: Bucket disclosure status and the list of other accounts that can use the bucket. Bucket versioning: Whether version management is enabled for the bucket (available only in the Japan Region). Lock management: Whether object lock is enabled for the bucket. Encryption management: Whether encryption is enabled for objects stored in the bucket. Log management: Configuration for bucket access logs. Static website hosting: Endpoint information and whether static website hosting is enabled.

Delete bucket

To delete a created bucket:

1. If the bucket is connected with another service, the list of connected services is displayed in the Delete bucket popup. Click [Next] to view the connected service and continue to proceed.
2. Enter the name of the bucket you're going to use, then click [OK].
3. Check that the task is completed in the Delete popup and close the window.

Cancel bucket deletion

When bucket deletion is executed, the Cancel bucket deletion menu appears so that you can cancel the deletion.
To cancel bucket deletion, click [OK] in the bucket deletion cancellation popup.

Access control (VPC)

When using Object Storage in the VPC environment, you can set bucket access from a specific server only. To configure the settings:

1. When the Access control popup is displayed, click in the access control setting items to activate the feature.
2. Select a server to allow access among the servers displayed in the VPC server list and click .
   • The selected server moves to the ACL setting information list.
   • To cancel the selection, click .
   • You can set the server in your VPC.
3. When the selection is complete, click [OK].
   • You can view the list of access-allowed servers through the > Bucket information menu.

Manage permissions

You can disclose a bucket to the world and grant the bucket use permission to other users of NAVER Cloud Platform. To configure the settings:

1. When the Manage permissions popup appears, select whether to make it public under the Manage access item.
   • Private: Keeps the list of folders and files in the bucket private.
   • Public: Allows the list of folders and files stored in the bucket visible to public. Disclosure status of each file is set when uploading the file.
2. Enter the account to grant use permissions in Other account permissions item and click [Add].
   • Only the account that completed the Object Storage subscription can be added.
   • You can optionally grant bucket list view, file upload, and Access Control List (ACL) view and edit permissions.
3. Click [OK].

Manage log

With bucket access log management, you can save a history of requests that accessed a bucket.
To set access log management:

1. Regions other than Japan
   When you enable access log management, logs for the previous hour are generated between 25 and 55 minutes past every 1 hour. (Example: Logs from 5:00:00 PM to 5:59:59 PM are generated between 6:25 PM and 6:55 PM.) To configure access log management:
   1. When the Log management popup is displayed, select a bucket to save logs and enter the prefix of the access log to be saved in the bucket, and click [Add].
      • You can set for your bucket only.
      • Only 1 prefix can be set per bucket.
      • You can set up multiple storage buckets in 1 bucket.
      • Click [Delete] to cancel prefix input.
   2. Click [OK].
      • Navigate to > Bucket information to view the access log setting details.

Access log examples (other than Japan Region)

The details for all requests executed on Object Storage are saved in the JSON format.
The following is the log example of when viewing an object of Object Storage:

{
  "container_id": "3aaae999-89b8-1234-abb6-5c106e4f436d",
  "container_name": "ncp-bucket",
  "container_region": "Korea",
  "credential_type": "hmac",
  "delete_marker": false,
  "e_tag": "2a158d5ab989430a11ba4f12345e357",
  "format": 1,
  "headers": {
    "Accept-Encoding": [
      "identity"
    ],
    "Authorization": [
      "AWS4-HMAC-SHA256 Credential=ABCDEFJqzABCDJ6cGS/20211109/us-east-1/s3/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature=1cc5b591e1f4c313a9bbf7471bd1d5b7f5d32033e4dec3bcaf1a329ef9b57e8"
    ],
    "Host": [
      "kr.object.ncloudstorage.com"
    ],
    "User-Agent": [
      "aws-cli/1.15.85 Python/2.7.9 Windows/8 botocore/1.10.84"
    ],
    "X-Amz-Content-SHA256": [
      "e3b0c44298fc1c149afbf4c8996fb92427ae41e464911234ca495991b7852b855"
    ],
    "X-Amz-Date": [
      "20211109T094038Z"
    ]
  },
  "https": {
    "cipher_suite": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
    "protocol": "TLSv1.2"
  },
  "interface_type": "s3",
  "is_secure": true,
  "last_changed": "2021-10-21T08:40:00.283Z",
  "last_modified": "2021-10-21T05:23:31.432Z",
  "object_length": "160",
  "object_name": "index.html",
  "principals": {
    "aws": "ABCDEFJqzABCDJ6cGS",
    "identity": "ncp-1234567-0@00000000-0000-0000-0000-000000000002"
  },
  "protocol": "HTTP/1.1",
  "proxy_enabled": false,
  "region": "KR",
  "remote_address": "123.45.123.45",
  "remote_user": "ABCDEFJqzABCDJ6cGS",
  "request_id": "76d34a72-2da0-400a-aac3-9861ec1040ad",
  "request_latency": "2",
  "request_method": "GET",
  "request_type": "REST.GET.OBJECT",
  "request_uri": "/ncp-bucket/object.txt",
  "response_length": "160",
  "server_name": "kr.object.ncloudstorage.com",
  "stat": {
    "client_wait": 0.056,
    "post_transfer": 0.011,
    "pre_transfer": 1.096,
    "storage_wait": 0.046,
    "total_transfer": 0.109,
    "turn_around_time": 1.14
  },
  "status": 200,
  "storage_account_id": "ncp-1234567-0",
  "storage_location_id": "24d02d1a-a0b5-7240-10b7-00655729e065",
  "time_finish": "09/Nov/2021:09:40:38 +0000",
  "time_start": "09/Nov/2021:09:40:38 +0000",
  "timestamp_finish": "1636450838774",
  "timestamp_start": "1636450838773",
  "type": "http",
  "user_agent": "aws-cli/1.15.85 Python/2.7.9 Windows/8 botocore/1.10.84",
  "version_name": "ef6dc25a-bda2-4378-9279-b3050b8da577",
  "version_transient": true
}

The following describes log fields: (Other than Japan Region)

2. Japan Region
   After you enable access log management, it may take from 10 minutes to several hours for requests to be recorded in the logs. To set access log management:
   1. When the Log management popup is displayed, select a bucket to save logs and enter the prefix of the access log to be saved in the bucket, and click [Apply].
      • You can set for your bucket only.
      • Only 1 prefix can be set per bucket.
      • You can set up a storage bucket in one bucket.
      • Navigate to > Bucket information to view the access log setting details.

Access log examples (Japan Region)

4aaa4222e45045f0897a90ccc13ba329 EXAMPLE-BUCKET1 [13/Apr/2022:13:08:11 +0900] 123.456.123.456 - afeb189f-9ecd-4cb4-8038-0e13777f9f8b REST.PUT.OBJECT test "PUT /EXAMPLE-BUCKET1/test HTTP/1.1" 200 null - 1004 17 17 "-" "Python-urllib/2.7" -
4aaa4222e45045f0897a90ccc13ba329 EXAMPLE-BUCKET1 [13/Apr/2022:13:08:21 +0900] 123.456.123.456 4aaa4222e45045f0897a90ccc13ba329 8fd2f79b-476d-4dcf-93be-d73e675ad950 REST.GET.OBJECT test "GET /EXAMPLE-BUCKET1/test HTTP/1.1" 200 null 1000 13 13 13 "-" "Python-urllib/2.7" -

The following describes log fields:

Bucket versioning (only for Japan Region)

Bucket versioning is only available in the Japan Region environment. (To be updated in other Regions.)
To configure bucket versioning:

1. Enable bucket versioning after creating a bucket or when managing a bucket after creation.
2. You can show or hide the version ID by selecting a bucket and clicking in Show version at the top of the file list.
3. When uploading the same file, a new version ID is added on top of the existing version ID.
4. If you want to download a specific version, select the version and click [Download].
5. If you want to delete a specific version, select the version, click [Edit], and click [Delete]. If a specific version needs to be deleted, select the version, click [Edit], and click [Delete].
6. Bucket versioning cannot be disabled after activation, but it can be paused. If you change bucket versioning to paused after selecting a bucket, creating object version is paused and existing object versions are retained.
7. If you use the bucket versioning feature, features to delete buckets and delete folders including sub-objects are limited in the console. When the version is ON, you can delete a bucket or folder only after manually deleting all version of the objects beneath it.

Manage lock

If you configure object lock (WORM: Write Once Read Many) for a bucket, you can prevent objects from being changed or deleted during the configured period. You can prevent unexpected object deformation or deletion by setting object lock when storing an object for a long time.

• Regions other than Japan
  • This feature is available for corporate customers. Individual customers can apply for this feature through Customer Support.
  • Early termination and membership withdrawal are not allowed, so please select carefully.
  • Object lock cannot be canceled during the set period, but the maximum retention period and default retention period can be changed.
  • Object lock can be set when creating a bucket or when the bucket is empty.
  • The Content MD5 value for the bucket with object lock has to be added to the header when uploading a file.
  • When the Lock management popup is displayed, the following items can be set:
    • Maximum retention period: You can set the maximum retention period allowed for the bucket between 0 and 365 days.
    • Default retention period: You can set the default retention period applied when objects are stored in the bucket between 0 and 365 days, and you can configure a different retention period later when you store objects.
• Japan Region
  • Object locking only works on versioned buckets. Enabling object lock automatically enables bucket versioning.
  • Bucket lock settings allow you to specify the retention period for objects. For objects with a specified retention period, the corresponding version object is protected from changing or deleting during the set period, and early termination and membership withdrawal are not allowed, so please select carefully.
  • If you have activated lock, set the following items:
    • Retention mode selection: You can select from the following two modes:
      • Governance mode: NCP_OBJECT_STORAGE_MANAGER or Change/ * Users with permission can overwrite or delete protected object versions during the retention period.
      • Compliance mode: No user can overwrite or delete protected object versions during the retention period.
    • Default retention period: You can set the default retention period for objects stored in the bucket between 1 and 365 days. (You can set a longer period when using the API.)
      • A retention period can be set for each file when saving objects later.

Host a static website

There are two types of hosting features available.

• Static website hosting: Use the bucket endpoint as a website address. All files in the bucket must be set as disclosed in order to be able to access the content of the website endpoint.
• Redirect request for files: Redirect requests to another bucket or domain.

To host:

1. When the Static website hosting popup is displayed, click to activate the feature.
2. Select a hosting type.
3. Enter the setting content according to the selected type.
   • Set the following items if you have selected static website hosting:
     • Index file: Default page of the website and required field.
     • Error file: Configure a custom error page to return when an error occurs.
   • Set the following items if you have selected redirect request for files:
     • Host name: Host to redirect to. Enter the website address of the target bucket or a custom domain.
     • Protocol: Select either None, http, or https depending on your environment.
4. Click [OK].
5. Check the bucket website endpoint and click [OK].
   • Click to copy the endpoint address.

Manage events

You can set notification forwarding if a specific event occurs in a bucket.

The following events can forward a notification:

Set notifications

To set an event notification:

1. When the Event management popup is displayed, click [Create].
2. When the Create bucket event popup is displayed, set the event.
   • Event name: Enter the event name.
     • Alphabets, numbers, hyphens (-), and underscores (_) can be used, and only letters or numbers are allowed as the first character.
   • Filter: Enter conditions to filter events for specific objects.
     • Enter the condition as a regular expression. (Example: Prefix images/: ^images/)
     • The filter applies to the object path. Events occur for all objects if no filter is entered.
   • Event type: Select multiple event types.
   • Target: Select the destination point to which the event alarm is delivered. Cloud Functions only.
     • Selecting Cloud Functions displays a list of triggers set up. If there is no existing trigger, click ** [Create trigger]** to create a new one. For more information about how to create triggers, see Object Storage Trigger user guide.
   • Caution for recursive calls: Read notice and click the checkbox.
3. Click [Create].

Event notification examples

The structure of notification messages sent from Object Storage is as follows:

{
    "container_name": "bucket name",
    "event_name": "event name",
    "event_type": "event type",
    "event_version": "1.0",
    "object_length": "object size",
    "object_name": "object key",
    "region": "Region name",
    "remote_address": "request IP",
    "remote_user_sha256": "SHA256 hash hex value of user Access Key",
    "remote_user_type": "user type",
    "request_method": "request Method",
    "request_type": "request type",
    "timestamp_finish": "time when the request processing is completed, Unix time, milliseconds",
    "timestamp_finish": "time when the request processing started, Unix time, milliseconds"
}

When remote_user_type is not a user, remote_address and remote_user_sha256 are set to null.

The example of a notification message is as follows:

{
    "container_name": "mybucket",
    "event_name": "testevent",
    "event_type": "ObjectCreated:PUT",
    "event_version": "1.0",
    "object_length": "1000",
    "object_name": "test.png",
    "region": "KR",
    "remote_address": "127.0.0.1",
    "remote_user_sha256": "ef5dd4b34d9de8d98182a9be416576efbd162b9a915d8b302ba8c3fa0c81b764",
    "remote_user_type": "user",
    "request_method": "PUT",
    "request_type": "REST.PUT.OBJECT",
    "timestamp_finish": "1609426801000",
    "timestamp_start": "1609426800000"
}