Using buckets

Available in Classic and VPC

A bucket is a space to store objects. To use Object Storage, at least one bucket must be created. You can create buckets easily and manage them conveniently in NAVER Cloud Platform console.

Create bucket

The following describes how to create a bucket after completing the subscription request to Object Storage.

1. From NAVER Cloud Platform console, click the Services > Storage > Object Storage menus, in that order.
2. Click the [Create bucket] button.
3. Enter the name of the bucket you're going to create, and then click the [Next] button.
   • Only lower case letters or numbers are allowed for the first and last characters, and enter between 3 to 63 characters.
   • A period (.) and a hyphen (-) are allowed, but the name in the form of an IP address cannot be used.
   • You can't change the name of the bucket once it is created. You should carefully select bucket names because they are used when creating object domains.
   • You cannot register an identical bucket name within the Region. Please enter a unique name for the bucket you are registering.
4. (Japan Region only) If necessary, select whether or not to manage bucket versions.
   • It is not possible to disable bucket version control again once it has been activated.
   • If the bucket lock feature is not used, the version control can be paused (creating object version is paused).
5. Select whether to lock bucket, if necessary.
   1. Non-Japan Regions (Korea, US West, Singapore, Germany)
      • If you lock your bucket, you can prevent it from being modified or deleted for the set period. However, mid-term cancellation and membership cancellation are also prohibited, so please choose carefully.
      • The bucket is unlocked by default. For individual customers, if you want to set up a bucket lock, please apply separately through customer inquiry.
      • If you have activated lock, set the following items:
        • Maximum retention period: the maximum retention period allowed by the bucket, which can be set between 0 to 365 days
        • Default retention period: the default retention period applied when objects are stored in the bucket, which can be set between 0 to 365 days.
          • Retention period can be set for each file when saving objects later
   2. Japan Region
      • Object locking only works on versioned buckets. Enabling object lock automatically enables bucket version control.
      • Bucket lock settings allow you to specify the retention period for objects. For objects with a specified retention period, the corresponding version object is not changed or deleted during the set period, and early termination and membership withdrawal are not allowed, so please choose carefully.
      • If you have activated lock, set the following items.
        • Preservation mode selection: selectable from the following two modes
          • Governance mode: NCP_OBJECT_STORAGE_MANAGER or Change/ Users with * permission can overwrite or delete protected object versions during the retention period
          • Compliance mode: no user can overwrite or delete protected object versions during the retention period
        • Default retention period: the default retention period applied when objects are stored in the bucket, which can be set between 1 to 365 days (a longer period can be set when using the API)
          • Retention period can be set for each file when saving objects later
6. Select whether to set encryption of bucket, if necessary. (Not available for Japan Region)
   • For more details on encryption settings, see Encryption settings (KMS).
   • By default, no encryption is set.
   • If encryption is enabled, select the encryption key management method and encryption key.
     • NCP-Managed key: keys managed by NCP
     • KMS Master key: can use AES256 or RSA-2048 type generated by Key Management Service. However, AES256 key with convergence encryption cannot be selected
7. (Japan Region only) Select zone settings under Manage available Zone.
   • Single-zone: available to select JP4 and JP5 Zone and data is saved in the selected zone.
   • Multi-zone: data is distributed and stored in JP4 and JP5 Zones. It provides higher availability compared to single-zone.
   • Pricing of single-zone and multi-zone are different. For more information on rates, see the pricing plan page.
8. Click the [Next] button.
9. Select whether to make the bucket disclosed.
   • When Disclosure is selected, the list of folders/files stored in the bucket is disclosed. Whether to disclose each file can be set when uploading the file.
10. If necessary, grant the bucket use permissions to other accounts and click the [Next] button.

• Only the account that completed the Object Storage subscription request can be added.
• You can optionally grant bucket list view, file upload, and access control ACL (Access Control List) view and edit permission.

11. After confirming the details, click the [Create bucket] button.

Encryption setting (KMS)

If you set bucket encryption, you can control access to the bucket and protect stored objects by connecting with Key Management Service of NAVER Cloud Platform.
Once encryption is set, it cannot be cancelled, and the following features cannot be used.

• Lock setting
• Static website hosting
• Disclosure status setting
• Granting permissions to other accounts
• Lifecycle Management Settings

Bucket management

While operating the created bucket, you may encounter situations where you need to change the bucket options set during creation. Object Storage enables you to change the settings of the created bucket conveniently.
The following describes how to manage the bucket that was created and is in use.

1. From NAVER Cloud Platform console, click the Services > Storage > Object Storage menus, in that order.

2. Place the mouse cursor on besides the bucket name.

3. Click the necessary management task.
   

   • Bucket information
   • Delete bucket
   • Cancel bucket deletion
   • Access control (VPC)
   • Manage permissions
   • Log management
   • Bucket version control (available only in Japan Region)
   • Manage lock
   • Static website hosting
   • Manage events (Japan Region will be provided later)
   Note

   Some items may not be displayed in the list depending on the Region or platform.

Bucket information

When the bucket information page is displayed, you can view the bucket details or set the bucket using feature buttons.
The available features and the information displayed in the list are as follows.

Item	Description
Feature buttons	[Bucket information]: view detailed information of the selected bucket [Delete Bucket]: delete the selected bucket [Cancel Bucket Deletion]: cancel bucket deletion in progress [Control Access]: define a server allowing bucket access (displayed in VPC only) [Manage Permissions]: set the bucket disclosure status and grant use permissions to other accounts [Manage Lock]: set object lock [Manage Logs]: set to save bucket access logs [Static Website Hosting]: static website hosting using the bucket [Manage Event]: send notifications when a specific event occurs in the bucket (integration with Cloud Function)
Bucket list	Select a bucket to view details and click in each area to change settings Name/bucket name: the name of the bucket Size: bucket capacity Created (Uploaded) Date: the date when the bucket was first created Zone: zone where the bucket is located (available only in Japan Region) Event management: list of event alarms set on buckets Access Control: list of servers allowed to access the bucket (displayed only in the VPC environment) Manage Permission: whether the bucket is public and the list of other accounts that can use the bucket Bucket version control: whether or not the bucket is versioned (available only in Japan) Lock management: whether the bucket is locked Encryption management: whether objects stored in the bucket are encrypted Log Management: configuration information of bucket access log Static Website Hosting: whether static website hosting is set up and endpoint information

Delete bucket

The following describes how to delete a created bucket.

1. If the bucket is connected with another service, the list of connected services is displayed in the Delete bucket pop-up window. Click the [Next] button to view the connected service and continue to proceed.
2. Enter the name of the bucket you're going to use, and then click the [OK] button.
3. Check whether the task is completed in the Delete pop-up window and close the window.

Cancel bucket deletion

When bucket deletion is executed, the Cancel bucket deletion menu appears so that you can cancel the deletion.
To cancel bucket cancellation, click the [Save] button in the Cancel bucket deletion pop-up window.

Access control (VPC)

When using Object Storage in the VPC environment, you can set bucket access from a specific server only. The following describes how to configure the settings.

1. When the Access control pop-up window is displayed, click in the access control setting items to activate the feature.
2. Select a server to allow access among the servers displayed in the VPC server list and click .
   • The selected server moves to the ACL setting information list.
   • To cancel the selection, click .
   • You can set the server in your VPC.
3. When the selection is complete, click the [OK] button.
   • You can view the list of access-allowed servers through the > Bucket information menu.

Manage Permissions

You can disclose a bucket to the world and grant the bucket use permission to other users of NAVER Cloud Platform. The following describes how to configure the settings.

1. When the Manage permissions pop-up window is displayed, select the disclosure status in the Manage disclosure item.
   • No disclosure: folders/files in a bucket are not disclosed.
   • Disclosure: discloses the list of folders/files stored in a bucket to anyone in the world. Disclosure status of each file is set when uploading the file.
2. Enter the account to grant use permissions in Other account permissions item and click the [Add] button.
   • Only the account that completed the Object Storage subscription request can be added.
   • You can optionally grant bucket list view, file upload, and access control ACL (Access Control List) view and edit permission.
3. Click the [OK] button.

Log management

With bucket access log management, you can save a history of requests that accessed a bucket.
The following describes how to set access log management.

1. Regions other than Japan
   When access log management is set, the log for the previous hour is created at 25 - 55 minutes every hour. (<example> Access logs from 17:00:00 - 17:59:59 are created at 18:25 - 18:55.) The following describes how to set access log management.
   1. When the Log management pop-up window is displayed, select a bucket to save logs and enter the prefix of the access log save in the bucket, and click the [Add] button.
      • You can set for your bucket only.
      • Only one prefix can be set per bucket.
      • You can set up multiple storage buckets in one bucket.
      • Click the [Delete] button to cancel prefix input.
   2. Click the [OK] button.
      • Use the > Bucket information menus to view the access log setting details.

Access log examples (other than Japan Region)

The details for all requests executed on Object Storage are saved in the JSON format.
The following is the log example of when searching an object of Object Storage.

{
  "container_id": "3aaae999-89b8-1234-abb6-5c106e4f436d",
  "container_name": "ncp-bucket",
  "container_region": "Korea",
  "credential_type": "hmac",
  "delete_marker": false,
  "e_tag": "2a158d5ab989430a11ba4f12345e357",
  "format": 1,
  "headers": {
    "Accept-Encoding": [
      "identity"
    ],
    "Authorization": [
      "AWS4-HMAC-SHA256 Credential=ABCDEFJqzABCDJ6cGS/20211109/us-east-1/s3/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature=1cc5b591e1f4c313a9bbf7471bd1d5b7f5d32033e4dec3bcaf1a329ef9b57e8"
    ],
    "Host": [
      "kr.object.ncloudstorage.com"
    ],
    "User-Agent": [
      "aws-cli/1.15.85 Python/2.7.9 Windows/8 botocore/1.10.84"
    ],
    "X-Amz-Content-SHA256": [
      "e3b0c44298fc1c149afbf4c8996fb92427ae41e464911234ca495991b7852b855"
    ],
    "X-Amz-Date": [
      "20211109T094038Z"
    ]
  },
  "https": {
    "cipher_suite": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
    "protocol": "TLSv1.2"
  },
  "interface_type": "s3",
  "is_secure": true,
  "last_changed": "2021-10-21T08:40:00.283Z",
  "last_modified": "2021-10-21T05:23:31.432Z",
  "object_length": "160",
  "object_name": "index.html",
  "principals": {
    "aws": "ABCDEFJqzABCDJ6cGS",
    "identity": "ncp-1234567-0@00000000-0000-0000-0000-000000000002"
  },
  "protocol": "HTTP/1.1",
  "proxy_enabled": false,
  "region": "KR",
  "remote_address": "123.45.123.45",
  "remote_user": "ABCDEFJqzABCDJ6cGS",
  "request_id": "76d34a72-2da0-400a-aac3-9861ec1040ad",
  "request_latency": "2",
  "request_method": "GET",
  "request_type": "REST.GET.OBJECT",
  "request_uri": "/ncp-bucket/object.txt",
  "response_length": "160",
  "server_name": "kr.object.ncloudstorage.com",
  "stat": {
    "client_wait": 0.056,
    "post_transfer": 0.011,
    "pre_transfer": 1.096,
    "storage_wait": 0.046,
    "total_transfer": 0.109,
    "turn_around_time": 1.14
  },
  "status": 200,
  "storage_account_id": "ncp-1234567-0",
  "storage_location_id": "24d02d1a-a0b5-7240-10b7-00655729e065",
  "time_finish": "09/Nov/2021:09:40:38 +0000",
  "time_start": "09/Nov/2021:09:40:38 +0000",
  "timestamp_finish": "1636450838774",
  "timestamp_start": "1636450838773",
  "type": "http",
  "user_agent": "aws-cli/1.15.85 Python/2.7.9 Windows/8 botocore/1.10.84",
  "version_name": "ef6dc25a-bda2-4378-9279-b3050b8da577",
  "version_transient": true
}

The following describes log fields. (Other than Japan Region)

2. Japan Region
   10 minutes to several hours may be taken to set the access log management and record the request in the log. The following describes how to set access log management.
   1. When the Log management pop-up window is displayed, select a bucket to save logs and enter the prefix of the access log save in the bucket, and click the [Application] button.
      • You can set for your bucket only.
      • Only one prefix can be set per bucket.
      • You can set up a storage bucket in one bucket.
      • Use the > Bucket information menus to view the access log setting details.

Access log examples (Japan Region)

4aaa4222e45045f0897a90ccc13ba329 EXAMPLE-BUCKET1 [13/Apr/2022:13:08:11 +0900] 123.456.123.456 - afeb189f-9ecd-4cb4-8038-0e13777f9f8b REST.PUT.OBJECT test "PUT /EXAMPLE-BUCKET1/test HTTP/1.1" 200 null - 1004 17 17 "-" "Python-urllib/2.7" -
4aaa4222e45045f0897a90ccc13ba329 EXAMPLE-BUCKET1 [13/Apr/2022:13:08:21 +0900] 123.456.123.456 4aaa4222e45045f0897a90ccc13ba329 8fd2f79b-476d-4dcf-93be-d73e675ad950 REST.GET.OBJECT test "GET /EXAMPLE-BUCKET1/test HTTP/1.1" 200 null 1000 13 13 13 "-" "Python-urllib/2.7" -

The following describes log fields.

Bucket version control (only for Japan Region)

Bucket version control is only available in the Japan Region environment. (Other Regions will be provided in the future)
The following describes how to set the bucket version control.

1. Please enable bucket version control after creating a bucket or when managing a bucket after creation.
2. You can show or hide the version ID by selecting a bucket and clicking in Show Versions at the top of the file list.
3. When uploading the same file, a new version ID is added on top of the existing version ID.
4. If you want to download a specific version, select the version and click the [Download] button.
5. If you want to delete a specific version, select the version and click the [Edit] button - [Delete] button. If you delete all versions, the file cannot be recovered.
6. Bucket version control cannot be disabled after activation, but it can be paused. If you change bucket version control to paused after selecting a bucket, creating object version is paused and existing object versions are retained.
7. If you use the bucket version control feature, features to delete buckets and delete folders including sub-objects are limited in the console. Deletion of buckets or folders is available after setting version ON and manually deleting all lower version objects.

Manage lock

If you set object lock (WORM: Write Once Read Many) on a bucket, you can protect objects from being changed or deleted within a set period of time. You can prevent unexpected object deformation or deletion by setting object lock when storing an object for a long time.

• Other than Japan Region
  • This feature is available for corporate customers. The individual customer can apply for this feature through Customer Inquiry.
  • However, mid-term cancellation and membership cancellation are not allowed after setting object lock, so please choose carefully.
  • Object lock cannot be cancelled during the set period, but the maximum retention period and default retention period can be changed.
  • Object lock can be set when creating a bucket or when the bucket is empty.
  • The Content MD5 value for the bucket with object lock has to be added to the header when uploading a file.
  • When the Lock management pop-up window is displayed, the following items can be set.
    • Maximum retention period: maximum retention period allowed by the bucket. 0 to 365 days can be set.
    • Default retention period: the applied default retention period when objects are stored in the bucket. 0 to 365 days can be set. A retention period can be set for each file when saving objects later.
• Japan Region
  • Object locking only works on versioned buckets. Enabling object lock automatically enables bucket version control.
  • Bucket lock settings allow you to specify the retention period for objects. For objects with a specified retention period, the corresponding version object is protected from changing or deleting during the set period, and early termination and membership withdrawal are not allowed, so please choose carefully.
  • If you have activated lock, set the following items.
    • Preservation mode selection: you can select from the following two modes.
      • Governance mode: NCP_OBJECT_STORAGE_MANAGER or Change/ Users with * permission can overwrite Delete s Accordingly, it also saves labor costs protected object versions during the retention period.
      • Compliance mode: no user can overwrite or delete protected object versions during the retention period.
    • Default retention period: the applied default retention period when objects are stored in the bucket, which can be set between 1 to 365 (a longer period can be set when using the API)
      • A retention period can be set for each file when saving objects later.

Static website hosting

There are two types of hosting features available.

• Static website hosting: uses the bucket endpoint as web address. All files in the bucket must be set as disclosed in order to be able to access the content of the website endpoint.
• Redirect requests for files: redirects requests to another bucket or domain.

You can host it as follows.

1. When the Static website hosting pop-up window is displayed, click to activate the feature.
2. Select a hosting type.
3. Enter the setting content according to the selected type.
   • Set the following items if you have selected static website hosting.
     • Index file: main page of the website. Required field.
     • Error file: sets the user’s error page to return when an error occurs.
   • Set the following items if you've chosen to redirect request for files.
     • Host name: host to be redirected. Enter the target bucket website address or personal domain.
     • Protocol: select either None, http, https according to the environment.
4. Click the [OK] button.
5. Check the bucket website endpoint and click the [OK] button.
   • Click to copy the endpoint address.

Manage events

You can set notification forwarding if a specific event occurs in a bucket.

The following events can forward a notification.

Notification settings

The following describes how to set an event notification.

1. When the Event management pop-up window is displayed, click the [Create] button.
2. When the Create bucket event pop-up window is displayed, set the event.
   • Event name: enter the name of the event.
     • Alphabets, numbers, hyphens (-), and underscores (_) can be used, and only letters or numbers are allowed as the first character.
   • Filter: enter the condition to be used when filtering events for a specific object.
     • Enter the condition as a regular expression. (<example> prefix images/: ^images/)
     • The filter applies to the object path. Events occur for all objects if no filter is entered.
   • Event type: select multiple event types desired.
   • Target: select a destination to forward an event notification. Cloud Functions only
     • Selecting Cloud Functions displays a list of triggers set up. If there is no existing trigger, click the [Create trigger] button to create a new one. For details on how to create triggers, see the Object Storage Trigger Usage Guide.
   • Caution for recursive calls: click the checkbox after reading the guide.
3. Click the [Create] button.

Event notification examples

The structure of notification messages sent from Object Storage is as follows:

{
    "container_name": "bucket name",
    "event_name": "event name",
    "event_type": "event type",
    "event_version": "1.0",
    "object_length": "object size",
    "object_name": "object key",
    "region": "Region name",
    "remote_address": "request IP",
    "remote_user_sha256": "SHA256 hash hex value of user Access Key",
    "remote_user_type": "user type",
    "request_method": "request Method",
    "request_type": "request type",
    "timestamp_finish": "time when the request processing is completed, Unix time, milliseconds",
    "timestamp_finish": "time when the request processing started, Unix time, milliseconds"
}

If remote_user_type is not user, null is entered for remote_access and remote_user_sha256.

The example of a notification message is as follows:

{
    "container_name": "mybucket",
    "event_name": "testevent",
    "event_type": "ObjectCreated:PUT",
    "event_version": "1.0",
    "object_length": "1000",
    "object_name": "test.png",
    "region": "KR",
    "remote_address": "127.0.0.1",
    "remote_user_sha256": "ef5dd4b34d9de8d98182a9be416576efbd162b9a915d8b302ba8c3fa0c81b764",
    "remote_user_type": "user",
    "request_method": "PUT",
    "request_type": "REST.PUT.OBJECT",
    "timestamp_finish": "1609426801000",
    "timestamp_start": "1609426800000"
}