Object Storage

Manage S3-compatible object storage resources in your project: users, access keys, IAM policies, and buckets.

Users

List storage users

enumctl storage users list

Lists all object storage users in the current project.

Create a storage user

enumctl storage users create <name>

Creates a new object storage user. The user has no S3 permissions until you attach a managed or inline policy. Access keys are issued separately with storage keys create.

Flag	Description
`--region`	Region for the user (defaults to the project’s default region)

Delete a storage user

enumctl storage users delete <user-id>

Soft-deletes the user. Any attached access keys and policies are detached and the underlying RGW user is removed.

Policies

New users start with no permissions (AWS CreateUser defaults). Attach a managed policy or an inline policy before the user can use S3.

Supported managed policy ARNs:

arn:aws:iam::aws:policy/AmazonS3FullAccess
arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess
arn:aws:iam::aws:policy/IAMFullAccess

List policies on a user

enumctl storage users policies list <user-id>

Get a policy

enumctl storage users policies get <policy-id>

Attach a managed policy

enumctl storage users policies attach <user-id> \
  --policy-arn arn:aws:iam::aws:policy/AmazonS3FullAccess

Flag	Description
`--policy-arn`	Managed policy ARN (required)

Detach a managed policy

enumctl storage users policies detach <policy-id>

Put an inline policy

enumctl storage users policies put-inline <user-id> \
  --name allow-bucket \
  --file ./policy.json

Creates or replaces an inline IAM policy document on the user. Pass the JSON with --document or --file (- reads stdin). Exactly one of --document or --file is required.

Flag	Description
`--name`	Inline policy name (required)
`--document`	Inline policy JSON document
`--file`	Path to inline policy JSON file (`-` for stdin)

Delete an inline policy

enumctl storage users policies delete-inline <policy-id>

Access keys

Access keys are S3-compatible credentials used to authenticate with object storage. A storage user can hold multiple keys. Keys alone are not enough: the user still needs an attached policy.

List access keys

enumctl storage keys list --user-id <user-id>

Lists all access keys for a given storage user.

Flag	Description
`--user-id`	Object storage user ID (required)

Create an access key

enumctl storage keys create --user-id <user-id>

Creates a new access key pair for the specified storage user. The secret key is only shown once. Save it immediately.

Flag	Description
`--user-id`	Object storage user ID (required)

Describe an access key

enumctl storage keys describe <access-key-id>

Shows details about a specific access key by its S3 key ID.

Delete an access key

enumctl storage keys delete <key-id>

Revokes the access key. The underlying S3 credentials stop working immediately.

Buckets

List buckets

enumctl storage buckets list

Lists all object storage buckets in the current project.

Get a bucket

enumctl storage buckets get <bucket-id>

Shows the bucket and its mirrored configuration (versioning, Object Lock, encryption, lifecycle, CORS, bucket policy, and tags). Configuration set through the S3 API is reflected here as well.

Create a bucket

enumctl storage buckets create <bucket-name>

Creates a new bucket in the current project. Bucket names must be globally unique within the cluster and follow S3 bucket naming rules. New buckets are deletion-protected by default.

Flag	Description
`--region`	Region for the bucket (defaults to the project’s default region)
`--object-lock`	Enable Object Lock at create time (cannot be enabled later)
`--deletion-protection`	Protect the bucket from deletion (default `true`; pass `false` to allow deletes)

Protect or unprotect a bucket

enumctl storage buckets protect <bucket-id>
enumctl storage buckets unprotect <bucket-id>

Enable or remove deletion protection on an existing bucket. A protected bucket cannot be deleted until protection is removed.

Delete a bucket

enumctl storage buckets delete <bucket-id>

Deletes the bucket. The bucket must be empty and must not have deletion protection enabled. Remove all objects through your S3 client first.

Bucket configuration

Set or clear bucket configuration through enum. Document-based commands take --document or --file (- reads stdin). Exactly one of those flags is required for put commands.

Versioning

enumctl storage buckets versioning <bucket-id> --status Enabled
enumctl storage buckets versioning <bucket-id> --status Suspended

Flag	Description
`--status`	`Enabled` or `Suspended` (required)

Object Lock

enumctl storage buckets object-lock <bucket-id> --file ./object-lock.xml

Puts the Object Lock configuration document (XML). Object Lock itself must have been enabled at bucket create time.

Encryption

enumctl storage buckets encryption <bucket-id> --file ./encryption.xml
enumctl storage buckets encryption-delete <bucket-id>

Lifecycle

enumctl storage buckets lifecycle <bucket-id> --file ./lifecycle.xml
enumctl storage buckets lifecycle-delete <bucket-id>

CORS

enumctl storage buckets cors <bucket-id> --file ./cors.xml
enumctl storage buckets cors-delete <bucket-id>

Bucket policy

enumctl storage buckets policy <bucket-id> --file ./bucket-policy.json
enumctl storage buckets policy-delete <bucket-id>

Flag	Description
`--tag`	Tag as `key=value` (repeatable; at least one required for `tagging`)

Aliases

Singular forms work as aliases:

enumctl storage bucket list
enumctl storage user list
enumctl storage key list