Object Storage

An object storage resource is an S3 bucket owned by your organisation. Attach it to an environment and Quant Cloud creates a dedicated access key for that attachment and writes the connection details into the environment’s secrets.

Use it for anything your application needs to keep beyond the life of a container: user uploads, generated assets, exports, or backups.

Creating a bucket

Open Cloud → Resources and choose Create Resource, with Object storage as the type. Names must start with a lowercase letter or number and contain only lowercase letters, numbers and hyphens, between 2 and 41 characters.

Wait for the resource to finish provisioning before you attach it.

Attaching it to an environment

Expand the resource, pick the application and environment, and optionally set an environment variable prefix. On attach, Quant Cloud creates an IAM user scoped to that attachment’s path in the bucket, generates an access key for it, and writes five variables into the environment’s secrets:

Variable	Contents
S3_ENDPOINT	The S3 endpoint to connect to
S3_REGION	The bucket’s region
S3_BUCKET	The bucket name
S3_ACCESS_KEY_ID	Access key for this attachment
S3_SECRET_ACCESS_KEY	Secret key for this attachment

With a prefix of MEDIA, these become MEDIA_S3_ENDPOINT, MEDIA_S3_BUCKET and so on.

Each attachment gets its own credentials, so revoking one environment’s access does not affect any other environment using the same bucket.

Connecting your application

The variables follow the names most S3 client libraries expect, so in many cases the configuration is direct:

// PHP, using the AWS SDK
$client = new Aws\S3\S3Client([
    'version'  => 'latest',
    'region'   => getenv('S3_REGION'),
    'endpoint' => getenv('S3_ENDPOINT'),
    'credentials' => [
        'key'    => getenv('S3_ACCESS_KEY_ID'),
        'secret' => getenv('S3_SECRET_ACCESS_KEY'),
    ],
]);

# Drupal, in settings.php via the s3fs module
$settings['s3fs.access_key'] = getenv('S3_ACCESS_KEY_ID');
$settings['s3fs.secret_key'] = getenv('S3_SECRET_ACCESS_KEY');
$config['s3fs.settings']['bucket'] = getenv('S3_BUCKET');
$config['s3fs.settings']['region'] = getenv('S3_REGION');

If you set a prefix when attaching, read the prefixed names instead.

When the credentials take effect

The secrets are written as soon as you attach, but a running container only sees them on its next deploy, so redeploy the environment once you have attached the bucket.

Removing access

Detaching deletes the attachment’s IAM user and access key, then redeploys the environment so it stops referencing secrets that no longer exist. The environment is briefly interrupted during that deploy.

The bucket and its contents are untouched by a detach. Deleting the resource is what removes the data, and that cannot be undone.