Create an object or SFTP storage

CDB Object Storage offers three storage types, each suited to different workloads and access protocols:

S3 Standard — general-purpose S3-compatible storage for backups, content delivery, and most workloads
S3 Fast — high-performance S3-compatible storage optimized for AI/ML workloads, IoT telemetry, and latency-sensitive applications (available in Sines-2, Sines-3, and London-2)
SFTP — legacy file-based storage accessed via SFTP protocol, with the same pricing and billing terms as S3 Standard

Create a storage

1
Open Object Storages
In the CDB Technical Web Portal, navigate to Storage > Object Storages.
2
Start creation
Click Add new object storage in the top-right corner.
3
Enter storage details
In the dialog, enter the storage name and select a location. The location name shows the storage type and data center — S3 Standard Luxembourg-2 or SFTP Amsterdam. SFTP locations appear and disappear based on available capacity.
A maximum of 3600 storages can be created per account.

S3 Standard and S3 Fast

S3 Standard and S3 Fast use the same creation flow — the only difference is the location selected in the dropdown. Each S3 storage supports up to 1000 buckets and 10 million objects per bucket. For optimal performance, keep under 100K objects per bucket and distribute data across multiple buckets.

In the Location dropdown, select an S3 Standard or S3 Fast location, then click Create at the bottom of the dialog.

Location dropdown in the Add new object storage dialog showing S3 and SFTP location options

A Details dialog opens immediately, showing the storage credentials: access key, secret key, hostname, and location. Click Copy object storage data to copy all credentials at once. Save the keys — regenerating them invalidates the existing credentials.

Details dialog showing S3 storage credentials including access key, secret key, and hostname

S3 management options

The created storage appears in the storage list. To manage it, click ... (three dots) next to the storage name and select an option:

Option	Description
Details	View the access key, secret key, hostname, and location.
Generate new keys	Replace the current access and secret keys. A confirmation dialog warns that the existing key will be deactivated. Click Yes to proceed; the new keys appear in the Details dialog.
Buckets	Manage the storage's buckets.
Delete object storage	Permanently delete the storage and all its contents. This action cannot be undone.

Object storage list with actions dropdown showing Details, Generate new keys, Buckets, and Delete object storage

SFTP storage

SFTP storage requires choosing an authentication method during creation — password or SSH key. Both can be managed after creation.

1
Select a location
In the Location dropdown, select an SFTP location.
2
Enter a name
Enter the storage name in the Name field.
3
Select authentication method
Select Password or SSH Key as the authentication method. Leave the password field empty to generate one automatically.
4
Create
Click Create at the bottom of the dialog.

SFTP management options

After creation, manage the SFTP storage by clicking ... (three dots) next to the storage name and selecting an option:

Option	Description
Details	View the hostname and connection path. Use port 2200 to connect via SFTP.
Edit	Configure the server alias and the HTTP `Expires` response header for files served over HTTP. Configuration details are in the Edit dialog section.
Set/Update password	Set or replace the password used to authenticate SFTP connections.
Remove password	Remove password authentication from the storage. After removal, only SSH key authentication is accepted.
SSH keys manager	Add or remove SSH keys for SFTP authentication. Up to five keys are allowed per storage.
Delete object storage	Permanently delete the storage and all its contents. This action cannot be undone.

SFTP storage actions dropdown showing Details, Edit, password management, SSH keys manager, and Delete options

Edit dialog

The Edit dialog for SFTP storage has two fields. Open it by clicking ... > Edit next to the storage name.

In the Server alias field, enter a domain name (subdomains are supported), then add a CNAME record in DNS settings: <server_name>.<host>. For a storage named 12345-test in Amsterdam, the record would be CNAME 12345-test.ams.origin.gcdn.co.

Storage status indicator

Each storage row shows a colored circle to the left of the ID.

After creation or a settings update — adding keys or changing a password — the storage enters a processing state shown by an orange circle. A green circle indicates the storage is ready.

Storage list showing orange and green status circles next to storage entries

S3-compatible and SFTP storages are provisioned with a single API call. For S3 storage, the secret key is returned only at creation time and when a new access key is created — it cannot be retrieved later.

An API token is required.

export GCORE_API_KEY="{YOUR_API_KEY}"

Quickstart

The scripts below list available locations, create an S3 storage, and print the credentials.

from gcore import CDB

client = CDB()

# Step 1. List available locations and select an S3-compatible one
locations = client.storage.locations.list()
s3_location = next(loc for loc in locations if loc.type == "s3_compatible")

# Step 2. Create S3 storage — access key and secret key are returned only here
storage = client.storage.object_storages.create(
    location_name=s3_location.name,
    name="my-storage",
)
print(f"Storage ID: {storage.id}")
print(f"Endpoint:   {storage.address}")
print(f"Full name:  {storage.full_name}")
print(f"Access key: {storage.access_keys[0].access_key}")
print(f"Secret key: {storage.access_keys[0].secret_key}")

package main

import (
    "context"
    "fmt"
    "log"

    gcore "github.com/G-Core/gcore-go"
    "github.com/G-Core/gcore-go/storage"
)

func main() {
    client := gcore.NewClient()
    ctx := context.Background()

    // Step 1. List available locations and select an S3-compatible one
    locations, err := client.Storage.Locations.List(ctx, storage.LocationListParams{})
    if err != nil {
        log.Fatalf("list locations: %v", err)
    }
    var locationName string
    for _, loc := range locations.Results {
        if loc.Type == "s3_compatible" {
            locationName = loc.Name
            break
        }
    }

    // Step 2. Create S3 storage — access key and secret key are returned only here
    s3, err := client.Storage.ObjectStorages.New(ctx, storage.ObjectStorageNewParams{
        Name:         "my-storage",
        LocationName: locationName,
    })
    if err != nil {
        log.Fatalf("create storage: %v", err)
    }
    fmt.Printf("Storage ID: %d\n", s3.ID)
    fmt.Printf("Endpoint:   %s\n", s3.Address)
    fmt.Printf("Full name:  %s\n", s3.FullName)
    fmt.Printf("Access key: %s\n", s3.AccessKeys[0].AccessKey)
    fmt.Printf("Secret key: %s\n", s3.AccessKeys[0].SecretKey)
}

Step-by-step

Each step below explains what the call does, which parameters matter, and what the response looks like.

Rotate access keys

Each S3 storage supports up to two active access keys, which allows rotating credentials without downtime — create the new key first, update clients, then delete the old one. The secret key is returned only when the key is created.

Create a new access key:

from gcore import CDB

client = CDB()

storage_id = 13864

new_key = client.storage.object_storages.access_keys.create(storage_id)
print(f"New access key: {new_key.access_key}")
print(f"New secret key: {new_key.secret_key}")

package main

import (
    "context"
    "fmt"
    "log"

    gcore "github.com/G-Core/gcore-go"
)

func main() {
    client := gcore.NewClient()
    ctx := context.Background()

    var storageID int64 = 13864

    newKey, err := client.Storage.ObjectStorages.AccessKeys.New(ctx, storageID)
    if err != nil {
        log.Fatalf("create access key: %v", err)
    }
    fmt.Printf("New access key: %s\n", newKey.AccessKey)
    fmt.Printf("New secret key: %s\n", newKey.SecretKey)
}

curl -X POST "https://api.cdb-staging.cdn.orange.com/storage/v4/object_storages/$STORAGE_ID/access_keys" \
  -H "Authorization: APIKey $GCORE_API_KEY"

Response:

{
  "access_key": "0CW9Q09ART50W9XB4O13",
  "secret_key": "oO5jztJ4ewahrFGX9pMNIq0X3nfVVlfu9XVO9NLz",
  "created_at": "2026-07-13T13:07:54Z"
}

Delete the old access key after updating all clients to the new credentials:

from gcore import CDB

client = CDB()

storage_id = 13864
old_access_key = "L1M3FSX3T0B3TWDVINKT"

client.storage.object_storages.access_keys.delete(old_access_key, storage_id=storage_id)
print("Old access key deleted")

package main

import (
    "context"
    "fmt"
    "log"

    gcore "github.com/G-Core/gcore-go"
    "github.com/G-Core/gcore-go/storage"
)

func main() {
    client := gcore.NewClient()
    ctx := context.Background()

    var storageID int64 = 13864
    oldAccessKey := "L1M3FSX3T0B3TWDVINKT"

    err := client.Storage.ObjectStorages.AccessKeys.Delete(ctx, oldAccessKey, storage.ObjectStorageAccessKeyDeleteParams{
        StorageID: storageID,
    })
    if err != nil {
        log.Fatalf("delete access key: %v", err)
    }
    fmt.Println("Old access key deleted")
}

curl -X DELETE "https://api.cdb-staging.cdn.orange.com/storage/v4/object_storages/$STORAGE_ID/access_keys/$OLD_ACCESS_KEY" \
  -H "Authorization: APIKey $GCORE_API_KEY"

Returns HTTP 204 with no response body.

Create SFTP storage

SFTP storage uses a different endpoint and requires a password_mode field. Setting it to auto generates a random password returned in the creation response — the only time it is visible. Use set to provide a custom password, or none to disable password authentication and use SSH keys instead.

from gcore import CDB

client = CDB()

sftp = client.storage.sftp_storages.create(
    location_name="ams",
    name="my-sftp-storage",
    password_mode="auto",
)
print(f"Storage ID: {sftp.id}")
print(f"Hostname:   {sftp.address}")
print(f"Password:   {sftp.password}")

package main

import (
    "context"
    "fmt"
    "log"

    gcore "github.com/G-Core/gcore-go"
    "github.com/G-Core/gcore-go/storage"
)

func main() {
    client := gcore.NewClient()
    ctx := context.Background()

    sftp, err := client.Storage.SftpStorages.New(ctx, storage.SftpStorageNewParams{
        Name:         "my-sftp-storage",
        LocationName: "ams",
        PasswordMode: storage.SftpStorageNewParamsPasswordModeAuto,
    })
    if err != nil {
        log.Fatalf("create SFTP storage: %v", err)
    }
    fmt.Printf("Storage ID: %d\n", sftp.ID)
    fmt.Printf("Hostname:   %s\n", sftp.Address)
    fmt.Printf("Password:   %s\n", sftp.Password)
}

curl -X POST https://api.cdb-staging.cdn.orange.com/storage/v4/sftp_storages \
  -H "Authorization: APIKey $GCORE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"location_name": "ams", "name": "my-sftp-storage", "password_mode": "auto"}'

Response:

{
  "id": 13865,
  "name": "my-sftp-storage",
  "full_name": "1000503-my-sftp-storage",
  "location_name": "ams",
  "address": "ams.origin.gcdn.co",
  "provisioning_status": "creating",
  "has_password": true,
  "password": "SVaUEHefakmx",
  "created_at": "2026-07-13T13:08:43Z"
}

Connect to the storage using SFTP on port 2200:

sftp -P 2200 1000503-my-sftp-storage@ams.origin.gcdn.co

Delete storage

Deleting a storage permanently removes all data it contains. S3 and SFTP storages use different endpoints.

Delete S3 storage:

from gcore import CDB

client = CDB()

storage_id = 13864
client.storage.object_storages.delete(storage_id)
print("Storage deleted")

package main

import (
    "context"
    "fmt"
    "log"

    gcore "github.com/G-Core/gcore-go"
)

func main() {
    client := gcore.NewClient()
    ctx := context.Background()

    var storageID int64 = 13864

    err := client.Storage.ObjectStorages.Delete(ctx, storageID)
    if err != nil {
        log.Fatalf("delete storage: %v", err)
    }
    fmt.Println("Storage deleted")
}

curl -X DELETE "https://api.cdb-staging.cdn.orange.com/storage/v4/object_storages/$STORAGE_ID" \
  -H "Authorization: APIKey $GCORE_API_KEY"

Returns HTTP 204 with no response body.

Delete SFTP storage uses the SFTP endpoint:

from gcore import CDB

client = CDB()

sftp_id = 13865
client.storage.sftp_storages.delete(sftp_id)
print("SFTP storage deleted")

package main

import (
    "context"
    "fmt"
    "log"

    gcore "github.com/G-Core/gcore-go"
)

func main() {
    client := gcore.NewClient()
    ctx := context.Background()

    var sftpID int64 = 13865

    err := client.Storage.SftpStorages.Delete(ctx, sftpID)
    if err != nil {
        log.Fatalf("delete SFTP storage: %v", err)
    }
    fmt.Println("SFTP storage deleted")
}

curl -X DELETE "https://api.cdb-staging.cdn.orange.com/storage/v4/sftp_storages/$SFTP_ID" \
  -H "Authorization: APIKey $GCORE_API_KEY"

Returns HTTP 204 with no response body.

Provision S3-compatible and SFTP storages declaratively using the CDB Terraform provider v2.

Create S3 storage

Declares an S3 storage and an optional additional access key for zero-downtime credential rotation. The storage is provisioned with one key automatically; gcore_storage_access_key creates a second one.

resource "gcore_storage_object_storage" "example" {
  location_name = "luxembourg-2"
  name          = "my-storage"
}

# Optional: second access key for zero-downtime rotation
resource "gcore_storage_access_key" "extra" {
  storage_id = gcore_storage_object_storage.example.id
}

output "s3_endpoint" {
  value = gcore_storage_object_storage.example.address
}

output "s3_access_key" {
  value = gcore_storage_object_storage.example.access_keys[0].access_key
}

output "s3_secret_key" {
  value     = gcore_storage_object_storage.example.access_keys[0].secret_key
  sensitive = true
}

output "extra_access_key" {
  value = gcore_storage_access_key.extra.access_key
}

output "extra_secret_key" {
  value     = gcore_storage_access_key.extra.secret_key
  sensitive = true
}

# terraform import gcore_storage_object_storage.example '<storage_id>'
# terraform import gcore_storage_access_key.extra '<storage_id>/<access_key>'

terraform apply

Rotate access keys

Declare a new gcore_storage_access_key resource to create a second key. Once clients are updated to use the new credentials, remove the resource block for the old key and apply to delete it.

# Add a new key resource, update clients, then remove this block:
# resource "gcore_storage_access_key" "extra" {
#   storage_id = gcore_storage_object_storage.example.id
# }

terraform apply

Delete S3 storage

Remove both resource blocks — Terraform deletes the extra access key first, then the storage.

# Remove or comment out both blocks:
# resource "gcore_storage_access_key" "extra" { ... }
# resource "gcore_storage_object_storage" "example" { ... }

terraform apply

Create SFTP storage

Declares an SFTP storage with an auto-generated password. After apply, use full_name as the login username when connecting on port 2200.

resource "gcore_storage_sftp" "example" {
  location_name = "ams"
  name          = "my-sftp-storage"
  password_mode = "auto"
}

output "sftp_address" {
  value = gcore_storage_sftp.example.address
}

output "sftp_full_name" {
  value = gcore_storage_sftp.example.full_name
}

output "sftp_password" {
  value     = gcore_storage_sftp.example.password
  sensitive = true
}

# terraform import gcore_storage_sftp.example '<storage_id>'

terraform apply

Delete SFTP storage

Remove the resource block — Terraform deletes the storage on the next apply.

# Remove or comment out this block:
# resource "gcore_storage_sftp" "example" {
#   location_name = "ams"
#   name          = "my-sftp-storage"
#   password_mode = "auto"
# }

terraform apply

Create a storage

Open Object Storages

Start creation

Enter storage details

S3 Standard and S3 Fast

S3 management options

SFTP storage

Select a location

Enter a name

Select authentication method

Create

SFTP management options

Edit dialog

Storage status indicator

Quickstart

Step-by-step

Rotate access keys

Create SFTP storage

Delete storage

Create S3 storage

Rotate access keys

Delete S3 storage

Create SFTP storage

Delete SFTP storage