Storage buckets (S3)

Buckets give your server an S3-compatible API, so backup tools, apps and scripts that speak S3 can store files on your own hardware: rclone, the AWS CLI, restic, Cyberduck and every AWS SDK.

Every bucket is a folder in your Drive. Objects are ordinary files under it, so you can browse, preview, search and share them like anything else, and they count toward your storage like any upload.

Make a bucket

1. Open the Buckets app and click New bucket.
2. Pick a name: 3 to 63 lowercase letters, numbers and hyphens, unique on the server.
3. Choose where it lives: a new folder (in a Buckets folder at the top of My Drive or a space), a folder you already have (its files become objects), or a folder on another drive.
4. Choose who can read it: only with an access key, or anyone with the address.
5. Make an access key. Copy the secret right away: it's shown once.

Keys are read-only or read and write, can be limited to IP addresses, and are revoked with one click. A key made under Keys for all buckets works on every bucket you manage, and can be allowed to create buckets.

Addresses

• https://drive.example.com: the endpoint for rclone, the AWS CLI, restic and Cyberduck. Requests signed with AWS Signature V4 are recognized at the top of the address.
• https://drive.example.com/s3: the same API at a path, for SDKs and browsers, with path-style addressing.
• An admin can set an S3 address of its own (Admin > Domains & addresses), like s3.example.com, which adds virtual-host style (my-bucket.s3.example.com).

The region is us-east-1. Clients that sign with auto work too.

rclone

[stavo]
type = s3
provider = Other
access_key_id = YOUR-ACCESS-KEY-ID
secret_access_key = YOUR-SECRET-ACCESS-KEY
endpoint = https://drive.example.com
region = us-east-1
force_path_style = true
acl = private
upload_cutoff = 64M
chunk_size = 64M

rclone lsd stavo:
rclone copy ~/Pictures stavo:my-bucket/pictures --progress
rclone sync ./site stavo:my-bucket/site --progress

AWS CLI

# ~/.aws/credentials
[stavo]
aws_access_key_id = YOUR-ACCESS-KEY-ID
aws_secret_access_key = YOUR-SECRET-ACCESS-KEY

# ~/.aws/config
[profile stavo]
region = us-east-1
endpoint_url = https://drive.example.com
s3 =
  addressing_style = path
  multipart_threshold = 64MB
  multipart_chunksize = 64MB

aws --profile stavo s3 ls s3://my-bucket/
aws --profile stavo s3 cp ./backup.tar.gz s3://my-bucket/backups/
aws --profile stavo s3 sync ./site s3://my-bucket/site --delete

AWS SDK for JavaScript

import { S3Client, PutObjectCommand } from "@aws-sdk/client-s3";

const s3 = new S3Client({
  region: "us-east-1",
  endpoint: "https://drive.example.com/s3",
  forcePathStyle: true,
  credentials: { accessKeyId: "YOUR-ACCESS-KEY-ID", secretAccessKey: process.env.STAVO_S3_SECRET },
});

await s3.send(new PutObjectCommand({ Bucket: "my-bucket", Key: "hello.txt", Body: "Hello" }));

Presigned URLs from @aws-sdk/s3-request-presigner work for downloads and for uploads straight from a browser (add a CORS rule for your site).

restic

export AWS_ACCESS_KEY_ID=YOUR-ACCESS-KEY-ID
export AWS_SECRET_ACCESS_KEY=YOUR-SECRET-ACCESS-KEY
restic -r s3:https://drive.example.com/my-bucket/restic -o s3.bucket-lookup=path init
restic -r s3:https://drive.example.com/my-bucket/restic -o s3.bucket-lookup=path backup ~/Documents

Cyberduck

Open Connection, choose Amazon S3, server drive.example.com, port 443, and your access key and secret. Under More Options set the path to /my-bucket.

Behind Cloudflare Tunnel

Cloudflare refuses single requests over 100 MB. Big files go up in parts (multipart uploads), which rclone, the AWS CLI and the SDKs do on their own; the settings above keep each part at 64 MB. On your own network there's no limit besides the server's upload size.

Keys and the Drive

A key like photos/2026/beach.jpg is the file beach.jpg in the folders photos/2026. S3 keys are exact and can hold things a file name can't, so those parts are escaped in the Drive: control characters, backslashes and spaces at either end become %XX codes, an empty part (as in a//b) is %, and very long parts are shortened with a short hash at the end. S3 tools always get back the exact key. A key ending in / with no bytes is the folder itself.

Changes made in the Drive show up in S3: files you add become objects named by their path, renamed or moved files get their new path, and files you delete or move out of the folder stop being objects. Saving over a key keeps the old version in the file's history. Deleted objects go to the Trash unless you turn that off (handy for backup tools that prune a lot).

Permissions, CORS and lifecycle

• Private (only keys and signed links), Public, or Public for some prefixes like images/.
• CORS rules for web pages on other sites, in the app or with PutBucketCors.
• Lifecycle rules: delete objects after a number of days, move them to the Archive (off your devices, still readable over S3), or drop unfinished multipart uploads. Unfinished uploads older than 30 days are dropped anyway.

What works

ListBuckets, CreateBucket, HeadBucket, DeleteBucket, GetBucketLocation, ListObjects (v1 and v2, with prefixes, delimiters, pagination and URL encoding), GetObject (ranges, conditions, response overrides), HeadObject, PutObject (Content-MD5, checksums, metadata), CopyObject, DeleteObject, DeleteObjects, multipart uploads (with UploadPartCopy), presigned URLs, aws-chunked uploads, bucket CORS and lifecycle.

Not supported: object versions, tags, object lock, ACLs other than private, bucket policies (use Permissions in the app), browser POST uploads and Signature Version 2.

Stats, backups and switches

Each bucket shows requests and bytes per day. Bucket changes and keys are in the activity log; single objects aren't. Buckets are part of off-site backups like the rest of the Drive (a bucket on another drive follows that drive's setting). An admin can turn Storage buckets off, or limit them to some people, in Admin > Features. For fast public delivery, see CDN. Stavo keeps your files in plain folders either way.