Architecture of Object Storage

STACKIT Object Storage is a fully managed, S3-compatible service backed by a distributed storage system that is physically separated from Block Storage and Backup Storage. Here is how it is implemented:

Storage model

Object Storage uses a flat namespace. You store data in buckets, and every object within a bucket is addressed by its key, a UTF-8 string unique within that bucket. There is no directory hierarchy; instead, you use key prefixes to logically organize objects. The storage system handles placement, replication, and retrieval transparently.

Regions and availability zones

Object Storage is available in dedicated regions. Within each region, your data is automatically replicated across all three Availability Zones. This replication happens transparently, you do not need to configure it.

The following diagram shows the structure of Object Storage in an example region (EU01):

Each region has a dedicated endpoint URL. You need to use the endpoint of the region where your bucket resides.

Region	Endpoint URL
EU01	https://object.storage.eu01.onstackit.cloud
EU02	https://object.storage.eu02.onstackit.cloud

All STACKIT Object Storage endpoints support TLS 1.3 encryption.

Buckets are region-specific. You can not move a bucket between regions after creation.

Addressing objects

Object Storage supports two URL styles for addressing objects. Both styles are equivalent in behavior:

Style	URL pattern
Virtual Hosted	https://[bucket_name].object.storage.eu01.onstackit.cloud/[key_name]
Path Style	https://object.storage.eu01.onstackit.cloud/[bucket_name]/[key_name]

Credentials

Object Storage uses a access key and secret key pair for authentication and authorization. Credentials are scoped to a STACKIT Project: anyone with access to the project can create credentials that grant access to all buckets in that project.

If you need to separate access between users or teams, you need to use separate STACKIT Projects, there is no per-bucket credential scoping.

You can create and manage credentials with the STACKIT Portal or the Object Storage API. To learn how, read Create and delete Object Storage credentials.

Consistency model

Object Storage provides read-after-write consistency for uploaded objects: immediately after a successful PUT, any subsequent GET returns that object. For object updates and deletions, the service provides eventual consistency.

Management

You can manage Object Storage with the STACKIT Portal, the STACKIT CLI, the STACKIT API, or any S3-compatible client:

• Enabling Object Storage for a project
• Creating and deleting buckets
• Uploading, downloading, and deleting objects
• Configuring bucket policies, versioning, life cycle rules, and CORS
• Managing credentials
• Configuring Object Lock and Compliance Lock