Overview

S3 Object Storage provides secure, scalable object storage using the industry-standard Amazon S3-compatible API.

The service can be used for:

• Backup repositories

• Immutable backups

• Archive storage

• Application data

• File and object repositories

• Long-term data retention

• S3-compatible applications

Customers can manage their S3 service through the customer portal and connect compatible applications directly to the S3 service.

S3 Endpoint

https://s3.iaasportal.com

Bucket Endpoint

https://<bucket-name>.s3.iaasportal.com

For example:

https://my-backups.s3.iaasportal.com

1. Your S3 Service

An S3 service normally consists of:

• An S3 account

• An Access Key

• A Secret Key

• One or more S3 buckets, depending on the service plan

• A storage quota

• Optional S3 Object Lock and immutable storage

The Access Key and Secret Key are used by applications to authenticate with the S3 service.

The Secret Key should be treated in the same way as a password.

Do not include your Secret Key in support tickets, emails, screenshots, documentation or other unsecured communications.

2. Connection Details

The Bloom S3 service supports the following region settings, depending on the S3 client or application being used:

• uk — Recommended: This is the native region identifier for the Bloom S3 platform and should be used wherever the application supports a custom S3-compatible region. Veeam should use uk, particularly when Automatic Bucket Creation is enabled.

• us-east-1 — Compatibility: Some S3-compatible clients require, default to, or work more reliably with a standard AWS region identifier. us-east-1 may be used for compatibility when accessing existing buckets where the client does not support the uk region.

Both region settings may therefore be encountered when configuring S3-compatible applications. Where the client supports uk, this should be used as the preferred setting.

When an application creates buckets itself, the configured region may also be submitted as the bucket's LocationConstraint. In these circumstances, uk must be used, as this matches the native region of the Bloom S3 service.

Recommended default configuration:

S3 Endpoint: https://s3.iaasportal.com
Region:      uk

Compatibility configuration where required by the client:

S3 Endpoint: https://s3.iaasportal.com
Region:      us-east-1

Bloom S3 service native object storage should be configured with the following settings:

Different applications may refer to the endpoint as:

• S3 Endpoint

• Service URL

• Server

• Object Storage Endpoint

• S3 Compatible Endpoint

These generally refer to the same S3 service address.

3. Bucket Names

A bucket is a container used to store objects and files.

When creating a bucket, use a simple DNS-compatible name.

Recommended format:

company-purpose

Examples:

company-backups

company-archive

finance-records

server-backups

Bucket names should:

• Use lowercase letters

• Use numbers where required

• Use hyphens to separate words

• Avoid spaces

• Avoid underscores

• Avoid special characters

• Avoid full stops/dots

Avoid including confidential or sensitive information in bucket names.

Bucket names must also be unique where required by the platform.

4. Creating a Bucket

Once you have completed your order via the portal by clicking 'Order' > 'Storage' > 'Object Storage' > 10TB or 100TB included service plan, buckets can be created.

Open your S3 service and select the option to manage buckets.

Enter the required bucket name and select the appropriate configuration options.

If immutable storage is required, select Object Lock when creating the bucket.

Object Lock and retention settings should be reviewed carefully before the bucket is used for production data.

5. S3 Object Lock

S3 Object Lock provides protection against accidental or unauthorised deletion of stored data.

It is particularly useful for:

• Backup repositories

• Ransomware protection

• Long-term archives

• Business records

• Data retention requirements

• Immutable backup strategies

Object Lock protects individual versions of objects for a defined retention period.

Object Lock-enabled buckets use S3 versioning to maintain protected versions of stored objects.

6. Governance Retention

Where configured, Governance retention prevents a protected object version from being modified or permanently deleted through normal S3 operations until its retention period expires.

For example, if an object is protected until:

22 January 2027

the protected version cannot normally be permanently deleted before that date.

The storage platform enforces this protection independently of the application that originally uploaded the object.

Important

Object Lock protects object versions.

An application may appear to delete an object from the normal bucket view while its protected version remains securely retained.

This is expected S3 versioning and Object Lock behaviour.

7. Retention Periods

The retention period determines how long an object version remains protected.

Depending on the service configuration, a default retention period may be defined when the bucket is created.

For example:

30 days

means a newly protected object will normally remain protected for approximately 30 days from the time the retention is applied.

Each newly uploaded object receives its own retention expiry date.

For example:

• Object A uploaded on 1 January with 30-day retention is protected until approximately 31 January.

• Object B uploaded on 10 January receives its own 30-day retention period.

• Object B therefore remains protected beyond the retention date of Object A.

Retention applies to individual object versions rather than simply to the age of the bucket.

8. Delete Markers and Deleted Objects

Object Lock-enabled buckets use S3 versioning.

When an application performs a normal delete operation against an object, S3 may create a delete marker.

For example:

backup01.zip

could contain:

• Protected Version 1

• Delete Marker

The delete marker becomes the current version, causing backup01.zip to disappear from a normal bucket listing.

The protected version has not necessarily been permanently deleted.

It continues to exist until its retention requirements permit permanent deletion.

This is normal S3 behaviour and is an important part of immutable storage.

9. Recovering a Deleted Object

If an object has been deleted from a versioned or Object Lock-enabled bucket, a previous version may still be available.

Do not assume that an object has been permanently lost simply because it is no longer displayed in the normal bucket view.

Recovery can be performed using an S3-compatible application capable of displaying object versions, or with assistance from Support.

When requesting assistance, provide:

• Service name or reference

• Bucket name

• Object name/key

• Approximate date and time of deletion

Never provide your Secret Key in a support request.

10. Choosing a Retention Period

Retention periods should be selected carefully.

A protected object continues consuming storage for the duration of its retention period and cannot normally be permanently removed until that retention expires.

For backup workloads, the S3 retention policy should be designed alongside the retention policy configured within the backup application.

For example:

Backup application retention: 30 days

S3 Object Lock retention: 90 days

The backup application may attempt to remove backup data after 30 days, but protected object versions can continue to consume storage until their 90-day S3 retention expires.

When selecting a retention period, consider:

• Backup retention requirements

• Recovery requirements

• Regulatory requirements

• Available storage capacity

• Expected daily data change

• Application behaviour

• Long-term storage requirements

If you are unsure which retention period is appropriate, contact Support before enabling long-term retention.

11. Storage Quotas

Your S3 service may have a storage quota defined by your subscription.

The quota determines the amount of storage available to the account.

With versioning and Object Lock, storage consumption can include:

• Current objects

• Previous object versions

• Protected object versions

• Objects hidden by delete markers

• Other retained data

Deleting an object from a normal bucket view therefore does not necessarily immediately reduce storage consumption.

When using immutable storage, ensure that sufficient capacity is available for the complete retention period.

12. Bucket Limits

Your service plan may specify the maximum number of buckets that can be created.

Where customer bucket management is enabled, the customer portal will provide the available bucket-management options.

If additional buckets or storage capacity are required, contact Support.

13. Connecting Using AWS CLI

Advanced users can connect using the AWS Command Line Interface or another S3-compatible command-line tool.

Create a dedicated profile:

aws configure --profile s3-storage

Enter your:

AWS Access Key ID

Your S3 Access Key

AWS Secret Access Key

Your S3 Secret Key

Default region

us-east-1

Default output format

json

To list available buckets:

aws s3api list-buckets --endpoint-url https://s3.iaasportal.com --profile s3-storage

To list objects within a bucket:

aws s3api list-objects-v2 --bucket YOUR-BUCKET --endpoint-url https://s3.iaasportal.com --profile s3-storage

Replace YOUR-BUCKET with the actual bucket name.

14. Connecting Backup Applications

When configuring backup software, select an option such as:

S3 Compatible Storage

where the application provides a separate option for third-party S3-compatible services.

Configure the following:

Endpoint

https://s3.iaasportal.com

Access Key

Your S3 Access Key

Secret Key

Your S3 Secret Key

Bucket

The bucket allocated to or created for the application

HTTPS / SSL

Enabled

Region

us-east-1 where the application requires a region

The exact terminology varies between applications.

15. Using Object Lock with Backup Software

If your backup application supports S3 Object Lock or immutable object storage, ensure its configuration is compatible with the retention policy configured on the S3 bucket.

Do not assume that the backup application's normal retention policy overrides S3 Object Lock.

For example:

Backup retention: 30 days

Object Lock retention: 90 days

The backup application may request deletion after 30 days, but the protected versions can remain stored until their S3 retention expires.

This can result in higher storage consumption than indicated by the backup application's normal retention settings.

16. Security Recommendations

When using S3 storage:

• Keep your Secret Key confidential.

• Never send your Secret Key in a support ticket.

• Do not embed credentials directly into scripts where avoidable.

• Use your application's secure credential store.

• Always use HTTPS.

• Restrict access to systems containing S3 credentials.

• Use separate credentials for different applications where available.

• Rotate credentials if you believe they have been exposed.

• Remove credentials that are no longer required.

• Use immutable storage for appropriate backup and archive workloads.

• Regularly test data recovery.

If an Access Key or Secret Key may have been compromised, stop using the affected credentials and contact Support to arrange replacement.

17. Troubleshooting

Unable to Connect

Confirm the endpoint is:

https://s3.iaasportal.com

Confirm that:

• HTTPS is enabled.

• Port 443 is permitted through your firewall.

• The endpoint has been entered correctly.

• The application supports S3-compatible storage.

Authentication Failed

Check the Access Key and Secret Key configured within the application.

Credentials are case-sensitive.

Do not send your Secret Key to Support when reporting an authentication problem.

Bucket Not Found

Confirm:

• The bucket name is correct.

• The correct S3 account credentials are being used.

• The application is configured for the correct endpoint.

Application Requires a Region

Where a region is mandatory, use:

us-east-1

unless you have been provided with different settings for your service.

Object Cannot Be Deleted

If Object Lock is enabled, the object version may still be within its configured retention period.

This is expected behaviour.

Deleted Object Still Consumes Storage

Previous versions of the object may still exist because of S3 versioning or Object Lock.

A delete marker can hide an object without removing the protected underlying version.

Backup Software Cannot Remove Old Backups

Compare the Object Lock retention period configured for the bucket with the retention period configured within the backup application.

S3 Object Lock may be preventing permanent deletion of protected versions.

18. Before Using Immutable Storage

Before using Object Lock with production data:

1. Determine the required retention period.

2. Confirm the application supports S3-compatible immutable storage.

3. Confirm the application's retention policy is compatible with the S3 retention period.

4. Estimate storage requirements across the complete retention period.

5. Test backup operations.

6. Test restore operations.

7. Test object/version recovery.

8. Confirm your organisation's retention requirements.

Object Lock should be treated as a data-protection control rather than simply a storage setting.

Once an object version is protected, normal deletion operations cannot be relied upon to immediately remove it.

19. Quick Reference

20. Getting Support

If assistance is required, contact Support via email to support@iaasportal.com or ticket via the portal and provide:

• Service name or reference

• Bucket name

• Application or backup product

• Application version

• Relevant error message

• Approximate date and time of the problem

• Screenshots where appropriate

• Relevant application logs where appropriate

Before submitting screenshots or logs, check that they do not contain passwords, Secret Keys or other credentials.

Never include your S3 Secret Key in a support request.