S3 compatibility
What works, what works partly, and what does not. Every claim on this page is tested: the Ceph s3-tests suite, the conformance suite S3-compatible servers are measured with, runs against a real VaultS3 server on every change to the code.
323
Ceph s3-tests that must pass on every change
323 of 836
passing in the full suite, the rest listed below
SigV4
header and presigned, streaming and trailers
How it is tested
The 323 tests that cover what VaultS3 implements are a gate: a change that breaks one of them does not ship. The full suite, all 836 tests, runs every week and reports tests that have started to pass, which are then added to the gate. Most of the 513 that do not pass test the features listed as partial or missing below. The list of gated tests and the runner are in the repository.
Real clients are tested too, over HTTP and HTTPS, with checksums, multipart and signed streaming uploads:
- AWS CLI v2
- boto3
- AWS SDK for Go v2
- MinIO client (mc) and minio-go
- rclone
Supported
Objects
- PutObject, GetObject, HeadObject, DeleteObject, CopyObject
- Range and conditional requests (If-Match, If-None-Match, If-Modified-Since), including conditional PUT
- GetObject by part number, GetObjectAttributes
- Object tagging, user metadata and content headers
- Presigned POST: browser form uploads signed with a POST policy (SigV4), with every condition, checksum and tagging field checked
- Browser form upload signed with an Authorization header
Multipart upload
- Create, UploadPart, UploadPartCopy, Complete, Abort
- ListMultipartUploads, ListParts
Buckets and listing
- CreateBucket, DeleteBucket, HeadBucket, ListBuckets, GetBucketLocation
- ListObjectsV2 and ListObjects (V1), ListObjectVersions, DeleteObjects
Versioning and object lock
- Bucket versioning, including suspend
- Object lock: GOVERNANCE and COMPLIANCE retention, legal hold, bucket default retention
Integrity and encryption
- Checksums CRC32, CRC32C, CRC64NVME, SHA1 and SHA256, as a header or an aws-chunked trailer
- Signed streaming uploads: every chunk and trailer signature is checked
- Content-MD5 and x-amz-content-sha256 checked against the body
- SSE-S3, SSE-KMS, SSE-C, and default bucket encryption
Access
- AWS Signature V4, in the Authorization header and as presigned URLs
- Bucket policies, IAM users, groups and policies, STS temporary credentials
- Public access block
Bucket configuration
- CORS, website hosting, bucket tagging, event notifications, replication
Other
- S3 Select over CSV, JSON and Parquet (records up to 1 MiB, as on AWS; up to 64 MiB of uncompressed input per request)
Partly supported
- Lifecycle
- One rule per bucket: expiring objects a number of days after they are written, optionally under a prefix, and aborting incomplete multipart uploads. Multiple rules, tag, And and size filters, expiration by date, noncurrent-version expiration, ExpiredObjectDeleteMarker and transitions are refused with NotImplemented, so a configuration is never silently half-applied.
- ACLs
- ACL requests are accepted so clients that send them keep working, but ACLs are not applied. Access is decided by IAM and bucket policies: to make objects public, use a bucket policy.
- Bucket logging
- The logging configuration is stored and returned, but access logs are not written to the target bucket. The audit trail in the dashboard records requests instead.
- Cold tier
- Objects not read for a set number of days move to a cold directory and are still read from there, encrypted and compressed as they were (5.0.12). RestoreObject moves one back. Single node only, not with erasure coding or small-file packing, and not for versioned objects.
- SSE-C on versioned buckets
- Refused with NotImplemented. SSE-C works on buckets without versioning.
- Virtual-hosted URLs
- bucket.s3.example.com style needs VAULTS3_DOMAIN to be set. Path-style URLs work without it.
Not supported
- Signature V2
- Only Signature V4 is accepted, for requests and for presigned POST forms. Every current SDK uses V4.
- Storage classes and lifecycle transitions
- Objects have one storage class. Tiering to a cold directory is a server setting, not an S3 transition.
- Inventory, analytics, metrics and Intelligent-Tiering configurations
- Not implemented. Prometheus metrics at /metrics cover the operational side.
- Transfer acceleration, requester pays, Object Lambda, directory buckets
- AWS-specific features with no equivalent on a self-hosted server.
Accurate for VaultS3 5.0.16. The full operation list is in docs/S3-API.md. Something missing that you need? Open an issue, or see moving from MinIO.
Spin it up in 30 seconds
One binary or one container. No license key, no account, no telemetry. Just object storage that works.