Discuss with expertTry it for free
© 2026 Direct Cursus Technology L.L.C.

FAQ about Object Storage

Written by
Improved by
Updated at November 12, 2026
View in Markdown

What is Yandex Object Storage?

Yandex Object Storage is a universal scalable solution for data storage. It is equally effective for high-load services requiring reliable and fast access to data as well as for projects that do not need any complex storage infrastructure.

What can I do with Yandex Object Storage?

With Object Storage, you can:

  • Store your project (website or server app) files in Object Storage with public or private access to them. The files can be of any format.
  • Store large archive data (up to 5 TB per file) and make them available based on access permissions.
  • Enable shared work with data inside a distributed organization.
  • Make your data accessible from anywhere in the world where there is internet.

How do I get started with Yandex Object Storage?

To get started with Object Storage:

  1. Sign up for Yandex Cloud.
  2. Create a folder.
    At this step, you can already use Object Storage via the Yandex Cloud management console. You can create and delete buckets, as well as upload objects to and download them from buckets.
  3. Get static keys to use the Object Storage HTTP API or ready-made SDKs and apps.

You can find a more detailed guide in Getting started with Yandex Object Storage and How to use the S3 API.

What data formats can I store?

You can store data in any format. Yandex Object Storage saves data in its original form without any modification.

How can I leave feedback on Yandex Object Storage?

Use the feedback form in the support center.

How do I contact support?

You can contact technical support from the management console in the Support section.

How much data can I store?

See Object Storage quotas and limits.

Why are objects not uploading, even though the maximum bucket size has not been reached yet?

Your cloud's Storage volume quota (storage.volume.size) may be exhausted. The management console may display this error message: We encountered an internal error, please try again.

Maximum bucket size limits data size in an individual bucket, whereas the storage.volume.size quota limits total data size across all buckets in the cloud. Increasing the maximum bucket size does not change the cloud quota.

For example, if the maximum bucket size is 500 GB and the cloud quota is 100 GB, new object uploads may fail once 100 GB total size is reached across all the cloud's buckets.

  1. View the storage.volume.size quota value and consumption for the cloud the bucket resides in.
  2. If the quota is exhausted or the remaining amount is not enough for the upload, request a quota increase.
  3. After the quota is increased, reupload the objects.

How can I delete multiple objects at a time?

You can delete multiple objects via the Yandex Cloud management console or the API using the deleteMultipleObjects method.

A service account cannot access a bucket, why is that?

Make sure the service account has the role that allows accessing the bucket.

If encryption is enabled for the bucket, assign the service account the kms.keys.encrypterDecrypter role for the KMS key used to encrypt the bucket. You can do this, for example, using the following CLI command:

yc kms symmetric-key add-access-binding \
  --id <key_ID> \
  --service-account-id <service_account_ID> \
  --role kms.keys.encrypterDecrypter

Where:

  • --id: KMS key ID.
  • --service-account-id: Service account ID.

What does Yandex Cloud do with the data I store in Yandex Object Storage?

The data is saved in the original form as transmitted by the user.

Does Yandex use Object Storage to store its own data?

Yes. Object Storage is used in the Yandex infrastructure. A number of Yandex services store their websites' static data in Object Storage.

What data consistency model does Yandex Object Storage use?

For overwritable (PUT) and removable (DELETE) objects, the strong consistency model is used.

What AWS S3 features does Yandex Object Storage support?

Object Storage supports:

  • Authorization using static tokens.
  • Some HTTP API methods. For a full list of supported methods, see the API reference.

Where is my data stored?

How is my data protected in Yandex Object Storage?

Physical media are located in Yandex Cloud data centers, which are high-security facilities.

Data is stored in an encrypted format and none of those who have access to the physical media can read the data.

By default, the storage is accessed via HTTPS.

What does the speed of data upload and download in Yandex Object Storage depend on?

The Object Storage response time depends on multiple factors:

  • Client-side performance: network speed, CPU load, or disk subsystem load.
  • Speed of trunks, data center interconnects, or client-server connections.
  • Performance of Object Storage itself.

This is why we cannot specify a particular response time value. However, we keep track of spikes in the response time and dips in the speed of sending data, and strive to improve the Object Storage performance.

Can I get logs of my operations in Yandex Cloud?

Yes, you can request information about operations with your resources from Yandex Cloud logs. Do it by contacting support.

How do I add my own domain to an Object Storage bucket?

To add your domain to a bucket:

  1. Create a bucket with the same name as your domain.

  2. Configure the bucket as hosting.

  3. On your DNS server, create a CNAME record to link your domain to the bucket.

  4. (Optional) Add your own certificate to Certificate Manager or issue a free-of-charge Let's Encrypt certificate.

  5. Configure HTTPS by linking a Certificate Manager certificate to your bucket or uploading your own.

Once you successfully complete all the steps, you will have access to objects via links in <domain_name>/<object_key> format.

Why did I lose access to the bucket after creating/updating a bucket policy?

If you get the Access Denied error after configuring an access policy or the list of objects is not displayed, check the policy rules.

The possible causes include:

  • Bucket policies treat objects within a bucket and the bucket itself as different resources. For a bucket policy rule to apply both to the bucket and the objects in it, specify them as separate resources, e.g., samplebucket and samplebucket/*.

  • If a bucket policy with no rules is applied to the bucket, access is denied to all users. To disable request verification for a bucket policy, delete it.

  • If a Apache Hive™ Metastore or Yandex Managed Service for Apache Airflow™ cluster uses a bucket with the bucket policy configured, the cluster will not be able to write or read to/from the bucket without a service account with the appropriate role. For more information, see the Apache Hive™ Metastore and Managed Service for Apache Airflow™ guides.

How do I get access to Object Storage from a Virtual Private Cloud cloud network?

For resources hosted in a VPC cloud network and having no public IP address or internet access, you can set up a connection to Object Storage via an API endpoint. The FQDN of the endpoint will be translated to a public IP address using DNS.

Do objects uploaded to a bucket get scanned for sensitive data and malicious code?

Object Storage does not scan uploaded objects for sensitive data or malicious code.

Implement your own malicious code checks before uploading objects to a bucket.

To discover sensitive data in a bucket, use Data Security Posture Management (DSPM) in Yandex Security Deck.

How do I fix an incorrect MIME type of objects when uploading them to a bucket?

If the bucket is used for website hosting, an incorrect object MIME type may cause website errors, such as unrendering images or failing scripts.

In such cases, the developer console of your browser shows invalid MIME type errors for objects uploaded from the bucket.

Depending on the method of uploading objects to the bucket, the Content-Type header may be set automatically, but not always correctly, e.g., to text/plain instead of text/css, or to the default binary/octet-stream.

To avoid errors, explicitly set the Content-Type header when uploading objects to the bucket:

If you do not have the Yandex Cloud CLI yet, install and initialize it.

The folder used by default is the one specified when creating the CLI profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also specify a different folder for any command using --folder-name or --folder-id.

If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. See the description of the command for uploading an object:

    yc storage s3api put-object --help

  2. Upload your file with an explicitly specified MIME type:

    yc storage s3api put-object \
  --bucket <bucket_name> \
  --key <object_key> \
  --body <local_file_path> \
  --content-type "application/javascript"

    Where --bucket and --key are the required parameters: bucket name and object key. The --body parameter sets the path to the file to upload. The optional --content-type parameter explicitly sets the MIME type. The example uses the type for JavaScript.

aws s3 cp \
  <local_file_path> \
  s3://<bucket_name>/ \
  --no-guess-mime-type \
  --content-type "application/javascript" \
  --endpoint-url=https://storage.yandexcloud.net

s3cmd put \
  --no-guess-mime-type \
  --no-mime-magic \
  --mime-type="application/javascript" \
  <local_file_path> \
  s3://<bucket_name>/

You can also change the Content-Type header for already uploaded objects. Here is an example:

aws s3 cp \
  s3://<bucket_name>/ \
  s3://<bucket_name>/ \
  --exclude '*' \
  --include '*.js' \
  --no-guess-mime-type \
  --content-type="application/javascript" \
  --metadata-directive="REPLACE" \
  --recursive \
  --endpoint-url=https://storage.yandexcloud.net

s3cmd modify \
  --recursive \
  --exclude '*' \
  --include '*.js' \
  --no-guess-mime-type \
  --no-mime-magic \
  --mime-type="application/javascript" \
  s3://<bucket_name>/

How do I configure a cache-control header for objects in a bucket?

The Cache-Control header is an object’s system metadata. You can specify it when uploading the object or update it for an already uploaded object.

You can use s3cmd to add the header when uploading the file:

s3cmd --add-header 'Cache-Control:max-age=3600' \
  put <local_file_path> s3://<bucket_name>/<object_key>

For an already uploaded object:

s3cmd --add-header 'Cache-Control:max-age=3600' \
  modify s3://<bucket_name>/<object_key>

Example of uploading via the AWS CLI:

aws --endpoint-url=https://storage.yandexcloud.net s3 cp \
  <local_file_path> s3://<bucket_name>/<object_key> \
  --cache-control 'max-age=3600'

In the examples above, the caching time is 3,600 seconds.

How do I copy bucket contents to another bucket?

You can copy bucket content to another bucket in the same folder, other folder, cloud, or organization. To do this, you need read permissions for the source bucket objects and write permissions for the target bucket. When copying all objects, you also need access to the list of objects in the source.

Example for the AWS CLI:

aws --endpoint-url=https://storage.yandexcloud.net s3 cp \
  s3://<source_bucket>/ s3://<target_bucket>/ \
  --recursive

For copying between organizations, the following approaches are available:

  • Using the Yandex Cloud CLI, on behalf of a Yandex account that has the required permissions in both organizations:

    yc storage s3 cp \
  s3://<source_bucket>/ s3://<target_bucket>/ \
  --recursive

    Before running the command, install and configure the CLI.

  • Using the AWS CLI, on behalf of a service account with permissions for the target bucket if public reading of objects and their list is allowed in the source bucket. This approach is suitable only for data that can be made publicly available.

If the objects are not encrypted, they are copied on the server side, including copying between organizations. For encrypted objects, there are certain nuances described in Copying an object.

Commands copy objects and save them in the source bucket. When data is migrated, source objects are deleted separately once their copy is verified.

How do I restore deleted objects?

If versioning was enabled during the object upload and the required version is preserved, you can restore it.

If the object could not be restored, create a support request. Specify the bucket name, approximate date and time of the deletion, names of the objects, and links to them.

Warning

Support does not guarantee recovery of the data deleted by the user. While engineers are working on the request, do not write new data to the affected bucket.

How do I change the storage class of objects?

A storage class specified in bucket properties applies to new objects only if the upload tool does not explicitly specify another class. For example, by default, you can upload a standard class object to an ice class bucket.

For already uploaded objects, changing the bucket setting does not change the storage class. To change it, you can:

  • Set up lifecycle rules for transition to a colder storage class.
  • Reupload the object with the required class or copy it using the same key, indicating the new class using an S3 client.

How do I allow reading objects only from Cloud CDN networks?

You can restrict access to objects by using a bucket policy that allows read access only from the Yandex Cloud CDN subnets.

The list of subnets periodically changes. The script below retrieves the current list, merges adjacent ranges, and generates the policy in JSON format. All ranges are in a single aws:SourceIp condition and use the OR logic.

Policy generation script

Save the code to the cdn-bucket-policy.py file:

import argparse
import ipaddress
import json
import urllib.request

parser = argparse.ArgumentParser()
parser.add_argument("--bucket", required=True)
parser.add_argument("--source", required=True)
args = parser.parse_args()

with urllib.request.urlopen(args.source, timeout=30) as response:
    prefixes = json.load(response)["prefixes"]

if not prefixes:
    raise ValueError("List of CDN subnets empty")

networks = [ipaddress.ip_network(prefix) for prefix in prefixes]
cidrs = []
for version in (4, 6):
    cidrs.extend(
        str(network)
        for network in ipaddress.collapse_addresses(
            network for network in networks if network.version == version
        )
    )

policy = {
    "Version": "2012-10-17",
    "Statement": [{
        "Sid": "AllowCloudCDNOnly",
        "Effect": "Allow",
        "Principal": "*",
        "Action": "s3:GetObject",
        "Resource": f"arn:aws:s3:::{args.bucket}/*",
        "Condition": {"IpAddress": {"aws:SourceIp": cidrs}},
    }],
}
print(json.dumps(policy, indent=2, ensure_ascii=False))

Run the script using Python 3 with the bucket name specified:

python3 cdn-bucket-policy.py --bucket <bucket_name> \
  --source https://tech.cdn.yandex.net/prefixes/yc.json > policy.json

Check the resulting file and apply the policy to the bucket. The script only creates a JSON file without changing the bucket settings.

The policy allows read-only access to objects from the CDN networks. Other operations, including access via the management console, require separate rules. If the bucket already has a policy, consider its rules when making your changes: other allow rules may open read access to addresses outside the CDN networks as well.

Rerun the script from time to time and update the bucket policy to accommodate the changes made to the list of subnets.

How do I fix the SignatureDoesNotMatcherror?

The The request signature we calculated does not match the signature you provided error may occur when working via an S3 client or SDK if you specified a wrong static access key. Check the ID and secret part of the key as well as their format in client settings.

Repeat the operation using the AWS CLI with the --debug parameter for diagnostics. The output will show intermediate results of signature calculation that you can use to identify the error cause.

If the error persists, create a support ticket and attach the debug output. Before sending, delete all secret keys and other confidential information from it.

Why do I get the Bucket is not emptyerror when deleting a bucket?

You can only delete an empty bucket. The Bucket is not empty error occurs if it still contains objects, their versions, deletion markers, or incomplete multipart uploads.

To clean up the bucket:

You can also configure the cleanup using lifecycle rules. They are processed asynchronously, so it may take some time to free up the bucket.

Why does the OPTIONS request return error 403 without the Access-Control-Allow-Origin header?

Check the CORS configuration in the bucket and the OPTIONS request headers:

  • The Origin header must contain the request source, e.g., https://example.com allowed in AllowedOrigin.
  • The Access-Control-Request-Method header must contain the further request method allowed in AllowedMethod.
  • If the request provides Access-Control-Request-Headers, the listed headers must be allowed in AllowedHeader. To allow all headers, * is used.

If the source or method is not allowed, Object Storage returns error 403 without Access-Control-* headers.

How do I fix the certificate error when using my own domain?

Theerr_cert_common_name_invalid and ssl_error_bad_cert_domain errors may occur when the CNAME record for the website domain points to <bucket_name>.storage.yandexcloud.net. For website hosting, it must point to <bucket_name>.website.yandexcloud.net.

Check the CNAME record and HTTPS setting: certificate must match the website domain.

Why do I get the BucketAlreadyExistserror when creating a bucket?

The 409 BucketAlreadyExists error means that the bucket name is already taken. Bucket names are unique within the region and its endpoint, including between folders, clouds, and organizations.

Select another name and repeat the creation attempt. The naming requirements are provided in Bucket naming rules.

Previous
Release notes