From a1325ac334226af9a4f2a301976a3e9cfc306d8b Mon Sep 17 00:00:00 2001 From: Samy OUBOUAZIZ Date: Fri, 21 Aug 2026 15:54:18 +0200 Subject: [PATCH 01/17] feat(vpc): add doc on private access --- .../object-storage/api-cli/bucket-policy.mdx | 25 +++- .../enable-object-storage-private-access.mdx | 136 ++++++++++++++++++ pages/vpc/menu.ts | 4 + 3 files changed, 164 insertions(+), 1 deletion(-) create mode 100644 pages/vpc/how-to/enable-object-storage-private-access.mdx diff --git a/pages/object-storage/api-cli/bucket-policy.mdx b/pages/object-storage/api-cli/bucket-policy.mdx index ea11a47d32..401aaf1780 100644 --- a/pages/object-storage/api-cli/bucket-policy.mdx +++ b/pages/object-storage/api-cli/bucket-policy.mdx @@ -532,7 +532,7 @@ To view the bucket policy action corresponding to each Object Storage API operat : `Statement` **Condition keys** -: `aws:SourceIp`, `aws:Referer`, `aws:CurrentTime`, `aws:EpochTime`, `aws:SecureTransport`, `s3:prefix` +: `aws:SourceIp`, `aws:SourceVpc`, `aws:Referer`, `aws:CurrentTime`, `aws:EpochTime`, `aws:SecureTransport`, `s3:prefix` **Examples** @@ -632,6 +632,29 @@ To view the bucket policy action corresponding to each Object Storage API operat } ``` +* You can restrict access to the resources of a given VPC with the `aws:SourceVpc` condition key. This condition key requires [private access for Object Storage](/vpc/api-cli/enable-object-storage-private-access/) to be enabled on the VPC: + +```json +{ + "Version": "2023-04-17", + "Id": "MyBucketPolicy", + "Statement": [ + { + "Sid": "Allow access from my VPC only", + "Effect": "Allow", + "Principal": "*", + "Action": ["s3:ListBucket", "s3:GetObject"], + "Resource": ["", "/*"], + "Condition": { + "StringEquals": { + "aws:SourceVpc": "" + } + } + } + ] +} +``` + #### Supported condition operators - `Bool` diff --git a/pages/vpc/how-to/enable-object-storage-private-access.mdx b/pages/vpc/how-to/enable-object-storage-private-access.mdx new file mode 100644 index 0000000000..6eb76177e0 --- /dev/null +++ b/pages/vpc/how-to/enable-object-storage-private-access.mdx @@ -0,0 +1,136 @@ +--- +title: Configuring private access for Object Storage +description: Learn how to enable private access for Object Storage on a Scaleway VPC, and how to restrict bucket access to your VPC with an aws:SourceVpc bucket policy condition. +tags: vpc object-storage private-access endpoint s3-integration bucket-policy aws-sourcevpc private-network +dates: + validation: 2026-08-21 + posted: 2026-08-21 +--- +import Requirements from '@macros/iam/requirements.mdx' +import ImportantBucketPolicy from '@macros/storage/important-bucket-policy.mdx' + + +Private access for Object Storage creates a private connection path between a VPC and Object Storage buckets. Instead of reaching buckets over the public internet, traffic from your resources transits over the internal Scaleway network. + +When the feature is enabled, all buckets in the region of the VPC are reachable privately from the selected Private Networks. Access relies on two independent components, and a request is accepted only if both coditions are satisfied: + +- the request comes from a resource in a Private Network within a VPC with private access enabled +- the [bucket policy](/object-storage/api-cli/bucket-policy/) of the target bucket explicitly allows the request. + + + +- A Scaleway account logged into the [console](https://console.scaleway.com) +- [Owner](/iam/concepts/#owner) status or [IAM permissions](/iam/concepts/#permission) allowing you to perform actions in the intended Organization +- A valid [API key](/iam/how-to/create-api-keys/) +- A [VPC](/vpc/how-to/create-vpc/) with at least one [Private Network](/vpc/how-to/create-private-network/) +- An [Object Storage bucket](/object-storage/how-to/create-a-bucket/) in the region of the VPC + +## How private access works + +Private access for Object Storage relies on two components, configured in two different sections of the Scaleway console: + +- The ¨**private access** feature in a VPC allows the selected Private Networks of that VPC to reach Object Storage without transiting over the public internet. + +- The bucket policy is the authorization layer. Enabling the endpoint applies no restriction at bucket level: buckets remain reachable both from the internet and from the VPC. To reject public traffic, apply a bucket policy with the `aws:SourceVpc` condition matching the ID of your VPC. + + +Both components are required to obtain private and restricted access. Neither component is sufficient on its own. + + +The two configuration steps are independent, and you can perform them in any order. + +## How to enable the Object Storage endpoint on a VPC + +This step creates a dedicated access path to the Object Storage service from the VPC. It can be performed from the settings of your VPC in the [Scaleway console](https://console.scaleway.com/), or via the [VPC API](https://www.scaleway.com/en/developers/api/vpc/s3-integration/). + + +Enabling the Object Storage endpoint on a VPC triggers the billing of the feature. + + +1. Enable the endpoint on the VPC, using the [Enable S3 integration](https://www.scaleway.com/en/developers/api/vpc/s3-integration#enable-s3-integration) API call: + + ```bash + curl -X POST \ + -H "X-Auth-Token: $SCW_SECRET_KEY" \ + "https://api.scaleway.com/vpc/v2/regions/{region}/s3-integration/{vpc_id}/enable" + ``` + +2. Add each Private Network that must benefit from the private path: + + ```bash + curl -X POST \ + -H "X-Auth-Token: $SCW_SECRET_KEY" \ + -H "Content-Type: application/json" \ + -d '{"private_network_id":"6170692e-7363-616c-6577-61792e636f6d"}' \ + "https://api.scaleway.com/vpc/v2/regions/{region}/s3-integration/{vpc_id}/private-networks" + ``` + + The resources attached to these Private Networks can now reach the buckets of the region privately. + +## How to restrict bucket access to a VPC + +When the endpoint is enabled, every bucket of the region whose bucket policy allows it is reachable from the VPC. To limit the access to a bucket to your VPC only, apply a bucket policy with the `StringEquals` condition and the `aws:SourceVpc` condition key. + + + +1. Click **Object Storage** in the **Storage** section of the [Scaleway console](https://console.scaleway.com/) side menu. The list of your buckets displays. +2. Click the name of the bucket to restrict, then open the **Bucket policy** tab. +3. Create a bucket policy that allows access from your VPC only. In the example below, resources coming from the `vpc-1a2b3c4d` VPC are allowed to perform the `s3:ListBucket` and `s3:GetObject` actions: + + ```json + { + "Version": "2023-04-17", + "Id": "MyBucketPolicy", + "Statement": [ + { + "Sid": "AllowAccessFromSpecificVPC", + "Effect": "Allow", + "Principal": "*", + "Action": ["s3:ListBucket", "s3:GetObject"], + "Resource": ["", "/*"], + "Condition": { + "StringEquals": { + "aws:SourceVpc": "" + } + } + } + ] + } + ``` + +4. Replace the `` placeholders with the name of the bucket, and the `` placeholder with the ID of the VPC on which the endpoint is enabled. +5. Save the bucket policy. Any request that does not come from the specified VPC is denied. + + +See the [bucket policies overview](/object-storage/api-cli/bucket-policy/) for more information on the syntax and the elements of a bucket policy. + + +## Behaviors to be aware of + +### A bucket without a bucket policy remains publicly accessible + +Enabling the endpoint on a VPC does not restrict access on its own. Without a bucket policy, the bucket remains reachable from the internet, as well as from the Private Networks of the VPC. + +### The Scaleway console accesses buckets over the internet + +When a bucket policy restricts access to a VPC ID, the Scaleway console can no longer display the objects, metrics, or logs of that bucket. Plan a management method from inside the VPC before applying such a policy. + +### The endpoint applies at VPC level, not at bucket level + +Enabling the endpoint makes all buckets of the region privately reachable from the VPC. The bucket policy of each bucket determines which VPCs can access it. + +### Bucket policies cannot target a single Private Network + +You select which Private Networks of the VPC use the private path, but a bucket policy cannot target a specific Private Network: the `aws:SourceVpc` condition key recognizes the ID of the VPC only. + +## Troubleshooting + +- The bucket is still reachable from the internet. The Object Storage endpoint is enabled on the VPC, but no bucket policy restricts access to the bucket. Enabling the endpoint adds a private path, and does not remove public access. Apply a bucket policy with an `aws:SourceVpc` condition, as described in [How to restrict bucket access to a VPC](#how-to-restrict-bucket-access-to-a-vpc). + +- The bucket became publicly accessible again. The bucket policy that contained the VPC condition was deleted, which removes all restrictions on the bucket. Apply the bucket policy again. + +- Resources in the VPC cannot reach the bucket. Check that the Object Storage endpoint is enabled on the VPC, that the Private Network of the resource is added to the endpoint, and that the bucket is in the region of the VPC. A bucket policy that references the ID of a VPC on which the endpoint is not enabled never matches any request. + +- The Scaleway console no longer displays the objects, metrics, or logs of the bucket. The console accesses buckets over the internet, and the bucket policy denies requests that do not come from the VPC. Manage the bucket from a resource inside the VPC. + +- You lost access to the bucket. The bucket policy allows requests from the VPC only, and you have no management method from inside the VPC. The [Owner](/iam/concepts/#owner) of the Organization can always put and delete bucket policies, and can therefore restore access to the bucket. diff --git a/pages/vpc/menu.ts b/pages/vpc/menu.ts index 13f910eecb..1418e3aaeb 100644 --- a/pages/vpc/menu.ts +++ b/pages/vpc/menu.ts @@ -38,6 +38,10 @@ export const vpcMenu = { label: 'Manage routing on a VPC', slug: 'manage-routing', }, + { + label: 'Configure private access for Object Storage', + slug: 'enable-object-storage-private-access', + }, { label: 'Use Network ACLs', slug: 'use-network-acl', From 94c196a70b9d8ec177236f19f557b0c4976ef3d7 Mon Sep 17 00:00:00 2001 From: Samy OUBOUAZIZ Date: Fri, 21 Aug 2026 15:55:12 +0200 Subject: [PATCH 02/17] feat(vpc): add doc on private access --- pages/object-storage/api-cli/bucket-policy.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pages/object-storage/api-cli/bucket-policy.mdx b/pages/object-storage/api-cli/bucket-policy.mdx index 401aaf1780..c833954702 100644 --- a/pages/object-storage/api-cli/bucket-policy.mdx +++ b/pages/object-storage/api-cli/bucket-policy.mdx @@ -632,7 +632,7 @@ To view the bucket policy action corresponding to each Object Storage API operat } ``` -* You can restrict access to the resources of a given VPC with the `aws:SourceVpc` condition key. This condition key requires [private access for Object Storage](/vpc/api-cli/enable-object-storage-private-access/) to be enabled on the VPC: +* You can restrict access to the resources of a given VPC with the `aws:SourceVpc` condition key. This condition key requires [private access for Object Storage](/vpc/how-to/enable-object-storage-private-access/) to be enabled on the VPC: ```json { From 1fd2c34804c031227635b8943ef09c285efe7827 Mon Sep 17 00:00:00 2001 From: Samy OUBOUAZIZ Date: Mon, 24 Aug 2026 14:18:33 +0200 Subject: [PATCH 03/17] feat(vpc): add doc on private access --- .../use-obj-stor-with-private-networks.mdx | 21 +++++++++++-------- 1 file changed, 12 insertions(+), 9 deletions(-) diff --git a/pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx b/pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx index 2e9052f70c..67d15a6efd 100644 --- a/pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx +++ b/pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx @@ -9,9 +9,6 @@ dates: import Requirements from '@macros/iam/requirements.mdx' -The [Public Gateway](/public-gateways/concepts/#public-gateway) feature of the [Private Networks](/vpc/concepts/#private-networks) allows Instances in your Private Network to reach resources on the internet without using a public IP address. - -This documentation shows how to create an Instance without a public IP address, create a Private Network with a Public Gateway, and a route from your Instance to an Object Storage bucket. @@ -19,7 +16,13 @@ This documentation shows how to create an Instance without a public IP address, - [Owner](/iam/concepts/#owner) status or [IAM permissions](/iam/concepts/#permission) allowing you to perform actions in the intended Organization - An [Object Storage bucket](/object-storage/how-to/create-a-bucket/) -## How to create an Instance without a public IP +## Using a Public Gateway + +[Public Gateways](/public-gateways/concepts/#public-gateway) allow resources in a Private Network to securely reach the public internet without using a public IP address. + +This procedure shows how to create an Instance without a public IP address, create a Private Network with a Public Gateway, and a route from your Instance to an Object Storage bucket. + +### Create an Instance without a public IP Follow the instructions for [creating an Instance](/instances/how-to/create-an-instance/). @@ -29,12 +32,12 @@ You must create an Instance without a flexible IP using the following specificat - **Instance type**: DEV1-S - **Network configuration**: Untick the selected IP options -## How to create a Private Network and attach the Instance +### Create a Private Network and attach the Instance 1. Follow the instructions for [creating a Private Network](/vpc/how-to/create-private-network/). Make sure you create it in the region that encompasses the Availability Zone of the Instance you previously created. 2. Follow the instructions to [attach your Instance to the Private Network](/vpc/how-to/attach-resources-to-pn/). -## How to create a Public Gateway and attach the Private Network +### Create a Public Gateway and attach the Private Network 1. Follow the instructions for [creating a Public Gateway](/public-gateways/how-to/create-a-public-gateway/): - Select the same Availability Zone as for your previously created Instance. @@ -48,7 +51,7 @@ You must create an Instance without a flexible IP using the following specificat 5. Select **Attach to an existing Private Network** and pick a Private Network from the drop-down list. 6. Click **Attach to Private Network**. -## How to set the Object Storage Route +### Set the Object Storage Route 1. SSH into your Instance using the following command: ``` @@ -71,6 +74,6 @@ You must create an Instance without a flexible IP using the following specificat curl https://s3.nl-ams.scw.cloud ``` -## Conclusion +### Conclusion -You have now configured an Instance with a Private Network to communicate with Scaleway's Object Storage platform using a Public Gateway. The gateway ensures the exchange of data between your Private Network and the public Internet. \ No newline at end of file +You have now configured an Instance with a Private Network to communicate with Scaleway Object Storage using a Public Gateway. The gateway ensures the exchange of data between your Private Network and the public Internet. \ No newline at end of file From 58c533c77fcdba4503ddd46cdbc9cfc8b35ec6bf Mon Sep 17 00:00:00 2001 From: Samy OUBOUAZIZ Date: Mon, 24 Aug 2026 14:29:07 +0200 Subject: [PATCH 04/17] feat(vpc): add doc on private access --- .../use-obj-stor-with-private-networks.mdx | 48 +++++++++---------- 1 file changed, 24 insertions(+), 24 deletions(-) diff --git a/pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx b/pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx index 67d15a6efd..66e71f3fc1 100644 --- a/pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx +++ b/pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx @@ -1,7 +1,7 @@ --- title: How to use Object Storage with Private Networks -description: Configure and use Object Storage with Private Networks. -tags: object storage private-networks private network +description: Learn how to reach Scaleway Object Storage from resources attached to a Private Network, using a Public Gateway to route traffic without a public IP address. +tags: object-storage private-networks private-network public-gateway vpc route dates: validation: 2025-08-11 posted: 2021-05-27 @@ -9,6 +9,11 @@ dates: import Requirements from '@macros/iam/requirements.mdx' +Resources attached to a [Private Network](/vpc/concepts/#private-networks) have no direct access to Object Storage, as buckets are reached over the public internet. To send traffic from such a resource to a bucket, you can route it through a [Public Gateway](/public-gateways/concepts/#public-gateway). + + +To keep traffic between your resources and your buckets on the internal Scaleway network instead of routing it over the public internet, see [Configuring private access for Object Storage](/vpc/api-cli/enable-object-storage-private-access/). + @@ -20,49 +25,46 @@ import Requirements from '@macros/iam/requirements.mdx' [Public Gateways](/public-gateways/concepts/#public-gateway) allow resources in a Private Network to securely reach the public internet without using a public IP address. -This procedure shows how to create an Instance without a public IP address, create a Private Network with a Public Gateway, and a route from your Instance to an Object Storage bucket. - -### Create an Instance without a public IP +The procedure below shows how to create an Instance without a public IP address, attach it to a Private Network with a Public Gateway, and configure a route from the Instance to an Object Storage bucket. -Follow the instructions for [creating an Instance](/instances/how-to/create-an-instance/). +### Create an Instance and attach it to a Private Network -You must create an Instance without a flexible IP using the following specifications for our Instance: - - **Availability Zone**: `nl-ams-1` (or another AZ of your choice). - - **OS Image**: Ubuntu 20.04 Focal Fossa - - **Instance type**: DEV1-S - - **Network configuration**: Untick the selected IP options -### Create a Private Network and attach the Instance +1. Follow the instructions for [creating an Instance](/instances/how-to/create-an-instance/) in the same Region as your Object storage bucket. Make sure you disable public connectivity for your Instance. 1. Follow the instructions for [creating a Private Network](/vpc/how-to/create-private-network/). Make sure you create it in the region that encompasses the Availability Zone of the Instance you previously created. 2. Follow the instructions to [attach your Instance to the Private Network](/vpc/how-to/attach-resources-to-pn/). -### Create a Public Gateway and attach the Private Network +### Create a Public Gateway and attach it to the Private Network 1. Follow the instructions for [creating a Public Gateway](/public-gateways/how-to/create-a-public-gateway/): - Select the same Availability Zone as for your previously created Instance. - Select a Public Gateway type according to your needs. - Select **Allocate a new IP**. - Enter a name and optional tags for your Public Gateway. - After creating your Public Gateway, you are directed to a list of this and any other Public Gateways you have previously created. -2. Click on your new Public Gateway's name. The gateway's dashboard displays. + + After creating the Public Gateway, you are directed to a list of your Public Gateways. + +2. Click the name of the new Public Gateway. The dashboard of the gateway displays. 3. Click the **Private Networks** tab. 4. Click **Attach to a new Private Network**. A pop-up window displays. 5. Select **Attach to an existing Private Network** and pick a Private Network from the drop-down list. 6. Click **Attach to Private Network**. -### Set the Object Storage Route +### Set the Object Storage route -1. SSH into your Instance using the following command: - ``` - ssh root@your_virtual_instance_ip +1. Connect to your Instance via SSH, replacing `` with the IP address of the Instance: + + ```bash + ssh root@ ``` - As your Instance has no public IP address, you must connect to it using another Instance in your Private Network or assign a temporary flexible IP to it. + As the Instance has no public IP address, you must connect to it from another Instance in the Private Network, or assign a temporary flexible IP address to it. 2. Configure the following route to the Object Storage platform: + ```bash # set this to keep the network on the instance ip route add 10.0.0.0/8 via `ip route | grep default | awk '{print $3} '` dev ens2 @@ -70,10 +72,8 @@ You must create an Instance without a flexible IP using the following specificat dhclient ens5 # change the default route ip route del default via `ip route | grep default | awk '{print $3} '` dev ens2 - ip route add default via 192.168.42.1 dev ens5 # use the gateway ip in the gateway's description + ip route add default via 192.168.42.1 dev ens5 # use the IP address of the gateway, shown on the gateway dashboard curl https://s3.nl-ams.scw.cloud ``` -### Conclusion - -You have now configured an Instance with a Private Network to communicate with Scaleway Object Storage using a Public Gateway. The gateway ensures the exchange of data between your Private Network and the public Internet. \ No newline at end of file + The Instance now reaches Object Storage through the Public Gateway, which handles the exchange of data between the Private Network and the public internet. \ No newline at end of file From 046f98f1e1eb171e39e465526bfb72360f0d2964 Mon Sep 17 00:00:00 2001 From: Samy OUBOUAZIZ Date: Mon, 24 Aug 2026 15:18:05 +0200 Subject: [PATCH 05/17] feat(vpc): add doc on private access --- .../how-to/use-obj-stor-with-private-networks.mdx | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx b/pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx index 66e71f3fc1..6be45aa883 100644 --- a/pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx +++ b/pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx @@ -32,18 +32,17 @@ The procedure below shows how to create an Instance without a public IP address, 1. Follow the instructions for [creating an Instance](/instances/how-to/create-an-instance/) in the same Region as your Object storage bucket. Make sure you disable public connectivity for your Instance. -1. Follow the instructions for [creating a Private Network](/vpc/how-to/create-private-network/). Make sure you create it in the region that encompasses the Availability Zone of the Instance you previously created. -2. Follow the instructions to [attach your Instance to the Private Network](/vpc/how-to/attach-resources-to-pn/). +2. Follow the instructions for [creating a Private Network](/vpc/how-to/create-private-network/). Make sure you create it in the region that encompasses the Availability Zone of the Instance you previously created. +3. Follow the instructions to [attach your Instance to the Private Network](/vpc/how-to/attach-resources-to-pn/). ### Create a Public Gateway and attach it to the Private Network 1. Follow the instructions for [creating a Public Gateway](/public-gateways/how-to/create-a-public-gateway/): - - Select the same Availability Zone as for your previously created Instance. - - Select a Public Gateway type according to your needs. - - Select **Allocate a new IP**. - - Enter a name and optional tags for your Public Gateway. - After creating the Public Gateway, you are directed to a list of your Public Gateways. + 1. Select the same Availability Zone as for your previously created Instance. + 2. Select a Public Gateway type according to your needs. + 3. Select **Allocate a new IP**. + 4. Enter a name and optional tags for your Public Gateway. 2. Click the name of the new Public Gateway. The dashboard of the gateway displays. 3. Click the **Private Networks** tab. From e21683352f8e2e288eec7b2eeaa2591296ec42d4 Mon Sep 17 00:00:00 2001 From: Samy OUBOUAZIZ Date: Mon, 24 Aug 2026 16:12:23 +0200 Subject: [PATCH 06/17] feat(vpc): add doc on private access --- .../object-storage/api-cli/bucket-policy.mdx | 2 +- .../use-obj-stor-with-private-networks.mdx | 29 +++++++++++++++---- .../enable-object-storage-private-access.mdx | 14 ++++----- pages/vpc/menu.ts | 2 +- 4 files changed, 32 insertions(+), 15 deletions(-) diff --git a/pages/object-storage/api-cli/bucket-policy.mdx b/pages/object-storage/api-cli/bucket-policy.mdx index c833954702..3107db99c2 100644 --- a/pages/object-storage/api-cli/bucket-policy.mdx +++ b/pages/object-storage/api-cli/bucket-policy.mdx @@ -632,7 +632,7 @@ To view the bucket policy action corresponding to each Object Storage API operat } ``` -* You can restrict access to the resources of a given VPC with the `aws:SourceVpc` condition key. This condition key requires [private access for Object Storage](/vpc/how-to/enable-object-storage-private-access/) to be enabled on the VPC: +* You can restrict access to the resources of a given VPC with the `aws:SourceVpc` condition key. This condition key requires [Object Storage private access](/vpc/how-to/enable-object-storage-private-access/) to be enabled on the VPC: ```json { diff --git a/pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx b/pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx index 6be45aa883..7a4683e2bf 100644 --- a/pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx +++ b/pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx @@ -1,6 +1,6 @@ --- title: How to use Object Storage with Private Networks -description: Learn how to reach Scaleway Object Storage from resources attached to a Private Network, using a Public Gateway to route traffic without a public IP address. +description: Learn how to securely reach Scaleway Object Storage from resources attached to a Private Network. tags: object-storage private-networks private-network public-gateway vpc route dates: validation: 2025-08-11 @@ -9,11 +9,12 @@ dates: import Requirements from '@macros/iam/requirements.mdx' -Resources attached to a [Private Network](/vpc/concepts/#private-networks) have no direct access to Object Storage, as buckets are reached over the public internet. To send traffic from such a resource to a bucket, you can route it through a [Public Gateway](/public-gateways/concepts/#public-gateway). +Resources attached to a [Private Network](/vpc/concepts/#private-networks) have no direct access to Object Storage, as buckets are reached over the public internet. - -To keep traffic between your resources and your buckets on the internal Scaleway network instead of routing it over the public internet, see [Configuring private access for Object Storage](/vpc/api-cli/enable-object-storage-private-access/). - +Object Storage private access keeps the traffic between your Private Networks and your buckets on the internal Scaleway network. + +Alternatively, you can use a [Public Gateway](/public-gateways/concepts/#public-gateway) to route +traffic from resources in a Private Network to the public endpoint of an Object Storage bucket. @@ -21,9 +22,25 @@ To keep traffic between your resources and your buckets on the internal Scaleway - [Owner](/iam/concepts/#owner) status or [IAM permissions](/iam/concepts/#permission) allowing you to perform actions in the intended Organization - An [Object Storage bucket](/object-storage/how-to/create-a-bucket/) +## Using Object Storage private access + +Object Storage private access is the recommended method to securely reach a bucket from a Private Network. Traffic transits over the internal Scaleway network, instead of the public internet. + +1. Enable Object Storage private access on the VPC via the [VPC API](https://www.scaleway.com/en/developers/api/vpc/). + +2. Select the Private Networks within this VPC you want to authorize using the [VPC API](https://www.scaleway.com/en/developers/api/vpc/). + +3. Apply a bucket policy with the `StringEquals` condition and the `aws:SourceVpc` condition key on the bucket to restrict, so that requests coming from outside the VPC are denied. + + +Enabling Object Storage private access on a VPC applies no restriction at bucket level: without a bucket policy, buckets remain reachable from the public internet. + + +See [Configuring Object Storage private access](/vpc/how-to/enable-object-storage-private-access/) for comprehensive information. + ## Using a Public Gateway -[Public Gateways](/public-gateways/concepts/#public-gateway) allow resources in a Private Network to securely reach the public internet without using a public IP address. +[Public Gateways](/public-gateways/concepts/#public-gateway) allow resources in a Private Network to securely reach the public internet without using a public IP address. Traffic to your buckets then transits over the public internet, and each resource requires a routing configuration. Use this method for the use cases that Object Storage private access does not cover. The procedure below shows how to create an Instance without a public IP address, attach it to a Private Network with a Public Gateway, and configure a route from the Instance to an Object Storage bucket. diff --git a/pages/vpc/how-to/enable-object-storage-private-access.mdx b/pages/vpc/how-to/enable-object-storage-private-access.mdx index 6eb76177e0..fdda8ace00 100644 --- a/pages/vpc/how-to/enable-object-storage-private-access.mdx +++ b/pages/vpc/how-to/enable-object-storage-private-access.mdx @@ -1,6 +1,6 @@ --- -title: Configuring private access for Object Storage -description: Learn how to enable private access for Object Storage on a Scaleway VPC, and how to restrict bucket access to your VPC with an aws:SourceVpc bucket policy condition. +title: Configuring Object Storage private access +description: Learn how to enable Object Storage private access on a Scaleway VPC, and how to restrict bucket access to your VPC with an aws:SourceVpc bucket policy condition. tags: vpc object-storage private-access endpoint s3-integration bucket-policy aws-sourcevpc private-network dates: validation: 2026-08-21 @@ -10,11 +10,11 @@ import Requirements from '@macros/iam/requirements.mdx' import ImportantBucketPolicy from '@macros/storage/important-bucket-policy.mdx' -Private access for Object Storage creates a private connection path between a VPC and Object Storage buckets. Instead of reaching buckets over the public internet, traffic from your resources transits over the internal Scaleway network. +Object Storage private access creates a private connection path between a VPC and Object Storage buckets. Instead of reaching buckets over the public internet, traffic from your resources transits over the internal Scaleway network. When the feature is enabled, all buckets in the region of the VPC are reachable privately from the selected Private Networks. Access relies on two independent components, and a request is accepted only if both coditions are satisfied: -- the request comes from a resource in a Private Network within a VPC with private access enabled +- the request comes from a resource in a Private Network within a VPC on which Object Storage private access is enabled - the [bucket policy](/object-storage/api-cli/bucket-policy/) of the target bucket explicitly allows the request. @@ -25,11 +25,11 @@ When the feature is enabled, all buckets in the region of the VPC are reachable - A [VPC](/vpc/how-to/create-vpc/) with at least one [Private Network](/vpc/how-to/create-private-network/) - An [Object Storage bucket](/object-storage/how-to/create-a-bucket/) in the region of the VPC -## How private access works +## How Object Storage private access works -Private access for Object Storage relies on two components, configured in two different sections of the Scaleway console: +Object Storage private access relies on two components, configured in two different sections of the Scaleway console: -- The ¨**private access** feature in a VPC allows the selected Private Networks of that VPC to reach Object Storage without transiting over the public internet. +- Object Storage private access, enabled on a VPC, allows the selected Private Networks of that VPC to reach Object Storage without transiting over the public internet. - The bucket policy is the authorization layer. Enabling the endpoint applies no restriction at bucket level: buckets remain reachable both from the internet and from the VPC. To reject public traffic, apply a bucket policy with the `aws:SourceVpc` condition matching the ID of your VPC. diff --git a/pages/vpc/menu.ts b/pages/vpc/menu.ts index 1418e3aaeb..163a6fefc2 100644 --- a/pages/vpc/menu.ts +++ b/pages/vpc/menu.ts @@ -39,7 +39,7 @@ export const vpcMenu = { slug: 'manage-routing', }, { - label: 'Configure private access for Object Storage', + label: 'Configure Object Storage private access', slug: 'enable-object-storage-private-access', }, { From cb018bebda872e3e618a52cc5ba68bddfd6e7d1f Mon Sep 17 00:00:00 2001 From: Samy OUBOUAZIZ Date: Wed, 26 Aug 2026 10:51:51 +0200 Subject: [PATCH 07/17] feat(vpc): add doc on private access --- .../use-obj-stor-with-private-networks.mdx | 4 +- .../enable-object-storage-private-access.mdx | 44 ++++++------- pages/vpc/troubleshooting/index.mdx | 1 + .../object-storage-private-access-issues.mdx | 62 +++++++++++++++++++ 4 files changed, 83 insertions(+), 28 deletions(-) create mode 100644 pages/vpc/troubleshooting/object-storage-private-access-issues.mdx diff --git a/pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx b/pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx index 7a4683e2bf..f89ff8f3f8 100644 --- a/pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx +++ b/pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx @@ -26,9 +26,9 @@ traffic from resources in a Private Network to the public endpoint of an Object Object Storage private access is the recommended method to securely reach a bucket from a Private Network. Traffic transits over the internal Scaleway network, instead of the public internet. -1. Enable Object Storage private access on the VPC via the [VPC API](https://www.scaleway.com/en/developers/api/vpc/). +1. Enable Object Storage private access on the VPC via the [Object Storage private access API](https://www.scaleway.com/en/developers/api/vpc/object-storage-private-access/). -2. Select the Private Networks within this VPC you want to authorize using the [VPC API](https://www.scaleway.com/en/developers/api/vpc/). +2. Select the Private Networks within this VPC you want to authorize using the [Object Storage private access API](https://www.scaleway.com/en/developers/api/vpc/object-storage-private-access/). 3. Apply a bucket policy with the `StringEquals` condition and the `aws:SourceVpc` condition key on the bucket to restrict, so that requests coming from outside the VPC are denied. diff --git a/pages/vpc/how-to/enable-object-storage-private-access.mdx b/pages/vpc/how-to/enable-object-storage-private-access.mdx index fdda8ace00..19602bfa10 100644 --- a/pages/vpc/how-to/enable-object-storage-private-access.mdx +++ b/pages/vpc/how-to/enable-object-storage-private-access.mdx @@ -1,7 +1,7 @@ --- title: Configuring Object Storage private access description: Learn how to enable Object Storage private access on a Scaleway VPC, and how to restrict bucket access to your VPC with an aws:SourceVpc bucket policy condition. -tags: vpc object-storage private-access endpoint s3-integration bucket-policy aws-sourcevpc private-network +tags: vpc object-storage private-access object-storage-private-access bucket-policy aws-sourcevpc private-network dates: validation: 2026-08-21 posted: 2026-08-21 @@ -25,7 +25,7 @@ When the feature is enabled, all buckets in the region of the VPC are reachable - A [VPC](/vpc/how-to/create-vpc/) with at least one [Private Network](/vpc/how-to/create-private-network/) - An [Object Storage bucket](/object-storage/how-to/create-a-bucket/) in the region of the VPC -## How Object Storage private access works +## Overview Object Storage private access relies on two components, configured in two different sections of the Scaleway console: @@ -39,33 +39,33 @@ Both components are required to obtain private and restricted access. Neither co The two configuration steps are independent, and you can perform them in any order. -## How to enable the Object Storage endpoint on a VPC +## How to enable Object Storage private access on a VPC -This step creates a dedicated access path to the Object Storage service from the VPC. It can be performed from the settings of your VPC in the [Scaleway console](https://console.scaleway.com/), or via the [VPC API](https://www.scaleway.com/en/developers/api/vpc/s3-integration/). - - -Enabling the Object Storage endpoint on a VPC triggers the billing of the feature. + +Enabling Object Storage private access on a VPC triggers billing for the feature. -1. Enable the endpoint on the VPC, using the [Enable S3 integration](https://www.scaleway.com/en/developers/api/vpc/s3-integration#enable-s3-integration) API call: +1. Enable Object Storage private access on the VPC, listing the Private Networks to authorize: ```bash curl -X POST \ -H "X-Auth-Token: $SCW_SECRET_KEY" \ - "https://api.scaleway.com/vpc/v2/regions/{region}/s3-integration/{vpc_id}/enable" + -H "Content-Type: application/json" \ + -d '{"private_network_ids":["example-7363-616c-6577-61792e636f6d"]}' \ + "https://api.scaleway.com/vpc/v2/regions/{region}/object-storage-private-access/{vpc_id}/enable" ``` -2. Add each Private Network that must benefit from the private path: +2. Add another Private Network, if needed: ```bash curl -X POST \ -H "X-Auth-Token: $SCW_SECRET_KEY" \ -H "Content-Type: application/json" \ -d '{"private_network_id":"6170692e-7363-616c-6577-61792e636f6d"}' \ - "https://api.scaleway.com/vpc/v2/regions/{region}/s3-integration/{vpc_id}/private-networks" + "https://api.scaleway.com/vpc/v2/regions/{region}/object-storage-private-access/{vpc_id}/private-networks" ``` - The resources attached to these Private Networks can now reach the buckets of the region privately. +Refer to the [VPC API documentation](https://www.scaleway.com/en/developers/api/vpc/object-storage-private-access/) for more information. ## How to restrict bucket access to a VPC @@ -74,8 +74,8 @@ When the endpoint is enabled, every bucket of the region whose bucket policy all 1. Click **Object Storage** in the **Storage** section of the [Scaleway console](https://console.scaleway.com/) side menu. The list of your buckets displays. -2. Click the name of the bucket to restrict, then open the **Bucket policy** tab. -3. Create a bucket policy that allows access from your VPC only. In the example below, resources coming from the `vpc-1a2b3c4d` VPC are allowed to perform the `s3:ListBucket` and `s3:GetObject` actions: +2. Click the name of the bucket, then click the **Bucket policy** tab. +3. Create a bucket policy that allows access from your VPC only: ```json { @@ -98,14 +98,14 @@ When the endpoint is enabled, every bucket of the region whose bucket policy all } ``` -4. Replace the `` placeholders with the name of the bucket, and the `` placeholder with the ID of the VPC on which the endpoint is enabled. -5. Save the bucket policy. Any request that does not come from the specified VPC is denied. +4. Replace the `` and `` placeholders with the name of your bucket and the ID of your VPC. +5. Save the bucket policy. Requests that do not come from Private Networks within the VPC are denied. See the [bucket policies overview](/object-storage/api-cli/bucket-policy/) for more information on the syntax and the elements of a bucket policy. -## Behaviors to be aware of +## Key considerations ### A bucket without a bucket policy remains publicly accessible @@ -125,12 +125,4 @@ You select which Private Networks of the VPC use the private path, but a bucket ## Troubleshooting -- The bucket is still reachable from the internet. The Object Storage endpoint is enabled on the VPC, but no bucket policy restricts access to the bucket. Enabling the endpoint adds a private path, and does not remove public access. Apply a bucket policy with an `aws:SourceVpc` condition, as described in [How to restrict bucket access to a VPC](#how-to-restrict-bucket-access-to-a-vpc). - -- The bucket became publicly accessible again. The bucket policy that contained the VPC condition was deleted, which removes all restrictions on the bucket. Apply the bucket policy again. - -- Resources in the VPC cannot reach the bucket. Check that the Object Storage endpoint is enabled on the VPC, that the Private Network of the resource is added to the endpoint, and that the bucket is in the region of the VPC. A bucket policy that references the ID of a VPC on which the endpoint is not enabled never matches any request. - -- The Scaleway console no longer displays the objects, metrics, or logs of the bucket. The console accesses buckets over the internet, and the bucket policy denies requests that do not come from the VPC. Manage the bucket from a resource inside the VPC. - -- You lost access to the bucket. The bucket policy allows requests from the VPC only, and you have no management method from inside the VPC. The [Owner](/iam/concepts/#owner) of the Organization can always put and delete bucket policies, and can therefore restore access to the bucket. +See [I am experiencing issues with Object Storage private access](/vpc/troubleshooting/object-storage-private-access-issues/) for solutions to the most common issues, such as buckets that remain publicly reachable, or resources in a VPC that cannot access a bucket. diff --git a/pages/vpc/troubleshooting/index.mdx b/pages/vpc/troubleshooting/index.mdx index 35095fdbd1..e24a7a1ae7 100644 --- a/pages/vpc/troubleshooting/index.mdx +++ b/pages/vpc/troubleshooting/index.mdx @@ -67,4 +67,5 @@ productIcon: VpcProductIcon - [My legacy Instance is attached to a Private Network but auto-configuration is not working](/vpc/troubleshooting/autoconfig-not-working) - [VPC limitations](/vpc/troubleshooting/vpc-limitations) - [I cannot connect to resources in a Private Network using SSH bastion](/vpc/troubleshooting/cant-connect-to-pn-resource-via-ssh/) + - [I am experiencing issues with Object Storage private access](/vpc/troubleshooting/object-storage-private-access-issues/) diff --git a/pages/vpc/troubleshooting/object-storage-private-access-issues.mdx b/pages/vpc/troubleshooting/object-storage-private-access-issues.mdx new file mode 100644 index 0000000000..fe3ec6ff58 --- /dev/null +++ b/pages/vpc/troubleshooting/object-storage-private-access-issues.mdx @@ -0,0 +1,62 @@ +--- +title: I am experiencing issues with Object Storage private access +description: Solve the most common issues with Object Storage private access, such as buckets that remain publicly reachable, or resources in a VPC that cannot access a bucket. +tags: vpc object-storage private-access bucket-policy aws-sourcevpc private-network troubleshooting +dates: + validation: 2026-08-21 + posted: 2026-08-21 +--- + +[Object Storage private access](/vpc/how-to/enable-object-storage-private-access/) relies on two independent components: the feature enabled on the VPC, which creates the private path, and a bucket policy with an `aws:SourceVpc` condition, which restricts access to the bucket. Most issues come from one of the two components being missing or incomplete. + +## My bucket is still reachable from the internet + +### Cause + +Object Storage private access is enabled on the VPC, but no bucket policy restricts access to the bucket. Enabling the feature adds a private path, and does not remove public access. + +Alternatively, a bucket policy that contained the VPC condition was deleted, which removes all restrictions on the bucket. + +### Solution + +Apply a bucket policy with an `aws:SourceVpc` condition on the bucket, as described in [How to restrict bucket access to a VPC](/vpc/how-to/enable-object-storage-private-access/#how-to-restrict-bucket-access-to-a-vpc). + +## Resources in my VPC cannot reach my bucket + +### Cause + +The private path is incomplete, or the bucket policy never matches the requests coming from the VPC. + +### Solution + +Check the following points: + +- Object Storage private access is enabled on the VPC. +- The Private Network of the resource is authorized on the VPC. +- The bucket is in the region of the VPC. +- The bucket policy references the ID of a VPC on which Object Storage private access is enabled. A condition that references any other VPC never matches a request. + +## The Scaleway console no longer displays my objects, metrics, or logs + +### Cause + +The Scaleway console accesses buckets over the internet. When the bucket policy denies requests that do not come from the VPC, the console requests are denied. + +### Solution + +Manage the bucket from a resource inside the VPC. If you no longer need the restriction, delete or edit the bucket policy. + +## I lost access to my bucket + +### Cause + +The bucket policy allows requests coming from the VPC only, and you have no management method from inside the VPC. + +### Solution + +The [Owner](/iam/concepts/#owner) of the Organization always has the right to put and delete bucket policies, even when the policy does not allow them to perform other bucket operations. Ask the Owner of the Organization to edit or delete the bucket policy. + +## Going further + +- [Configuring Object Storage private access](/vpc/how-to/enable-object-storage-private-access/) +- [Bucket policies overview](/object-storage/api-cli/bucket-policy/) From c88a4629e6ca9144dcffe922de60154a0721f5d2 Mon Sep 17 00:00:00 2001 From: Samy OUBOUAZIZ Date: Tue, 8 Sep 2026 10:56:10 +0200 Subject: [PATCH 08/17] docs(object): add concepts --- macros/vpc/object-storage-private-access.mdx | 10 ++++++++++ pages/object-storage/concepts.mdx | 5 +++++ .../how-to/use-obj-stor-with-private-networks.mdx | 2 +- pages/vpc/concepts.mdx | 7 ++++++- 4 files changed, 22 insertions(+), 2 deletions(-) create mode 100644 macros/vpc/object-storage-private-access.mdx diff --git a/macros/vpc/object-storage-private-access.mdx b/macros/vpc/object-storage-private-access.mdx new file mode 100644 index 0000000000..da617fa0bf --- /dev/null +++ b/macros/vpc/object-storage-private-access.mdx @@ -0,0 +1,10 @@ +--- +macro: object-storage-private-access +--- + +Object Storage private access creates a private connection path between a VPC and Object Storage buckets. Instead of reaching buckets over the public internet, traffic from your resources transits over the internal Scaleway network. + +When the feature is enabled, all buckets in the region of the VPC are reachable privately from the selected Private Networks. Access relies on two independent components, and a request is accepted only if both coditions are satisfied: + +- the request comes from a resource in a Private Network within a VPC on which Object Storage private access is enabled +- the [bucket policy](/object-storage/api-cli/bucket-policy/) of the target bucket explicitly allows the request. \ No newline at end of file diff --git a/pages/object-storage/concepts.mdx b/pages/object-storage/concepts.mdx index fc3a5021f0..5c8c4f3921 100644 --- a/pages/object-storage/concepts.mdx +++ b/pages/object-storage/concepts.mdx @@ -8,6 +8,7 @@ dates: --- import RegionAndAz from '@macros/console/region-and-az.mdx' import StorageBucketPolicy from '@macros/storage/bucket-policy.mdx' +import ObjectStoragePrivateAccess from '@macros/vpc/object-storage-private-access.mdx' ## Access control list (ACL) @@ -137,6 +138,10 @@ Creating a [lifecycle rule](/object-storage/how-to/manage-lifecycle-rules/) base A principal is the target of a [bucket policy](#bucket-policy). They acquire the rights and permissions defined in the policy. The principal of a bucket policy can be an IAM user or application. Bucket policies can have several principals attached to them. +## Object Storage Private access + + + ## Region and Availability Zone diff --git a/pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx b/pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx index f89ff8f3f8..752cfa51fa 100644 --- a/pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx +++ b/pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx @@ -11,7 +11,7 @@ import Requirements from '@macros/iam/requirements.mdx' Resources attached to a [Private Network](/vpc/concepts/#private-networks) have no direct access to Object Storage, as buckets are reached over the public internet. -Object Storage private access keeps the traffic between your Private Networks and your buckets on the internal Scaleway network. +[Object Storage private access](/object-storage/concepts/#private-access) keeps the traffic between your Private Networks and your buckets on the internal Scaleway network. Alternatively, you can use a [Public Gateway](/public-gateways/concepts/#public-gateway) to route traffic from resources in a Private Network to the public endpoint of an Object Storage bucket. diff --git a/pages/vpc/concepts.mdx b/pages/vpc/concepts.mdx index dfb9b602fd..19d7471579 100644 --- a/pages/vpc/concepts.mdx +++ b/pages/vpc/concepts.mdx @@ -10,7 +10,7 @@ import RegionAndAz from '@macros/console/region-and-az.mdx' import IngressRoutingRuleConcept from '@macros/vpc/ingress-routing-rule-concept.mdx' import image from './assets/scaleway-vpc-pn-diag.webp' import image2 from './assets/scaleway-vpc-osi.webp' - +import ObjectStoragePrivateAccess from '@macros/vpc/object-storage-private-access.mdx' ## CIDR block @@ -91,6 +91,11 @@ NACLs are currently in Public Beta, and configurable only via the [VPC API](http A VPC's Network **A**ccess **C**control **L**ist is composed of stateless rules to control the flow of traffic between Private Networks. By default, the list contains no rules, and therefore traffic is allowed to flow unrestrictedly between the VPC's Private Networks. Add rules to the list to start creating restrictions. [Take a deeper dive into NACLs](/vpc/reference-content/understanding-nacls/). +## Object Storage Private access + + + + ## Private IP address A [private IP address](/vpc/how-to/attach-resources-to-pn/#how-to-view-the-resources-ip-address) identifies a resource on a Private Network. When you attach a resource (e.g. an Instance) to the network, you can either [use a reserved IP address](/ipam/how-to/reserve-ip/), or let [DHCP](#dhcp) assign one IPv4 and (if the resource is IPv6-compatible) one IPv6 address from the designated [CIDR blocks](#cidr-block) to that resource. From 377528245a5fd481f6dd2b75fcca1ca4cf342aee Mon Sep 17 00:00:00 2001 From: Samy OUBOUAZIZ Date: Tue, 8 Sep 2026 14:36:42 +0200 Subject: [PATCH 09/17] docs(object): update --- pages/object-storage/concepts.mdx | 8 ++++---- .../vpc/how-to/enable-object-storage-private-access.mdx | 9 ++------- 2 files changed, 6 insertions(+), 11 deletions(-) diff --git a/pages/object-storage/concepts.mdx b/pages/object-storage/concepts.mdx index 5c8c4f3921..124a1ec58e 100644 --- a/pages/object-storage/concepts.mdx +++ b/pages/object-storage/concepts.mdx @@ -113,6 +113,10 @@ Contrary to other storage types such as block devices or file systems, Object St Read our [quickstart documentation](/object-storage/quickstart/) to get started with Scaleway Object Storage. +## Object Storage Private access + + + ## Parts Parts are individual segments of a larger object that is uploaded in multiple pieces during a multipart upload process. This method divides large uploads into manageable chunks, improving efficiency and reliability. If one part fails, only that part needs to be retried, rather than the entire file. Each part must be uploaded in sequence and identified by a part number, which helps Scaleway Object Storage to reassemble the complete object accurately after all parts have been successfully uploaded. @@ -138,10 +142,6 @@ Creating a [lifecycle rule](/object-storage/how-to/manage-lifecycle-rules/) base A principal is the target of a [bucket policy](#bucket-policy). They acquire the rights and permissions defined in the policy. The principal of a bucket policy can be an IAM user or application. Bucket policies can have several principals attached to them. -## Object Storage Private access - - - ## Region and Availability Zone diff --git a/pages/vpc/how-to/enable-object-storage-private-access.mdx b/pages/vpc/how-to/enable-object-storage-private-access.mdx index 19602bfa10..b8592f04bb 100644 --- a/pages/vpc/how-to/enable-object-storage-private-access.mdx +++ b/pages/vpc/how-to/enable-object-storage-private-access.mdx @@ -8,14 +8,9 @@ dates: --- import Requirements from '@macros/iam/requirements.mdx' import ImportantBucketPolicy from '@macros/storage/important-bucket-policy.mdx' +import ObjectStoragePrivateAccess from '@macros/vpc/object-storage-private-access.mdx' - -Object Storage private access creates a private connection path between a VPC and Object Storage buckets. Instead of reaching buckets over the public internet, traffic from your resources transits over the internal Scaleway network. - -When the feature is enabled, all buckets in the region of the VPC are reachable privately from the selected Private Networks. Access relies on two independent components, and a request is accepted only if both coditions are satisfied: - -- the request comes from a resource in a Private Network within a VPC on which Object Storage private access is enabled -- the [bucket policy](/object-storage/api-cli/bucket-policy/) of the target bucket explicitly allows the request. + From a73902c13571a7654554a46645246a46e5acb7f8 Mon Sep 17 00:00:00 2001 From: Samy OUBOUAZIZ Date: Fri, 18 Sep 2026 11:30:53 +0200 Subject: [PATCH 10/17] feat(vpc): updates --- macros/vpc/object-storage-private-access.mdx | 2 +- .../use-obj-stor-with-private-networks.mdx | 6 ++++-- .../enable-object-storage-private-access.mdx | 18 ++++-------------- 3 files changed, 9 insertions(+), 17 deletions(-) diff --git a/macros/vpc/object-storage-private-access.mdx b/macros/vpc/object-storage-private-access.mdx index da617fa0bf..046c3770f4 100644 --- a/macros/vpc/object-storage-private-access.mdx +++ b/macros/vpc/object-storage-private-access.mdx @@ -4,7 +4,7 @@ macro: object-storage-private-access Object Storage private access creates a private connection path between a VPC and Object Storage buckets. Instead of reaching buckets over the public internet, traffic from your resources transits over the internal Scaleway network. -When the feature is enabled, all buckets in the region of the VPC are reachable privately from the selected Private Networks. Access relies on two independent components, and a request is accepted only if both coditions are satisfied: +When the feature is enabled, all buckets in the region of the VPC are reachable privately from the selected Private Networks. Access relies on two independent components, and a request is accepted only if both conditions are satisfied: - the request comes from a resource in a Private Network within a VPC on which Object Storage private access is enabled - the [bucket policy](/object-storage/api-cli/bucket-policy/) of the target bucket explicitly allows the request. \ No newline at end of file diff --git a/pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx b/pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx index 752cfa51fa..76db935ce9 100644 --- a/pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx +++ b/pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx @@ -7,7 +7,7 @@ dates: posted: 2021-05-27 --- import Requirements from '@macros/iam/requirements.mdx' - +import ObjectStoragePrivateAccess from '@macros/vpc/object-storage-private-access.mdx' Resources attached to a [Private Network](/vpc/concepts/#private-networks) have no direct access to Object Storage, as buckets are reached over the public internet. @@ -24,7 +24,9 @@ traffic from resources in a Private Network to the public endpoint of an Object ## Using Object Storage private access -Object Storage private access is the recommended method to securely reach a bucket from a Private Network. Traffic transits over the internal Scaleway network, instead of the public internet. +Object Storage private access is the recommended method to securely reach a bucket from a Private Network. + + 1. Enable Object Storage private access on the VPC via the [Object Storage private access API](https://www.scaleway.com/en/developers/api/vpc/object-storage-private-access/). diff --git a/pages/vpc/how-to/enable-object-storage-private-access.mdx b/pages/vpc/how-to/enable-object-storage-private-access.mdx index b8592f04bb..2adc5391e5 100644 --- a/pages/vpc/how-to/enable-object-storage-private-access.mdx +++ b/pages/vpc/how-to/enable-object-storage-private-access.mdx @@ -22,17 +22,11 @@ import ObjectStoragePrivateAccess from '@macros/vpc/object-storage-private-acces ## Overview -Object Storage private access relies on two components, configured in two different sections of the Scaleway console: +The two components are configured in two different sections of the Scaleway console, and you can set them up in any order: -- Object Storage private access, enabled on a VPC, allows the selected Private Networks of that VPC to reach Object Storage without transiting over the public internet. +- **Object Storage private access** is enabled on a VPC, for the Private Networks you select. It applies no restriction at bucket level: buckets remain reachable both from the internet and from the VPC. -- The bucket policy is the authorization layer. Enabling the endpoint applies no restriction at bucket level: buckets remain reachable both from the internet and from the VPC. To reject public traffic, apply a bucket policy with the `aws:SourceVpc` condition matching the ID of your VPC. - - -Both components are required to obtain private and restricted access. Neither component is sufficient on its own. - - -The two configuration steps are independent, and you can perform them in any order. +- The **bucket policy** is the authorization layer. To reject public traffic, apply a bucket policy with the `aws:SourceVpc` condition matching the ID of your VPC. ## How to enable Object Storage private access on a VPC @@ -64,7 +58,7 @@ Refer to the [VPC API documentation](https://www.scaleway.com/en/developers/api/ ## How to restrict bucket access to a VPC -When the endpoint is enabled, every bucket of the region whose bucket policy allows it is reachable from the VPC. To limit the access to a bucket to your VPC only, apply a bucket policy with the `StringEquals` condition and the `aws:SourceVpc` condition key. +To limit the access to a bucket to your VPC only, apply a bucket policy with the `StringEquals` condition and the `aws:SourceVpc` condition key. @@ -110,10 +104,6 @@ Enabling the endpoint on a VPC does not restrict access on its own. Without a bu When a bucket policy restricts access to a VPC ID, the Scaleway console can no longer display the objects, metrics, or logs of that bucket. Plan a management method from inside the VPC before applying such a policy. -### The endpoint applies at VPC level, not at bucket level - -Enabling the endpoint makes all buckets of the region privately reachable from the VPC. The bucket policy of each bucket determines which VPCs can access it. - ### Bucket policies cannot target a single Private Network You select which Private Networks of the VPC use the private path, but a bucket policy cannot target a specific Private Network: the `aws:SourceVpc` condition key recognizes the ID of the VPC only. From 37f00563c535d4baa7643c844f50fa304ba45efb Mon Sep 17 00:00:00 2001 From: Samy OUBOUAZIZ Date: Thu, 24 Sep 2026 10:37:23 +0200 Subject: [PATCH 11/17] feat(vpc): jc update with bp doc --- macros/vpc/object-storage-private-access.mdx | 14 +++-- .../object-storage/api-cli/bucket-policy.mdx | 2 +- .../use-obj-stor-with-private-networks.mdx | 12 ++--- .../enable-object-storage-private-access.mdx | 54 +++++++++++++------ .../object-storage-private-access-issues.mdx | 21 ++++++-- 5 files changed, 72 insertions(+), 31 deletions(-) diff --git a/macros/vpc/object-storage-private-access.mdx b/macros/vpc/object-storage-private-access.mdx index 046c3770f4..f4789d589c 100644 --- a/macros/vpc/object-storage-private-access.mdx +++ b/macros/vpc/object-storage-private-access.mdx @@ -2,9 +2,15 @@ macro: object-storage-private-access --- -Object Storage private access creates a private connection path between a VPC and Object Storage buckets. Instead of reaching buckets over the public internet, traffic from your resources transits over the internal Scaleway network. +Object Storage private access allows resources in your Private Networks to reach Object Storage over the internal Scaleway network, instead of the public internet. -When the feature is enabled, all buckets in the region of the VPC are reachable privately from the selected Private Networks. Access relies on two independent components, and a request is accepted only if both conditions are satisfied: +Buckets are always served on two endpoints, whether the feature is enabled or not: -- the request comes from a resource in a Private Network within a VPC on which Object Storage private access is enabled -- the [bucket policy](/object-storage/api-cli/bucket-policy/) of the target bucket explicitly allows the request. \ No newline at end of file +| Endpoint | Regional URL | Bucket URL | +|--------------|------------------------------|---------------------------------------------| +| Public | `s3..scw.cloud` | `.s3..scw.cloud` | +| VPC | `s3-vpc..scw.eu` | `.s3-vpc..scw.eu` | + +Enabling Object Storage private access on a VPC makes the VPC endpoint reachable from the Private Networks you select, for all buckets in the region of the VPC. Without it, the VPC endpoint is not reachable from a Private Network. + +The feature adds a private path to your buckets. It does not remove the public path, and it does not change the permissions of your buckets. diff --git a/pages/object-storage/api-cli/bucket-policy.mdx b/pages/object-storage/api-cli/bucket-policy.mdx index 3107db99c2..f3223c53c4 100644 --- a/pages/object-storage/api-cli/bucket-policy.mdx +++ b/pages/object-storage/api-cli/bucket-policy.mdx @@ -632,7 +632,7 @@ To view the bucket policy action corresponding to each Object Storage API operat } ``` -* You can restrict access to the resources of a given VPC with the `aws:SourceVpc` condition key. This condition key requires [Object Storage private access](/vpc/how-to/enable-object-storage-private-access/) to be enabled on the VPC: +* You can restrict a statement to the requests coming from a given VPC with the `aws:SourceVpc` condition key. The condition matches the requests that reach the bucket over the VPC endpoint, which requires [Object Storage private access](/vpc/how-to/enable-object-storage-private-access/) to be enabled on the VPC: ```json { diff --git a/pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx b/pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx index 76db935ce9..7f0c4dad9d 100644 --- a/pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx +++ b/pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx @@ -11,9 +11,9 @@ import ObjectStoragePrivateAccess from '@macros/vpc/object-storage-private-acces Resources attached to a [Private Network](/vpc/concepts/#private-networks) have no direct access to Object Storage, as buckets are reached over the public internet. -[Object Storage private access](/object-storage/concepts/#private-access) keeps the traffic between your Private Networks and your buckets on the internal Scaleway network. +[Object Storage private access](/object-storage/concepts/#object-storage-private-access) keeps the traffic between your Private Networks and your buckets on the internal Scaleway network. -Alternatively, you can use a [Public Gateway](/public-gateways/concepts/#public-gateway) to route +Alternatively, you can use a [Public Gateway](/public-gateways/concepts/#public-gateway) to route traffic from resources in a Private Network to the public endpoint of an Object Storage bucket. @@ -28,14 +28,14 @@ Object Storage private access is the recommended method to securely reach a buck -1. Enable Object Storage private access on the VPC via the [Object Storage private access API](https://www.scaleway.com/en/developers/api/vpc/object-storage-private-access/). +1. Enable Object Storage private access on the VPC, and select the Private Networks within this VPC you want to authorize, using the [Object Storage private access API](https://www.scaleway.com/en/developers/api/vpc/object-storage-private-access/). -2. Select the Private Networks within this VPC you want to authorize using the [Object Storage private access API](https://www.scaleway.com/en/developers/api/vpc/object-storage-private-access/). +2. Configure your Object Storage client on the resources of these Private Networks with the VPC endpoint of the bucket, `.s3-vpc..scw.eu`. -3. Apply a bucket policy with the `StringEquals` condition and the `aws:SourceVpc` condition key on the bucket to restrict, so that requests coming from outside the VPC are denied. +3. Optionally, apply a bucket policy with the `StringEquals` condition operator and the `aws:SourceVpc` condition key on the bucket, to deny the requests coming from outside the VPC. -Enabling Object Storage private access on a VPC applies no restriction at bucket level: without a bucket policy, buckets remain reachable from the public internet. +Enabling Object Storage private access on a VPC applies no restriction at bucket level: buckets keep their public endpoint and their existing permissions. Use a bucket policy to reject public requests. See [Configuring Object Storage private access](/vpc/how-to/enable-object-storage-private-access/) for comprehensive information. diff --git a/pages/vpc/how-to/enable-object-storage-private-access.mdx b/pages/vpc/how-to/enable-object-storage-private-access.mdx index 2adc5391e5..f767c37d75 100644 --- a/pages/vpc/how-to/enable-object-storage-private-access.mdx +++ b/pages/vpc/how-to/enable-object-storage-private-access.mdx @@ -1,9 +1,9 @@ --- title: Configuring Object Storage private access -description: Learn how to enable Object Storage private access on a Scaleway VPC, and how to restrict bucket access to your VPC with an aws:SourceVpc bucket policy condition. +description: Learn how to enable Object Storage private access on a Scaleway VPC, how to reach the VPC endpoint from a Private Network, and how to restrict bucket access with an aws:SourceVpc bucket policy condition. tags: vpc object-storage private-access object-storage-private-access bucket-policy aws-sourcevpc private-network dates: - validation: 2026-08-21 + validation: 2026-09-24 posted: 2026-08-21 --- import Requirements from '@macros/iam/requirements.mdx' @@ -20,14 +20,6 @@ import ObjectStoragePrivateAccess from '@macros/vpc/object-storage-private-acces - A [VPC](/vpc/how-to/create-vpc/) with at least one [Private Network](/vpc/how-to/create-private-network/) - An [Object Storage bucket](/object-storage/how-to/create-a-bucket/) in the region of the VPC -## Overview - -The two components are configured in two different sections of the Scaleway console, and you can set them up in any order: - -- **Object Storage private access** is enabled on a VPC, for the Private Networks you select. It applies no restriction at bucket level: buckets remain reachable both from the internet and from the VPC. - -- The **bucket policy** is the authorization layer. To reject public traffic, apply a bucket policy with the `aws:SourceVpc` condition matching the ID of your VPC. - ## How to enable Object Storage private access on a VPC @@ -56,9 +48,37 @@ Enabling Object Storage private access on a VPC triggers billing for the feature Refer to the [VPC API documentation](https://www.scaleway.com/en/developers/api/vpc/object-storage-private-access/) for more information. +## How to reach a bucket over the VPC endpoint + +Resources in an authorized Private Network reach Object Storage privately only when they target the VPC endpoint. A client configured with the public endpoint keeps sending its requests over the public internet. + +1. Connect to a resource attached to an authorized Private Network of the VPC. +2. Point your Object Storage client at the VPC endpoint of the region. For the AWS CLI, set the `endpoint_url` in your `~/.aws/config` file: + + ``` + [default] + region = fr-par + output = json + services = scw-fr-par + + [services scw-fr-par] + s3 = + endpoint_url = https://s3-vpc.fr-par.scw.eu + ``` + +3. List the contents of your bucket, replacing `` with the name of your bucket: + + ```bash + aws s3 ls s3:// + ``` + + The same command run from a machine outside the VPC fails, as the VPC endpoint is not reachable from the public internet. + ## How to restrict bucket access to a VPC -To limit the access to a bucket to your VPC only, apply a bucket policy with the `StringEquals` condition and the `aws:SourceVpc` condition key. +Object Storage private access adds a private path, and applies no restriction at bucket level. Access to a bucket remains governed by [IAM permissions](/object-storage/api-cli/combining-iam-and-object-storage/) and by its [bucket policy](/object-storage/api-cli/bucket-policy/). This step is therefore optional: use it when you want a bucket to accept requests coming from your VPC only. + +To do so, apply a bucket policy with the `StringEquals` condition operator and the `aws:SourceVpc` condition key. @@ -88,7 +108,11 @@ To limit the access to a bucket to your VPC only, apply a bucket policy with the ``` 4. Replace the `` and `` placeholders with the name of your bucket and the ID of your VPC. -5. Save the bucket policy. Requests that do not come from Private Networks within the VPC are denied. +5. Save the bucket policy. + + +A statement with an `aws:SourceVpc` condition does not make a bucket private by itself: any other statement of the policy that allows the request still grants access. Review the whole policy to make sure no other statement allows requests coming from outside the VPC. + See the [bucket policies overview](/object-storage/api-cli/bucket-policy/) for more information on the syntax and the elements of a bucket policy. @@ -96,9 +120,9 @@ See the [bucket policies overview](/object-storage/api-cli/bucket-policy/) for m ## Key considerations -### A bucket without a bucket policy remains publicly accessible +### Buckets remain publicly reachable by default -Enabling the endpoint on a VPC does not restrict access on its own. Without a bucket policy, the bucket remains reachable from the internet, as well as from the Private Networks of the VPC. +Enabling the feature on a VPC restricts nothing. Every bucket keeps its public endpoint, and its existing permissions apply unchanged. Use a bucket policy to reject requests coming from outside the VPC. ### The Scaleway console accesses buckets over the internet @@ -106,7 +130,7 @@ When a bucket policy restricts access to a VPC ID, the Scaleway console can no l ### Bucket policies cannot target a single Private Network -You select which Private Networks of the VPC use the private path, but a bucket policy cannot target a specific Private Network: the `aws:SourceVpc` condition key recognizes the ID of the VPC only. +You select which Private Networks of the VPC reach the VPC endpoint, but a bucket policy cannot target a specific Private Network: the `aws:SourceVpc` condition key recognizes the ID of the VPC only. ## Troubleshooting diff --git a/pages/vpc/troubleshooting/object-storage-private-access-issues.mdx b/pages/vpc/troubleshooting/object-storage-private-access-issues.mdx index fe3ec6ff58..a59a609232 100644 --- a/pages/vpc/troubleshooting/object-storage-private-access-issues.mdx +++ b/pages/vpc/troubleshooting/object-storage-private-access-issues.mdx @@ -7,7 +7,17 @@ dates: posted: 2026-08-21 --- -[Object Storage private access](/vpc/how-to/enable-object-storage-private-access/) relies on two independent components: the feature enabled on the VPC, which creates the private path, and a bucket policy with an `aws:SourceVpc` condition, which restricts access to the bucket. Most issues come from one of the two components being missing or incomplete. +[Object Storage private access](/vpc/how-to/enable-object-storage-private-access/) makes the Object Storage VPC endpoint, `s3-vpc..scw.eu`, reachable from the Private Networks you select. It adds a private path to your buckets: it does not remove their public endpoint, and does not change their permissions. Most issues come from a client that still targets the public endpoint, or from a bucket policy that does not match the requests coming from the VPC. + +## My traffic still transits over the public internet + +### Cause + +The client keeps targeting the public endpoint of the bucket, `.s3..scw.cloud`. Both endpoints stay available when the feature is enabled, and the feature does not redirect the requests sent to the public endpoint. + +### Solution + +Configure your client with the VPC endpoint, `.s3-vpc..scw.eu`. For the AWS CLI, set `endpoint_url = https://s3-vpc..scw.eu` in your `~/.aws/config` file, as described in [How to reach a bucket over the VPC endpoint](/vpc/how-to/enable-object-storage-private-access/#how-to-reach-a-bucket-over-the-vpc-endpoint). ## My bucket is still reachable from the internet @@ -15,17 +25,17 @@ dates: Object Storage private access is enabled on the VPC, but no bucket policy restricts access to the bucket. Enabling the feature adds a private path, and does not remove public access. -Alternatively, a bucket policy that contained the VPC condition was deleted, which removes all restrictions on the bucket. +Alternatively, a statement of the bucket policy still allows the request. A statement with an `aws:SourceVpc` condition does not make a bucket private on its own: any other statement that allows the request grants access. ### Solution -Apply a bucket policy with an `aws:SourceVpc` condition on the bucket, as described in [How to restrict bucket access to a VPC](/vpc/how-to/enable-object-storage-private-access/#how-to-restrict-bucket-access-to-a-vpc). +Apply a bucket policy with an `aws:SourceVpc` condition on the bucket, as described in [How to restrict bucket access to a VPC](/vpc/how-to/enable-object-storage-private-access/#how-to-restrict-bucket-access-to-a-vpc), and check that no other statement of the policy allows requests coming from outside the VPC. ## Resources in my VPC cannot reach my bucket ### Cause -The private path is incomplete, or the bucket policy never matches the requests coming from the VPC. +The VPC endpoint is not reachable from the resource, or the bucket policy never matches the requests coming from the VPC. ### Solution @@ -34,7 +44,8 @@ Check the following points: - Object Storage private access is enabled on the VPC. - The Private Network of the resource is authorized on the VPC. - The bucket is in the region of the VPC. -- The bucket policy references the ID of a VPC on which Object Storage private access is enabled. A condition that references any other VPC never matches a request. +- The client uses the VPC endpoint of the region the bucket is in. A VPC endpoint of another region is not reachable. +- The bucket policy, if any, references the ID of a VPC on which Object Storage private access is enabled. A condition that references any other VPC never matches a request. ## The Scaleway console no longer displays my objects, metrics, or logs From 000068afbc5adc1aa55f3dd4ed167f96dc1ce114 Mon Sep 17 00:00:00 2001 From: Samy OUBOUAZIZ Date: Thu, 24 Sep 2026 10:51:30 +0200 Subject: [PATCH 12/17] feat(vpc): remove bp doc --- .../object-storage/api-cli/bucket-policy.mdx | 25 +------ .../use-obj-stor-with-private-networks.mdx | 4 +- .../enable-object-storage-private-access.mdx | 71 ++++--------------- .../object-storage-private-access-issues.mdx | 44 ++---------- 4 files changed, 23 insertions(+), 121 deletions(-) diff --git a/pages/object-storage/api-cli/bucket-policy.mdx b/pages/object-storage/api-cli/bucket-policy.mdx index f3223c53c4..ea11a47d32 100644 --- a/pages/object-storage/api-cli/bucket-policy.mdx +++ b/pages/object-storage/api-cli/bucket-policy.mdx @@ -532,7 +532,7 @@ To view the bucket policy action corresponding to each Object Storage API operat : `Statement` **Condition keys** -: `aws:SourceIp`, `aws:SourceVpc`, `aws:Referer`, `aws:CurrentTime`, `aws:EpochTime`, `aws:SecureTransport`, `s3:prefix` +: `aws:SourceIp`, `aws:Referer`, `aws:CurrentTime`, `aws:EpochTime`, `aws:SecureTransport`, `s3:prefix` **Examples** @@ -632,29 +632,6 @@ To view the bucket policy action corresponding to each Object Storage API operat } ``` -* You can restrict a statement to the requests coming from a given VPC with the `aws:SourceVpc` condition key. The condition matches the requests that reach the bucket over the VPC endpoint, which requires [Object Storage private access](/vpc/how-to/enable-object-storage-private-access/) to be enabled on the VPC: - -```json -{ - "Version": "2023-04-17", - "Id": "MyBucketPolicy", - "Statement": [ - { - "Sid": "Allow access from my VPC only", - "Effect": "Allow", - "Principal": "*", - "Action": ["s3:ListBucket", "s3:GetObject"], - "Resource": ["", "/*"], - "Condition": { - "StringEquals": { - "aws:SourceVpc": "" - } - } - } - ] -} -``` - #### Supported condition operators - `Bool` diff --git a/pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx b/pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx index 7f0c4dad9d..a510ab8090 100644 --- a/pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx +++ b/pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx @@ -32,10 +32,8 @@ Object Storage private access is the recommended method to securely reach a buck 2. Configure your Object Storage client on the resources of these Private Networks with the VPC endpoint of the bucket, `.s3-vpc..scw.eu`. -3. Optionally, apply a bucket policy with the `StringEquals` condition operator and the `aws:SourceVpc` condition key on the bucket, to deny the requests coming from outside the VPC. - -Enabling Object Storage private access on a VPC applies no restriction at bucket level: buckets keep their public endpoint and their existing permissions. Use a bucket policy to reject public requests. +Enabling Object Storage private access on a VPC applies no restriction at bucket level: buckets keep their public endpoint and their existing permissions. See [Configuring Object Storage private access](/vpc/how-to/enable-object-storage-private-access/) for comprehensive information. diff --git a/pages/vpc/how-to/enable-object-storage-private-access.mdx b/pages/vpc/how-to/enable-object-storage-private-access.mdx index f767c37d75..040473d86a 100644 --- a/pages/vpc/how-to/enable-object-storage-private-access.mdx +++ b/pages/vpc/how-to/enable-object-storage-private-access.mdx @@ -1,15 +1,18 @@ --- title: Configuring Object Storage private access -description: Learn how to enable Object Storage private access on a Scaleway VPC, how to reach the VPC endpoint from a Private Network, and how to restrict bucket access with an aws:SourceVpc bucket policy condition. -tags: vpc object-storage private-access object-storage-private-access bucket-policy aws-sourcevpc private-network +description: Learn how to enable Object Storage private access on a Scaleway VPC, and how to reach your buckets over the VPC endpoint from a Private Network. +tags: vpc object-storage private-access object-storage-private-access private-network endpoint dates: validation: 2026-09-24 posted: 2026-08-21 --- import Requirements from '@macros/iam/requirements.mdx' -import ImportantBucketPolicy from '@macros/storage/important-bucket-policy.mdx' import ObjectStoragePrivateAccess from '@macros/vpc/object-storage-private-access.mdx' + +Object Storage private access is currently in private beta, and is available in the Paris (`fr-par`) region only. + + @@ -52,8 +55,8 @@ Refer to the [VPC API documentation](https://www.scaleway.com/en/developers/api/ Resources in an authorized Private Network reach Object Storage privately only when they target the VPC endpoint. A client configured with the public endpoint keeps sending its requests over the public internet. -1. Connect to a resource attached to an authorized Private Network of the VPC. -2. Point your Object Storage client at the VPC endpoint of the region. For the AWS CLI, set the `endpoint_url` in your `~/.aws/config` file: +1. Connect to an Instance attached to an authorized Private Network of the VPC. +2. Configure your Object Storage client to point at the VPC endpoint of the region. For the AWS CLI, set the `endpoint_url` in your `~/.aws/config` file: ``` [default] @@ -74,64 +77,20 @@ Resources in an authorized Private Network reach Object Storage privately only w The same command run from a machine outside the VPC fails, as the VPC endpoint is not reachable from the public internet. -## How to restrict bucket access to a VPC - -Object Storage private access adds a private path, and applies no restriction at bucket level. Access to a bucket remains governed by [IAM permissions](/object-storage/api-cli/combining-iam-and-object-storage/) and by its [bucket policy](/object-storage/api-cli/bucket-policy/). This step is therefore optional: use it when you want a bucket to accept requests coming from your VPC only. - -To do so, apply a bucket policy with the `StringEquals` condition operator and the `aws:SourceVpc` condition key. - - - -1. Click **Object Storage** in the **Storage** section of the [Scaleway console](https://console.scaleway.com/) side menu. The list of your buckets displays. -2. Click the name of the bucket, then click the **Bucket policy** tab. -3. Create a bucket policy that allows access from your VPC only: - - ```json - { - "Version": "2023-04-17", - "Id": "MyBucketPolicy", - "Statement": [ - { - "Sid": "AllowAccessFromSpecificVPC", - "Effect": "Allow", - "Principal": "*", - "Action": ["s3:ListBucket", "s3:GetObject"], - "Resource": ["", "/*"], - "Condition": { - "StringEquals": { - "aws:SourceVpc": "" - } - } - } - ] - } - ``` - -4. Replace the `` and `` placeholders with the name of your bucket and the ID of your VPC. -5. Save the bucket policy. - - -A statement with an `aws:SourceVpc` condition does not make a bucket private by itself: any other statement of the policy that allows the request still grants access. Review the whole policy to make sure no other statement allows requests coming from outside the VPC. - - - -See the [bucket policies overview](/object-storage/api-cli/bucket-policy/) for more information on the syntax and the elements of a bucket policy. - - ## Key considerations -### Buckets remain publicly reachable by default +### Buckets remain publicly reachable -Enabling the feature on a VPC restricts nothing. Every bucket keeps its public endpoint, and its existing permissions apply unchanged. Use a bucket policy to reject requests coming from outside the VPC. +Enabling the feature on a VPC restricts nothing. Every bucket keeps its public endpoint, and its existing permissions apply unchanged. -### The Scaleway console accesses buckets over the internet +### The feature applies to all buckets of the region -When a bucket policy restricts access to a VPC ID, the Scaleway console can no longer display the objects, metrics, or logs of that bucket. Plan a management method from inside the VPC before applying such a policy. +Enabling Object Storage private access makes every bucket of the region reachable over the VPC endpoint, from the Private Networks you select. You cannot enable it for a single bucket. -### Bucket policies cannot target a single Private Network +### Access rights are managed at bucket level -You select which Private Networks of the VPC reach the VPC endpoint, but a bucket policy cannot target a specific Private Network: the `aws:SourceVpc` condition key recognizes the ID of the VPC only. +Object Storage private access controls connectivity only. Which requests a bucket accepts remains governed by [IAM permissions](/object-storage/api-cli/combining-iam-and-object-storage/) and by its [bucket policy](/object-storage/api-cli/bucket-policy/), whichever endpoint the request comes from. ## Troubleshooting -See [I am experiencing issues with Object Storage private access](/vpc/troubleshooting/object-storage-private-access-issues/) for solutions to the most common issues, such as buckets that remain publicly reachable, or resources in a VPC that cannot access a bucket. +See [I am experiencing issues with Object Storage private access](/vpc/troubleshooting/object-storage-private-access-issues/) for solutions to the most common issues, such as traffic that still transits over the public internet, or resources in a VPC that cannot reach a bucket. diff --git a/pages/vpc/troubleshooting/object-storage-private-access-issues.mdx b/pages/vpc/troubleshooting/object-storage-private-access-issues.mdx index a59a609232..58f53751b8 100644 --- a/pages/vpc/troubleshooting/object-storage-private-access-issues.mdx +++ b/pages/vpc/troubleshooting/object-storage-private-access-issues.mdx @@ -1,13 +1,13 @@ --- title: I am experiencing issues with Object Storage private access -description: Solve the most common issues with Object Storage private access, such as buckets that remain publicly reachable, or resources in a VPC that cannot access a bucket. -tags: vpc object-storage private-access bucket-policy aws-sourcevpc private-network troubleshooting +description: Solve the most common issues with Object Storage private access, such as traffic that still transits over the public internet, or resources in a VPC that cannot reach a bucket. +tags: vpc object-storage private-access private-network endpoint troubleshooting dates: validation: 2026-08-21 posted: 2026-08-21 --- -[Object Storage private access](/vpc/how-to/enable-object-storage-private-access/) makes the Object Storage VPC endpoint, `s3-vpc..scw.eu`, reachable from the Private Networks you select. It adds a private path to your buckets: it does not remove their public endpoint, and does not change their permissions. Most issues come from a client that still targets the public endpoint, or from a bucket policy that does not match the requests coming from the VPC. +[Object Storage private access](/vpc/how-to/enable-object-storage-private-access/) makes the Object Storage VPC endpoint, `s3-vpc..scw.eu`, reachable from the Private Networks you select. It adds a private path to your buckets: it does not remove their public endpoint, and does not change their permissions. Most issues come from a client that still targets the public endpoint, or from a Private Network that is not authorized on the VPC. ## My traffic still transits over the public internet @@ -19,23 +19,11 @@ The client keeps targeting the public endpoint of the bucket, `.s3. Configure your client with the VPC endpoint, `.s3-vpc..scw.eu`. For the AWS CLI, set `endpoint_url = https://s3-vpc..scw.eu` in your `~/.aws/config` file, as described in [How to reach a bucket over the VPC endpoint](/vpc/how-to/enable-object-storage-private-access/#how-to-reach-a-bucket-over-the-vpc-endpoint). -## My bucket is still reachable from the internet - -### Cause - -Object Storage private access is enabled on the VPC, but no bucket policy restricts access to the bucket. Enabling the feature adds a private path, and does not remove public access. - -Alternatively, a statement of the bucket policy still allows the request. A statement with an `aws:SourceVpc` condition does not make a bucket private on its own: any other statement that allows the request grants access. - -### Solution - -Apply a bucket policy with an `aws:SourceVpc` condition on the bucket, as described in [How to restrict bucket access to a VPC](/vpc/how-to/enable-object-storage-private-access/#how-to-restrict-bucket-access-to-a-vpc), and check that no other statement of the policy allows requests coming from outside the VPC. - ## Resources in my VPC cannot reach my bucket ### Cause -The VPC endpoint is not reachable from the resource, or the bucket policy never matches the requests coming from the VPC. +The VPC endpoint is not reachable from the resource, or the credentials of the client do not allow the operation. ### Solution @@ -45,29 +33,9 @@ Check the following points: - The Private Network of the resource is authorized on the VPC. - The bucket is in the region of the VPC. - The client uses the VPC endpoint of the region the bucket is in. A VPC endpoint of another region is not reachable. -- The bucket policy, if any, references the ID of a VPC on which Object Storage private access is enabled. A condition that references any other VPC never matches a request. - -## The Scaleway console no longer displays my objects, metrics, or logs - -### Cause - -The Scaleway console accesses buckets over the internet. When the bucket policy denies requests that do not come from the VPC, the console requests are denied. - -### Solution - -Manage the bucket from a resource inside the VPC. If you no longer need the restriction, delete or edit the bucket policy. - -## I lost access to my bucket - -### Cause - -The bucket policy allows requests coming from the VPC only, and you have no management method from inside the VPC. - -### Solution - -The [Owner](/iam/concepts/#owner) of the Organization always has the right to put and delete bucket policies, even when the policy does not allow them to perform other bucket operations. Ask the Owner of the Organization to edit or delete the bucket policy. +- The API key of the client holds the [IAM permissions](/iam/concepts/#permission) required for the operation. ## Going further - [Configuring Object Storage private access](/vpc/how-to/enable-object-storage-private-access/) -- [Bucket policies overview](/object-storage/api-cli/bucket-policy/) +- [How to use Object Storage with Private Networks](/object-storage/how-to/use-obj-stor-with-private-networks/) From d587a930f9c826c2167cb07d779f4c57f547ba19 Mon Sep 17 00:00:00 2001 From: Samy OUBOUAZIZ Date: Fri, 25 Sep 2026 16:46:45 +0200 Subject: [PATCH 13/17] feat(vpc): update with test --- .../how-to/use-obj-stor-with-private-networks.mdx | 12 ++++++------ .../how-to/enable-object-storage-private-access.mdx | 13 +++++++------ 2 files changed, 13 insertions(+), 12 deletions(-) diff --git a/pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx b/pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx index a510ab8090..3d7d065be3 100644 --- a/pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx +++ b/pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx @@ -24,17 +24,17 @@ traffic from resources in a Private Network to the public endpoint of an Object ## Using Object Storage private access + +Object Storage private access is currently in private beta, and is available in the Paris (`fr-par`) region only. + + Object Storage private access is the recommended method to securely reach a bucket from a Private Network. -1. Enable Object Storage private access on the VPC, and select the Private Networks within this VPC you want to authorize, using the [Object Storage private access API](https://www.scaleway.com/en/developers/api/vpc/object-storage-private-access/). +1. Enable Object Storage private access on the VPC, and select the Private Networks within this VPC you want to authorize, using the [VPC API](https://www.scaleway.com/en/developers/api/vpc/object-storage-private-access/). -2. Configure your Object Storage client on the resources of these Private Networks with the VPC endpoint of the bucket, `.s3-vpc..scw.eu`. - - -Enabling Object Storage private access on a VPC applies no restriction at bucket level: buckets keep their public endpoint and their existing permissions. - +2. Configure your Object Storage client on the resources of the authorized Private Networks to use the private regional endpoint `s3-vpc..scw.eu` See [Configuring Object Storage private access](/vpc/how-to/enable-object-storage-private-access/) for comprehensive information. diff --git a/pages/vpc/how-to/enable-object-storage-private-access.mdx b/pages/vpc/how-to/enable-object-storage-private-access.mdx index 040473d86a..7199be6f1c 100644 --- a/pages/vpc/how-to/enable-object-storage-private-access.mdx +++ b/pages/vpc/how-to/enable-object-storage-private-access.mdx @@ -45,7 +45,7 @@ Enabling Object Storage private access on a VPC triggers billing for the feature curl -X POST \ -H "X-Auth-Token: $SCW_SECRET_KEY" \ -H "Content-Type: application/json" \ - -d '{"private_network_id":"6170692e-7363-616c-6577-61792e636f6d"}' \ + -d '{"private_network_id":"example-717b-6045-74503301df334"}' \ "https://api.scaleway.com/vpc/v2/regions/{region}/object-storage-private-access/{vpc_id}/private-networks" ``` @@ -56,6 +56,7 @@ Refer to the [VPC API documentation](https://www.scaleway.com/en/developers/api/ Resources in an authorized Private Network reach Object Storage privately only when they target the VPC endpoint. A client configured with the public endpoint keeps sending its requests over the public internet. 1. Connect to an Instance attached to an authorized Private Network of the VPC. + 2. Configure your Object Storage client to point at the VPC endpoint of the region. For the AWS CLI, set the `endpoint_url` in your `~/.aws/config` file: ``` @@ -69,10 +70,10 @@ Resources in an authorized Private Network reach Object Storage privately only w endpoint_url = https://s3-vpc.fr-par.scw.eu ``` -3. List the contents of your bucket, replacing `` with the name of your bucket: +3. Run the command below to list your buckets present in the specified region: ```bash - aws s3 ls s3:// + aws s3 ls ``` The same command run from a machine outside the VPC fails, as the VPC endpoint is not reachable from the public internet. @@ -81,15 +82,15 @@ Resources in an authorized Private Network reach Object Storage privately only w ### Buckets remain publicly reachable -Enabling the feature on a VPC restricts nothing. Every bucket keeps its public endpoint, and its existing permissions apply unchanged. +Enabling the feature on a VPC does not restrict public connectivity. Every bucket keeps its public endpoint, and its existing permissions remain unchanged. ### The feature applies to all buckets of the region -Enabling Object Storage private access makes every bucket of the region reachable over the VPC endpoint, from the Private Networks you select. You cannot enable it for a single bucket. +Enabling Object Storage private access makes every bucket of the region reachable over the private endpoint, from the Private Networks you select. You cannot enable it for a single bucket. ### Access rights are managed at bucket level -Object Storage private access controls connectivity only. Which requests a bucket accepts remains governed by [IAM permissions](/object-storage/api-cli/combining-iam-and-object-storage/) and by its [bucket policy](/object-storage/api-cli/bucket-policy/), whichever endpoint the request comes from. +Object Storage private access controls connectivity only. The requests allowed on a bucket are managed via [IAM permissions](/object-storage/api-cli/combining-iam-and-object-storage/) and [bucket policies](/object-storage/api-cli/bucket-policy/). ## Troubleshooting From f5ede2e45fa873aef0ea8dd3626d8e754647854a Mon Sep 17 00:00:00 2001 From: Samy OUBOUAZIZ Date: Mon, 28 Sep 2026 10:41:11 +0200 Subject: [PATCH 14/17] feat(vpc): update --- pages/object-storage/concepts.mdx | 2 +- .../how-to/use-obj-stor-with-private-networks.mdx | 6 +++--- pages/vpc/concepts.mdx | 3 +-- pages/vpc/how-to/enable-object-storage-private-access.mdx | 2 +- .../object-storage-private-access-issues.mdx | 2 +- 5 files changed, 7 insertions(+), 8 deletions(-) diff --git a/pages/object-storage/concepts.mdx b/pages/object-storage/concepts.mdx index 124a1ec58e..69d07f3dea 100644 --- a/pages/object-storage/concepts.mdx +++ b/pages/object-storage/concepts.mdx @@ -113,7 +113,7 @@ Contrary to other storage types such as block devices or file systems, Object St Read our [quickstart documentation](/object-storage/quickstart/) to get started with Scaleway Object Storage. -## Object Storage Private access +## Object Storage private access diff --git a/pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx b/pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx index 3d7d065be3..841c31d0df 100644 --- a/pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx +++ b/pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx @@ -3,13 +3,13 @@ title: How to use Object Storage with Private Networks description: Learn how to securely reach Scaleway Object Storage from resources attached to a Private Network. tags: object-storage private-networks private-network public-gateway vpc route dates: - validation: 2025-08-11 + validation: 2026-09-28 posted: 2021-05-27 --- import Requirements from '@macros/iam/requirements.mdx' import ObjectStoragePrivateAccess from '@macros/vpc/object-storage-private-access.mdx' -Resources attached to a [Private Network](/vpc/concepts/#private-networks) have no direct access to Object Storage, as buckets are reached over the public internet. +By default, resources attached to a [Private Network](/vpc/concepts/#private-networks) reach Object Storage over the public internet, which requires them to hold a public IP address or to transit through a gateway. [Object Storage private access](/object-storage/concepts/#object-storage-private-access) keeps the traffic between your Private Networks and your buckets on the internal Scaleway network. @@ -22,7 +22,7 @@ traffic from resources in a Private Network to the public endpoint of an Object - [Owner](/iam/concepts/#owner) status or [IAM permissions](/iam/concepts/#permission) allowing you to perform actions in the intended Organization - An [Object Storage bucket](/object-storage/how-to/create-a-bucket/) -## Using Object Storage private access +## Use Object Storage private access Object Storage private access is currently in private beta, and is available in the Paris (`fr-par`) region only. diff --git a/pages/vpc/concepts.mdx b/pages/vpc/concepts.mdx index 19d7471579..0817d8c248 100644 --- a/pages/vpc/concepts.mdx +++ b/pages/vpc/concepts.mdx @@ -91,11 +91,10 @@ NACLs are currently in Public Beta, and configurable only via the [VPC API](http A VPC's Network **A**ccess **C**control **L**ist is composed of stateless rules to control the flow of traffic between Private Networks. By default, the list contains no rules, and therefore traffic is allowed to flow unrestrictedly between the VPC's Private Networks. Add rules to the list to start creating restrictions. [Take a deeper dive into NACLs](/vpc/reference-content/understanding-nacls/). -## Object Storage Private access +## Object Storage private access - ## Private IP address A [private IP address](/vpc/how-to/attach-resources-to-pn/#how-to-view-the-resources-ip-address) identifies a resource on a Private Network. When you attach a resource (e.g. an Instance) to the network, you can either [use a reserved IP address](/ipam/how-to/reserve-ip/), or let [DHCP](#dhcp) assign one IPv4 and (if the resource is IPv6-compatible) one IPv6 address from the designated [CIDR blocks](#cidr-block) to that resource. diff --git a/pages/vpc/how-to/enable-object-storage-private-access.mdx b/pages/vpc/how-to/enable-object-storage-private-access.mdx index 7199be6f1c..0013334876 100644 --- a/pages/vpc/how-to/enable-object-storage-private-access.mdx +++ b/pages/vpc/how-to/enable-object-storage-private-access.mdx @@ -1,5 +1,5 @@ --- -title: Configuring Object Storage private access +title: Configure Object Storage private access description: Learn how to enable Object Storage private access on a Scaleway VPC, and how to reach your buckets over the VPC endpoint from a Private Network. tags: vpc object-storage private-access object-storage-private-access private-network endpoint dates: diff --git a/pages/vpc/troubleshooting/object-storage-private-access-issues.mdx b/pages/vpc/troubleshooting/object-storage-private-access-issues.mdx index 58f53751b8..f4487f748d 100644 --- a/pages/vpc/troubleshooting/object-storage-private-access-issues.mdx +++ b/pages/vpc/troubleshooting/object-storage-private-access-issues.mdx @@ -3,7 +3,7 @@ title: I am experiencing issues with Object Storage private access description: Solve the most common issues with Object Storage private access, such as traffic that still transits over the public internet, or resources in a VPC that cannot reach a bucket. tags: vpc object-storage private-access private-network endpoint troubleshooting dates: - validation: 2026-08-21 + validation: 2026-09-28 posted: 2026-08-21 --- From da9a7ca3e7b7e06ae143eb09ed59bfc9da846490 Mon Sep 17 00:00:00 2001 From: Samy OUBOUAZIZ Date: Mon, 28 Sep 2026 10:43:48 +0200 Subject: [PATCH 15/17] feat(vpc): update --- macros/vpc/object-storage-private-access.mdx | 4 ++++ .../how-to/use-obj-stor-with-private-networks.mdx | 4 ---- pages/vpc/how-to/enable-object-storage-private-access.mdx | 4 ---- 3 files changed, 4 insertions(+), 8 deletions(-) diff --git a/macros/vpc/object-storage-private-access.mdx b/macros/vpc/object-storage-private-access.mdx index f4789d589c..6ed5246c48 100644 --- a/macros/vpc/object-storage-private-access.mdx +++ b/macros/vpc/object-storage-private-access.mdx @@ -2,6 +2,10 @@ macro: object-storage-private-access --- + +Object Storage private access is currently in private beta, and is available in the Paris (`fr-par`) region only. + + Object Storage private access allows resources in your Private Networks to reach Object Storage over the internal Scaleway network, instead of the public internet. Buckets are always served on two endpoints, whether the feature is enabled or not: diff --git a/pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx b/pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx index 841c31d0df..e97cd8bcca 100644 --- a/pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx +++ b/pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx @@ -24,10 +24,6 @@ traffic from resources in a Private Network to the public endpoint of an Object ## Use Object Storage private access - -Object Storage private access is currently in private beta, and is available in the Paris (`fr-par`) region only. - - Object Storage private access is the recommended method to securely reach a bucket from a Private Network. diff --git a/pages/vpc/how-to/enable-object-storage-private-access.mdx b/pages/vpc/how-to/enable-object-storage-private-access.mdx index 0013334876..d59ce83dc5 100644 --- a/pages/vpc/how-to/enable-object-storage-private-access.mdx +++ b/pages/vpc/how-to/enable-object-storage-private-access.mdx @@ -9,10 +9,6 @@ dates: import Requirements from '@macros/iam/requirements.mdx' import ObjectStoragePrivateAccess from '@macros/vpc/object-storage-private-access.mdx' - -Object Storage private access is currently in private beta, and is available in the Paris (`fr-par`) region only. - - From f94e6907d89981e94ce501dd31ebec0cc8cdfb6f Mon Sep 17 00:00:00 2001 From: Samy OUBOUAZIZ Date: Mon, 28 Sep 2026 11:39:04 +0200 Subject: [PATCH 16/17] feat(vpc): review --- macros/vpc/object-storage-private-access.mdx | 2 +- .../how-to/use-obj-stor-with-private-networks.mdx | 12 +++++------- .../how-to/enable-object-storage-private-access.mdx | 2 +- .../object-storage-private-access-issues.mdx | 2 +- 4 files changed, 8 insertions(+), 10 deletions(-) diff --git a/macros/vpc/object-storage-private-access.mdx b/macros/vpc/object-storage-private-access.mdx index 6ed5246c48..6ff72a2c90 100644 --- a/macros/vpc/object-storage-private-access.mdx +++ b/macros/vpc/object-storage-private-access.mdx @@ -8,7 +8,7 @@ Object Storage private access is currently in private beta, and is available in Object Storage private access allows resources in your Private Networks to reach Object Storage over the internal Scaleway network, instead of the public internet. -Buckets are always served on two endpoints, whether the feature is enabled or not: +Buckets are always served on 2 endpoints, whether the feature is enabled or not: | Endpoint | Regional URL | Bucket URL | |--------------|------------------------------|---------------------------------------------| diff --git a/pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx b/pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx index e97cd8bcca..3a9bd351e7 100644 --- a/pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx +++ b/pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx @@ -13,8 +13,7 @@ By default, resources attached to a [Private Network](/vpc/concepts/#private-net [Object Storage private access](/object-storage/concepts/#object-storage-private-access) keeps the traffic between your Private Networks and your buckets on the internal Scaleway network. -Alternatively, you can use a [Public Gateway](/public-gateways/concepts/#public-gateway) to route -traffic from resources in a Private Network to the public endpoint of an Object Storage bucket. +Alternatively, you can use a [Public Gateway](/public-gateways/concepts/#public-gateway) to route traffic from resources in a Private Network to the public endpoint of an Object Storage bucket. @@ -30,9 +29,9 @@ Object Storage private access is the recommended method to securely reach a buck 1. Enable Object Storage private access on the VPC, and select the Private Networks within this VPC you want to authorize, using the [VPC API](https://www.scaleway.com/en/developers/api/vpc/object-storage-private-access/). -2. Configure your Object Storage client on the resources of the authorized Private Networks to use the private regional endpoint `s3-vpc..scw.eu` +2. Configure your Object Storage client on the resources of the authorized Private Networks to use the private regional endpoint `s3-vpc..scw.eu`. -See [Configuring Object Storage private access](/vpc/how-to/enable-object-storage-private-access/) for comprehensive information. +See [Configuring Object Storage private access](/vpc/how-to/enable-object-storage-private-access/) for more information. ## Using a Public Gateway @@ -42,7 +41,6 @@ The procedure below shows how to create an Instance without a public IP address, ### Create an Instance and attach it to a Private Network - 1. Follow the instructions for [creating an Instance](/instances/how-to/create-an-instance/) in the same Region as your Object storage bucket. Make sure you disable public connectivity for your Instance. 2. Follow the instructions for [creating a Private Network](/vpc/how-to/create-private-network/). Make sure you create it in the region that encompasses the Availability Zone of the Instance you previously created. @@ -57,9 +55,9 @@ The procedure below shows how to create an Instance without a public IP address, 3. Select **Allocate a new IP**. 4. Enter a name and optional tags for your Public Gateway. -2. Click the name of the new Public Gateway. The dashboard of the gateway displays. +2. Click the name of the new Public Gateway. The dashboard of the gateway opens. 3. Click the **Private Networks** tab. -4. Click **Attach to a new Private Network**. A pop-up window displays. +4. Click **Attach to a new Private Network**. A dialog appears. 5. Select **Attach to an existing Private Network** and pick a Private Network from the drop-down list. 6. Click **Attach to Private Network**. diff --git a/pages/vpc/how-to/enable-object-storage-private-access.mdx b/pages/vpc/how-to/enable-object-storage-private-access.mdx index d59ce83dc5..eb771f62cb 100644 --- a/pages/vpc/how-to/enable-object-storage-private-access.mdx +++ b/pages/vpc/how-to/enable-object-storage-private-access.mdx @@ -66,7 +66,7 @@ Resources in an authorized Private Network reach Object Storage privately only w endpoint_url = https://s3-vpc.fr-par.scw.eu ``` -3. Run the command below to list your buckets present in the specified region: +3. Run the following command to list your buckets present in the specified region: ```bash aws s3 ls diff --git a/pages/vpc/troubleshooting/object-storage-private-access-issues.mdx b/pages/vpc/troubleshooting/object-storage-private-access-issues.mdx index f4487f748d..69dfde1160 100644 --- a/pages/vpc/troubleshooting/object-storage-private-access-issues.mdx +++ b/pages/vpc/troubleshooting/object-storage-private-access-issues.mdx @@ -1,6 +1,6 @@ --- title: I am experiencing issues with Object Storage private access -description: Solve the most common issues with Object Storage private access, such as traffic that still transits over the public internet, or resources in a VPC that cannot reach a bucket. +description: Solve Object Storage private access common issues, such as traffic that still transits over the public internet, or resources in a VPC that cannot reach a bucket tags: vpc object-storage private-access private-network endpoint troubleshooting dates: validation: 2026-09-28 From 873e087080a4e4e1649545ee5101a51732085386 Mon Sep 17 00:00:00 2001 From: Samy OUBOUAZIZ Date: Mon, 28 Sep 2026 11:54:06 +0200 Subject: [PATCH 17/17] feat(vpc): review 2 --- .../how-to/use-obj-stor-with-private-networks.mdx | 2 +- pages/vpc/how-to/enable-object-storage-private-access.mdx | 4 ++-- .../object-storage-private-access-issues.mdx | 6 +++--- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx b/pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx index 3a9bd351e7..471bf8c595 100644 --- a/pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx +++ b/pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx @@ -33,7 +33,7 @@ Object Storage private access is the recommended method to securely reach a buck See [Configuring Object Storage private access](/vpc/how-to/enable-object-storage-private-access/) for more information. -## Using a Public Gateway +## Use Object Storage with a Public Gateway [Public Gateways](/public-gateways/concepts/#public-gateway) allow resources in a Private Network to securely reach the public internet without using a public IP address. Traffic to your buckets then transits over the public internet, and each resource requires a routing configuration. Use this method for the use cases that Object Storage private access does not cover. diff --git a/pages/vpc/how-to/enable-object-storage-private-access.mdx b/pages/vpc/how-to/enable-object-storage-private-access.mdx index eb771f62cb..897cb79f9d 100644 --- a/pages/vpc/how-to/enable-object-storage-private-access.mdx +++ b/pages/vpc/how-to/enable-object-storage-private-access.mdx @@ -19,7 +19,7 @@ import ObjectStoragePrivateAccess from '@macros/vpc/object-storage-private-acces - A [VPC](/vpc/how-to/create-vpc/) with at least one [Private Network](/vpc/how-to/create-private-network/) - An [Object Storage bucket](/object-storage/how-to/create-a-bucket/) in the region of the VPC -## How to enable Object Storage private access on a VPC +## Enable Object Storage private access on a VPC Enabling Object Storage private access on a VPC triggers billing for the feature. @@ -47,7 +47,7 @@ Enabling Object Storage private access on a VPC triggers billing for the feature Refer to the [VPC API documentation](https://www.scaleway.com/en/developers/api/vpc/object-storage-private-access/) for more information. -## How to reach a bucket over the VPC endpoint +## Reach a bucket over the VPC endpoint Resources in an authorized Private Network reach Object Storage privately only when they target the VPC endpoint. A client configured with the public endpoint keeps sending its requests over the public internet. diff --git a/pages/vpc/troubleshooting/object-storage-private-access-issues.mdx b/pages/vpc/troubleshooting/object-storage-private-access-issues.mdx index 69dfde1160..cb0c30ee38 100644 --- a/pages/vpc/troubleshooting/object-storage-private-access-issues.mdx +++ b/pages/vpc/troubleshooting/object-storage-private-access-issues.mdx @@ -7,17 +7,17 @@ dates: posted: 2026-08-21 --- -[Object Storage private access](/vpc/how-to/enable-object-storage-private-access/) makes the Object Storage VPC endpoint, `s3-vpc..scw.eu`, reachable from the Private Networks you select. It adds a private path to your buckets: it does not remove their public endpoint, and does not change their permissions. Most issues come from a client that still targets the public endpoint, or from a Private Network that is not authorized on the VPC. +[Object Storage private access](/vpc/how-to/enable-object-storage-private-access/) makes the Object Storage VPC endpoint, `s3-vpc..scw.eu`, reachable from the Private Networks you select. It adds a private path to your buckets: it does not remove their public endpoint, and does not change their permissions. Most issues come from a client that still targets the public endpoint, or from a Private Network that is not authorized on the VPC. ## My traffic still transits over the public internet ### Cause -The client keeps targeting the public endpoint of the bucket, `.s3..scw.cloud`. Both endpoints stay available when the feature is enabled, and the feature does not redirect the requests sent to the public endpoint. +The client keeps targeting the public endpoint of the bucket, `.scw.eu`. Both endpoints stay available when the feature is enabled, and the feature does not redirect the requests sent to the public endpoint. ### Solution -Configure your client with the VPC endpoint, `.s3-vpc..scw.eu`. For the AWS CLI, set `endpoint_url = https://s3-vpc..scw.eu` in your `~/.aws/config` file, as described in [How to reach a bucket over the VPC endpoint](/vpc/how-to/enable-object-storage-private-access/#how-to-reach-a-bucket-over-the-vpc-endpoint). +Configure your client with the VPC endpoint, `.scw.eu`. For the AWS CLI, set `endpoint_url = https://s3-vpc..scw.eu` in your `~/.aws/config` file, as described in [How to reach a bucket over the VPC endpoint](/vpc/how-to/enable-object-storage-private-access/#how-to-reach-a-bucket-over-the-vpc-endpoint). ## Resources in my VPC cannot reach my bucket