feat(vpc): add doc on private access

macros/vpc/object-storage-private-access.mdx

@@ -0,0 +1,20 @@
+---
+macro: object-storage-private-access
+---
+
+<Message type="important">
+Object Storage private access is currently in private beta, and is available in the Paris (`fr-par`) region only.
+</Message>
+
+Object Storage private access allows resources in your Private Networks to reach Object Storage over the internal Scaleway network, instead of the public internet.
+
+Buckets are always served on 2 endpoints, whether the feature is enabled or not:
+
+| Endpoint     | Regional URL                 | Bucket URL                                  |
+|--------------|------------------------------|---------------------------------------------|
+| Public       | `s3.<region>.scw.cloud`      | `<bucket_name>.s3.<region>.scw.cloud`       |
+| VPC          | `s3-vpc.<region>.scw.eu`     | `<bucket_name>.s3-vpc.<region>.scw.eu`      |
+
+Enabling Object Storage private access on a VPC makes the VPC endpoint reachable from the Private Networks you select, for all buckets in the region of the VPC. Without it, the VPC endpoint is not reachable from a Private Network.
+
+The feature adds a private path to your buckets. It does not remove the public path, and it does not change the permissions of your buckets.

pages/object-storage/concepts.mdx

@@ -8,6 +8,7 @@ dates:
 ---
 import RegionAndAz from '@macros/console/region-and-az.mdx'
 import StorageBucketPolicy from '@macros/storage/bucket-policy.mdx'
+import ObjectStoragePrivateAccess from '@macros/vpc/object-storage-private-access.mdx'
 
 
 ## Access control list (ACL)
@@ -112,6 +113,10 @@ Contrary to other storage types such as block devices or file systems, Object St
 
 Read our [quickstart documentation](/object-storage/quickstart/) to get started with Scaleway Object Storage.
 
+## Object Storage private access
+
+<ObjectStoragePrivateAccess />
+
 ## Parts
 
 Parts are individual segments of a larger object that is uploaded in multiple pieces during a multipart upload process. This method divides large uploads into manageable chunks, improving efficiency and reliability. If one part fails, only that part needs to be retried, rather than the entire file. Each part must be uploaded in sequence and identified by a part number, which helps Scaleway Object Storage to reassemble the complete object accurately after all parts have been successfully uploaded.

pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx

@@ -1,76 +1,89 @@
 ---
 title: How to use Object Storage with Private Networks
-description: Configure and use Object Storage with Private Networks.
-tags: object storage private-networks private network
+description: Learn how to securely reach Scaleway Object Storage from resources attached to a Private Network.
+tags: object-storage private-networks private-network public-gateway vpc route
 dates:
-  validation: 2025-08-11
+  validation: 2026-09-28
   posted: 2021-05-27
 ---
 import Requirements from '@macros/iam/requirements.mdx'
+import ObjectStoragePrivateAccess from '@macros/vpc/object-storage-private-access.mdx'
 
+By default, resources attached to a [Private Network](/vpc/concepts/#private-networks) reach Object Storage over the public internet, which requires them to hold a public IP address or to transit through a gateway.
 
-The [Public Gateway](/public-gateways/concepts/#public-gateway) feature of the [Private Networks](/vpc/concepts/#private-networks) allows Instances in your Private Network to reach resources on the internet without using a public IP address.
+[Object Storage private access](/object-storage/concepts/#object-storage-private-access) keeps the traffic between your Private Networks and your buckets on the internal Scaleway network.
 
-This documentation shows how to create an Instance without a public IP address, create a Private Network with a Public Gateway, and a route from your Instance to an Object Storage bucket.
+Alternatively, you can use a [Public Gateway](/public-gateways/concepts/#public-gateway) to route traffic from resources in a Private Network to the public endpoint of an Object Storage bucket.
 
 <Requirements />
 
 - A Scaleway account logged into the [console](https://console.scaleway.com)
 - [Owner](/iam/concepts/#owner) status or [IAM permissions](/iam/concepts/#permission) allowing you to perform actions in the intended Organization
 - An [Object Storage bucket](/object-storage/how-to/create-a-bucket/)
 
-## How to create an Instance without a public IP
+## Use Object Storage private access
 
-Follow the instructions for [creating an Instance](/instances/how-to/create-an-instance/).
+Object Storage private access is the recommended method to securely reach a bucket from a Private Network.
 
-You must create an Instance without a flexible IP using the following specifications for our Instance:
-  - **Availability Zone**: `nl-ams-1` (or another AZ of your choice).
-  - **OS Image**: Ubuntu 20.04 Focal Fossa
-  - **Instance type**: DEV1-S
-  - **Network configuration**: Untick the selected IP options
+<ObjectStoragePrivateAccess />
 
-## How to create a Private Network and attach the Instance
+1. Enable Object Storage private access on the VPC, and select the Private Networks within this VPC you want to authorize, using the [VPC API](https://www.scaleway.com/en/developers/api/vpc/object-storage-private-access/).
 
-1. Follow the instructions for [creating a Private Network](/vpc/how-to/create-private-network/). Make sure you create it in the region that encompasses the Availability Zone of the Instance you previously created.
-2. Follow the instructions to [attach your Instance to the Private Network](/vpc/how-to/attach-resources-to-pn/).
+2. Configure your Object Storage client on the resources of the authorized Private Networks to use the private regional endpoint `s3-vpc.<YOUR_REGION>.scw.eu`.
 
-## How to create a Public Gateway and attach the Private Network
+See [Configuring Object Storage private access](/vpc/how-to/enable-object-storage-private-access/) for more information.
+
+## Use Object Storage with a Public Gateway
+
+[Public Gateways](/public-gateways/concepts/#public-gateway) allow resources in a Private Network to securely reach the public internet without using a public IP address. Traffic to your buckets then transits over the public internet, and each resource requires a routing configuration. Use this method for the use cases that Object Storage private access does not cover.
+
+The procedure below shows how to create an Instance without a public IP address, attach it to a Private Network with a Public Gateway, and configure a route from the Instance to an Object Storage bucket.
+
+### Create an Instance and attach it to a Private Network
+
+1. Follow the instructions for [creating an Instance](/instances/how-to/create-an-instance/) in the same Region as your Object storage bucket. Make sure you disable public connectivity for your Instance.
+
+2. Follow the instructions for [creating a Private Network](/vpc/how-to/create-private-network/). Make sure you create it in the region that encompasses the Availability Zone of the Instance you previously created.
+3. Follow the instructions to [attach your Instance to the Private Network](/vpc/how-to/attach-resources-to-pn/).
+
+### Create a Public Gateway and attach it to the Private Network
 
 1. Follow the instructions for [creating a Public Gateway](/public-gateways/how-to/create-a-public-gateway/):
-    - Select the same Availability Zone as for your previously created Instance.
-    - Select a Public Gateway type according to your needs.
-    - Select **Allocate a new IP**.
-    - Enter a name and optional tags for your Public Gateway.
-    After creating your Public Gateway, you are directed to a list of this and any other Public Gateways you have previously created.
-2. Click on your new Public Gateway's name. The gateway's dashboard displays.
+
+    1. Select the same Availability Zone as for your previously created Instance.
+    2. Select a Public Gateway type according to your needs.
+    3. Select **Allocate a new IP**.
+    4. Enter a name and optional tags for your Public Gateway.
+
+2. Click the name of the new Public Gateway. The dashboard of the gateway opens.
 3. Click the **Private Networks** tab.
-4. Click **Attach to a new Private Network**. A pop-up window displays.
+4. Click **Attach to a new Private Network**. A dialog appears.
 5. Select **Attach to an existing Private Network** and pick a Private Network from the drop-down list.
 6. Click **Attach to Private Network**.
 
-## How to set the Object Storage Route
+### Set the Object Storage route
 
-1. SSH into your Instance using the following command:
-    ```
-    ssh root@your_virtual_instance_ip
+1. Connect to your Instance via SSH, replacing `<INSTANCE_IP>` with the IP address of the Instance:
+
+    ```bash
+    ssh root@<INSTANCE_IP>
     ```
 
     <Message type="note">
-    As your Instance has no public IP address, you must connect to it using another Instance in your Private Network or assign a temporary flexible IP to it.
+    As the Instance has no public IP address, you must connect to it from another Instance in the Private Network, or assign a temporary flexible IP address to it.
     </Message>
 
 2. Configure the following route to the Object Storage platform:
+
     ```bash
     # set this to keep the network on the instance
     ip route add 10.0.0.0/8 via `ip route | grep default | awk '{print $3} '` dev ens2
     # dhcp on pn interface
     dhclient ens5
     # change the default route
     ip route del default via `ip route | grep default | awk '{print $3} '` dev ens2
-    ip route add default via 192.168.42.1 dev ens5 # use the gateway ip in the gateway's description
+    ip route add default via 192.168.42.1 dev ens5 # use the IP address of the gateway, shown on the gateway dashboard
     curl https://s3.nl-ams.scw.cloud
     ```
 
-## Conclusion
-
-You have now configured an Instance with a Private Network to communicate with Scaleway's Object Storage platform using a Public Gateway. The gateway ensures the exchange of data between your Private Network and the public Internet.
+    The Instance now reaches Object Storage through the Public Gateway, which handles the exchange of data between the Private Network and the public internet.

pages/vpc/concepts.mdx

@@ -10,7 +10,7 @@ import RegionAndAz from '@macros/console/region-and-az.mdx'
 import IngressRoutingRuleConcept from '@macros/vpc/ingress-routing-rule-concept.mdx'
 import image from './assets/scaleway-vpc-pn-diag.webp'
 import image2 from './assets/scaleway-vpc-osi.webp'
-
+import ObjectStoragePrivateAccess from '@macros/vpc/object-storage-private-access.mdx'
 
 ## CIDR block
 
@@ -91,6 +91,10 @@ NACLs are currently in Public Beta, and configurable only via the [VPC API](http
 
 A VPC's Network **A**ccess **C**control **L**ist is composed of stateless rules to control the flow of traffic between Private Networks. By default, the list contains no rules, and therefore traffic is allowed to flow unrestrictedly between the VPC's Private Networks. Add rules to the list to start creating restrictions. [Take a deeper dive into NACLs](/vpc/reference-content/understanding-nacls/).
 
+## Object Storage private access
+
+<ObjectStoragePrivateAccess />
+
 ## Private IP address
 
 A [private IP address](/vpc/how-to/attach-resources-to-pn/#how-to-view-the-resources-ip-address) identifies a resource on a Private Network. When you attach a resource (e.g. an Instance) to the network, you can either [use a reserved IP address](/ipam/how-to/reserve-ip/), or let [DHCP](#dhcp) assign one IPv4 and (if the resource is IPv6-compatible) one IPv6 address from the designated [CIDR blocks](#cidr-block) to that resource.

pages/vpc/how-to/enable-object-storage-private-access.mdx

@@ -0,0 +1,93 @@
+---
+title: Configure Object Storage private access
+description: Learn how to enable Object Storage private access on a Scaleway VPC, and how to reach your buckets over the VPC endpoint from a Private Network.
+tags: vpc object-storage private-access object-storage-private-access private-network endpoint
+dates:
+  validation: 2026-09-24
+  posted: 2026-08-21
+---
+import Requirements from '@macros/iam/requirements.mdx'
+import ObjectStoragePrivateAccess from '@macros/vpc/object-storage-private-access.mdx'
+
+<ObjectStoragePrivateAccess />
+
+<Requirements />
+
+- A Scaleway account logged into the [console](https://console.scaleway.com)
+- [Owner](/iam/concepts/#owner) status or [IAM permissions](/iam/concepts/#permission) allowing you to perform actions in the intended Organization
+- A valid [API key](/iam/how-to/create-api-keys/)
+- A [VPC](/vpc/how-to/create-vpc/) with at least one [Private Network](/vpc/how-to/create-private-network/)
+- An [Object Storage bucket](/object-storage/how-to/create-a-bucket/) in the region of the VPC
+
+## Enable Object Storage private access on a VPC
+
+<Message type="note">
+Enabling Object Storage private access on a VPC triggers billing for the feature.
+</Message>
+
+1. Enable Object Storage private access on the VPC, listing the Private Networks to authorize:
+
+    ```bash
+    curl -X POST \
+      -H "X-Auth-Token: $SCW_SECRET_KEY" \
+      -H "Content-Type: application/json" \
+      -d '{"private_network_ids":["example-7363-616c-6577-61792e636f6d"]}' \
+      "https://api.scaleway.com/vpc/v2/regions/{region}/object-storage-private-access/{vpc_id}/enable"
+    ```
+
+2. Add another Private Network, if needed:
+
+    ```bash
+    curl -X POST \
+      -H "X-Auth-Token: $SCW_SECRET_KEY" \
+      -H "Content-Type: application/json" \
+      -d '{"private_network_id":"example-717b-6045-74503301df334"}' \
+      "https://api.scaleway.com/vpc/v2/regions/{region}/object-storage-private-access/{vpc_id}/private-networks"
+    ```
+
+Refer to the [VPC API documentation](https://www.scaleway.com/en/developers/api/vpc/object-storage-private-access/) for more information.
+
+## Reach a bucket over the VPC endpoint
+
+Resources in an authorized Private Network reach Object Storage privately only when they target the VPC endpoint. A client configured with the public endpoint keeps sending its requests over the public internet.
+
+1. Connect to an Instance attached to an authorized Private Network of the VPC.
+
+2. Configure your Object Storage client to point at the VPC endpoint of the region. For the AWS CLI, set the `endpoint_url` in your `~/.aws/config` file:
+
+    ```
+    [default]
+    region = fr-par
+    output = json
+    services = scw-fr-par
+
+    [services scw-fr-par]
+    s3 =
+      endpoint_url = https://s3-vpc.fr-par.scw.eu
+    ```
+
+3. Run the following command to list your buckets present in the specified region:
+
+    ```bash
+    aws s3 ls
+    ```
+
+    The same command run from a machine outside the VPC fails, as the VPC endpoint is not reachable from the public internet.
+
+## Key considerations
+
+### Buckets remain publicly reachable
+
+Enabling the feature on a VPC does not restrict public connectivity. Every bucket keeps its public endpoint, and its existing permissions remain unchanged.
+
+### The feature applies to all buckets of the region
+
+Enabling Object Storage private access makes every bucket of the region reachable over the private endpoint, from the Private Networks you select. You cannot enable it for a single bucket.
+
+### Access rights are managed at bucket level
+
+Object Storage private access controls connectivity only. The requests allowed on a bucket are managed via [IAM permissions](/object-storage/api-cli/combining-iam-and-object-storage/) and [bucket policies](/object-storage/api-cli/bucket-policy/).
+
+## Troubleshooting
+
+See [I am experiencing issues with Object Storage private access](/vpc/troubleshooting/object-storage-private-access-issues/) for solutions to the most common issues, such as traffic that still transits over the public internet, or resources in a VPC that cannot reach a bucket.

pages/vpc/menu.ts

@@ -38,6 +38,10 @@ export const vpcMenu = {
           label: 'Manage routing on a VPC',
           slug: 'manage-routing',
         },
+        {
+          label: 'Configure Object Storage private access',
+          slug: 'enable-object-storage-private-access',
+        },
         {
           label: 'Use Network ACLs',
           slug: 'use-network-acl',

pages/vpc/troubleshooting/index.mdx

@@ -67,4 +67,5 @@ productIcon: VpcProductIcon
   - [My legacy Instance is attached to a Private Network but auto-configuration is not working](/vpc/troubleshooting/autoconfig-not-working)
   - [VPC limitations](/vpc/troubleshooting/vpc-limitations)
   - [I cannot connect to resources in a Private Network using SSH bastion](/vpc/troubleshooting/cant-connect-to-pn-resource-via-ssh/)
+  - [I am experiencing issues with Object Storage private access](/vpc/troubleshooting/object-storage-private-access-issues/)
 </LinksList>

pages/vpc/troubleshooting/object-storage-private-access-issues.mdx

@@ -0,0 +1,41 @@
+---
+title: I am experiencing issues with Object Storage private access
+description: Solve Object Storage private access common issues, such as traffic that still transits over the public internet, or resources in a VPC that cannot reach a bucket
+tags: vpc object-storage private-access private-network endpoint troubleshooting
+dates:
+  validation: 2026-09-28
+  posted: 2026-08-21
+---
+
+[Object Storage private access](/vpc/how-to/enable-object-storage-private-access/) makes the Object Storage VPC endpoint, `s3-vpc.<REGION>.scw.eu`, reachable from the Private Networks you select. It adds a private path to your buckets: it does not remove their public endpoint, and does not change their permissions. Most issues come from a client that still targets the public endpoint, or from a Private Network that is not authorized on the VPC.
+
+## My traffic still transits over the public internet
+
+### Cause
+
+The client keeps targeting the public endpoint of the bucket, `<BUCKET_NAME.s3-vpc.<REGION>.scw.eu`. Both endpoints stay available when the feature is enabled, and the feature does not redirect the requests sent to the public endpoint.
+
+### Solution
+
+Configure your client with the VPC endpoint, `<BUCKET_NAME.s3-vpc.<REGION>.scw.eu`. For the AWS CLI, set `endpoint_url = https://s3-vpc.<REGION>.scw.eu` in your `~/.aws/config` file, as described in [How to reach a bucket over the VPC endpoint](/vpc/how-to/enable-object-storage-private-access/#how-to-reach-a-bucket-over-the-vpc-endpoint).
+
+## Resources in my VPC cannot reach my bucket
+
+### Cause
+
+The VPC endpoint is not reachable from the resource, or the credentials of the client do not allow the operation.
+
+### Solution
+
+Check the following points:
+
+- Object Storage private access is enabled on the VPC.
+- The Private Network of the resource is authorized on the VPC.
+- The bucket is in the region of the VPC.
+- The client uses the VPC endpoint of the region the bucket is in. A VPC endpoint of another region is not reachable.
+- The API key of the client holds the [IAM permissions](/iam/concepts/#permission) required for the operation.
+
+## Going further
+
+- [Configuring Object Storage private access](/vpc/how-to/enable-object-storage-private-access/)
+- [How to use Object Storage with Private Networks](/object-storage/how-to/use-obj-stor-with-private-networks/)