{"slug":"object-storage-supported-actions","title":"S3 API Supported Actions","description":"DanubeData Object Storage provides S3-compatible storage powered by Ceph RGW. The following tables list supported S3 API actions and known limitations.","section":"Features","url":"https://docs.danubedata.ro/object-storage-supported-actions","markdown_url":"https://docs.danubedata.ro/object-storage-supported-actions.md","breadcrumbs":[{"title":"Features","slug":null},{"title":"Storage","slug":"storage-overview"},{"title":"S3 API Supported Actions","slug":"object-storage-supported-actions"}],"headings":[{"level":1,"title":"S3 API Supported Actions","id":"s3-api-supported-actions"},{"level":2,"title":"Bucket Operations","id":"bucket-operations"},{"level":2,"title":"Object Operations","id":"object-operations"},{"level":2,"title":"Object Lock Operations","id":"object-lock-operations"},{"level":2,"title":"Multipart Upload Operations","id":"multipart-upload-operations"},{"level":2,"title":"Server-Side Encryption","id":"server-side-encryption"},{"level":2,"title":"Presigned URLs","id":"presigned-urls"},{"level":2,"title":"Known Limitations","id":"known-limitations"},{"level":3,"title":"UploadPartCopy and Server-Side Encryption","id":"uploadpartcopy-and-server-side-encryption"}],"format":"markdown","word_count":633,"content":"# S3 API Supported Actions\n\nDanubeData Object Storage provides S3-compatible storage powered by Ceph RGW. The following tables list supported S3 API actions and known limitations.\n\n## Bucket Operations\n\n| Action | Status | Limitations |\n|--------|--------|-------------|\n| `CreateBucket` | Not supported | Buckets must be created via the DanubeData dashboard or API |\n| `DeleteBucket` | Not supported | Buckets must be deleted via the DanubeData dashboard or API |\n| `HeadBucket` | Supported | |\n| `ListBuckets` | Supported | |\n| `GetBucketLocation` | Supported | |\n| `GetBucketVersioning` / `PutBucketVersioning` | Supported | |\n| `GetBucketPolicy` / `PutBucketPolicy` | Supported | |\n| `GetBucketCors` / `PutBucketCors` / `DeleteBucketCors` | Supported | |\n| `GetBucketLifecycleConfiguration` / `PutBucketLifecycleConfiguration` | Supported | |\n| `GetBucketTagging` / `PutBucketTagging` / `DeleteBucketTagging` | Supported | |\n| `GetBucketEncryption` / `PutBucketEncryption` / `DeleteBucketEncryption` | Supported | SSE-S3 (AES-256) and SSE-KMS |\n| `GetBucketAcl` / `PutBucketAcl` | Supported | |\n| `GetBucketRequestPayment` | Not supported | |\n| `GetBucketNotification` | Not supported | |\n| `GetBucketAccelerateConfiguration` | Not supported | |\n| `GetBucketWebsite` | Not supported | |\n| `GetBucketAnalyticsConfiguration` | Not supported | |\n| `GetBucketIntelligentTieringConfiguration` | Not supported | |\n| `GetBucketInventoryConfiguration` | Not supported | |\n| `GetBucketLogging` | Not supported | |\n| `GetBucketMetricsConfiguration` | Not supported | |\n| `GetBucketOwnershipControls` | Not supported | |\n| `GetBucketReplication` | Not supported | |\n\n## Object Operations\n\n| Action | Status | Limitations |\n|--------|--------|-------------|\n| `PutObject` | Supported | Max 5 TB per object |\n| `GetObject` | Supported | |\n| `HeadObject` | Supported | |\n| `DeleteObject` | Supported | |\n| `DeleteObjects` (multi-delete) | Supported | |\n| `CopyObject` | Supported | Works on server-side encrypted objects |\n| `ListObjects` / `ListObjectsV2` | Supported | |\n| `GetObjectTagging` / `PutObjectTagging` / `DeleteObjectTagging` | Supported | |\n| `GetObjectAcl` / `PutObjectAcl` | Supported | |\n| `RestoreObject` | Not supported | |\n| `SelectObjectContent` | Not supported | |\n| `GetObjectTorrent` | Not supported | |\n| `GetObjectAttributes` | Not supported | |\n\n## Object Lock Operations\n\nObject Lock provides write-once-read-many (WORM) retention. See [Object Storage security](https://docs.danubedata.ro/object-storage-security#object-lock-worm) for how modes and retention work.\n\n| Action | Status | Limitations |\n|--------|--------|-------------|\n| `GetObjectLockConfiguration` | Supported | Object Lock must be enabled when the bucket is created; it cannot be added to an existing bucket |\n| `PutObjectLockConfiguration` | Supported | Requires a team-wide access key; bucket-scoped keys cannot change the bucket's default retention. Set it from the bucket's **Settings** tab instead |\n| `GetObjectRetention` / `PutObjectRetention` | Supported | GOVERNANCE and COMPLIANCE modes. A scoped key can add or extend a retention, never shorten one |\n| `GetObjectLegalHold` / `PutObjectLegalHold` | Supported | |\n| `BypassGovernanceRetention` | Team-wide keys only | Bucket-scoped keys can never delete a locked version before its retention expires |\n\n## Multipart Upload Operations\n\n| Action | Status | Limitations |\n|--------|--------|-------------|\n| `CreateMultipartUpload` | Supported | |\n| `UploadPart` | Supported | |\n| `UploadPartCopy` | Partial | See [encryption limitation](#uploadpartcopy-and-server-side-encryption) below |\n| `CompleteMultipartUpload` | Supported | |\n| `AbortMultipartUpload` | Supported | |\n| `ListMultipartUploads` | Supported | |\n| `ListParts` | Supported | |\n\n## Server-Side Encryption\n\n| Action | Status | Limitations |\n|--------|--------|-------------|\n| SSE-S3 (AES-256) | Supported | Managed encryption keys via Vault |\n| SSE-KMS | Supported | Customer-managed keys via Vault Transit |\n| SSE-C (customer-provided keys) | Supported | Client provides key with each request |\n\n## Presigned URLs\n\n| Action | Status | Limitations |\n|--------|--------|-------------|\n| Presigned GET (download) | Supported | Configurable expiration |\n| Presigned PUT (upload) | Supported | Configurable expiration |\n\n## Known Limitations\n\n### UploadPartCopy and Server-Side Encryption\n\n**`UploadPartCopy` is not supported for server-side encrypted objects.** This applies to all server-side encryption methods (SSE-S3, SSE-KMS, and SSE-C). Attempting a multipart server-side copy of an encrypted object returns a `501 Not Implemented` error.\n\n**`CopyObject` is no longer affected.** Server-side copies of encrypted objects work normally as of the 2026-08-07 storage platform update, which shipped the upstream fix ([Ceph PR #63794](https://github.com/ceph/ceph/pull/63794), released in Ceph v20.2.3). Only the multipart copy path remains outstanding.\n\nThe remaining limitation is tracked upstream in [Ceph Tracker #23264](https://tracker.ceph.com/issues/23264).\n\n**Impact:** S3 clients switch from `CopyObject` to the multipart copy path for large objects, so move, rename, and metadata-update operations on encrypted objects can still fail above a certain size. The threshold is client-specific — the AWS CLI defaults to 8 MB (`multipart_threshold`) — and above 5 GB multipart copy is the only option, since `CopyObject` cannot be used for objects larger than that.\n\n**Workarounds:**\n\n1. **Raise the client's multipart threshold** — Keeping objects under the threshold routes them through `CopyObject`, which now works on encrypted objects. For the AWS CLI: `aws configure set default.s3.multipart_threshold 5GB`.\n2. **Client-side encryption** — Encrypt data before uploading. The storage backend sees unencrypted blobs, so all copy operations work normally. Tools like rclone (`--crypt`), Cryptomator, restic, and Duplicati support this.\n3. **Download and re-upload** — Instead of a server-side copy, download the object and upload it to the new location.\n\nWe are tracking the remaining upstream fix and will update this page when it is resolved.\n\n---\n\n**Questions?** Contact support at support@danubedata.ro\n","prev":{"title":"NVMe Storage","slug":"storage-nvme","url":"https://docs.danubedata.ro/storage-nvme","markdown_url":"https://docs.danubedata.ro/storage-nvme.md","json_url":"https://docs.danubedata.ro/storage-nvme.json"},"next":{"title":"Migration Troubleshooting","slug":"object-storage-migration","url":"https://docs.danubedata.ro/object-storage-migration","markdown_url":"https://docs.danubedata.ro/object-storage-migration.md","json_url":"https://docs.danubedata.ro/object-storage-migration.json"},"index_url":"https://docs.danubedata.ro/index.json"}