# S3 API Supported Actions

DanubeData Object Storage provides S3-compatible storage powered by Ceph RGW. The following tables list supported S3 API actions and known limitations.

## Bucket Operations

| Action | Status | Limitations |
|--------|--------|-------------|
| `CreateBucket` | Not supported | Buckets must be created via the DanubeData dashboard or API |
| `DeleteBucket` | Not supported | Buckets must be deleted via the DanubeData dashboard or API |
| `HeadBucket` | Supported | |
| `ListBuckets` | Supported | |
| `GetBucketLocation` | Supported | |
| `GetBucketVersioning` / `PutBucketVersioning` | Supported | |
| `GetBucketPolicy` / `PutBucketPolicy` | Supported | |
| `GetBucketCors` / `PutBucketCors` / `DeleteBucketCors` | Supported | |
| `GetBucketLifecycleConfiguration` / `PutBucketLifecycleConfiguration` | Supported | |
| `GetBucketTagging` / `PutBucketTagging` / `DeleteBucketTagging` | Supported | |
| `GetBucketEncryption` / `PutBucketEncryption` / `DeleteBucketEncryption` | Supported | SSE-S3 (AES-256) and SSE-KMS |
| `GetBucketAcl` / `PutBucketAcl` | Supported | |
| `GetBucketRequestPayment` | Not supported | |
| `GetBucketNotification` | Not supported | |
| `GetBucketAccelerateConfiguration` | Not supported | |
| `GetBucketWebsite` | Not supported | |
| `GetBucketAnalyticsConfiguration` | Not supported | |
| `GetBucketIntelligentTieringConfiguration` | Not supported | |
| `GetBucketInventoryConfiguration` | Not supported | |
| `GetBucketLogging` | Not supported | |
| `GetBucketMetricsConfiguration` | Not supported | |
| `GetBucketOwnershipControls` | Not supported | |
| `GetBucketReplication` | Not supported | |

## Object Operations

| Action | Status | Limitations |
|--------|--------|-------------|
| `PutObject` | Supported | Max 5 TB per object |
| `GetObject` | Supported | |
| `HeadObject` | Supported | |
| `DeleteObject` | Supported | |
| `DeleteObjects` (multi-delete) | Supported | |
| `CopyObject` | Supported | Works on server-side encrypted objects |
| `ListObjects` / `ListObjectsV2` | Supported | |
| `GetObjectTagging` / `PutObjectTagging` / `DeleteObjectTagging` | Supported | |
| `GetObjectAcl` / `PutObjectAcl` | Supported | |
| `RestoreObject` | Not supported | |
| `SelectObjectContent` | Not supported | |
| `GetObjectTorrent` | Not supported | |
| `GetObjectAttributes` | Not supported | |

## Object Lock Operations

Object Lock provides write-once-read-many (WORM) retention. See [Object Storage security](https://docs.danubedata.ro/object-storage-security#object-lock-worm) for how modes and retention work.

| Action | Status | Limitations |
|--------|--------|-------------|
| `GetObjectLockConfiguration` | Supported | Object Lock must be enabled when the bucket is created; it cannot be added to an existing bucket |
| `PutObjectLockConfiguration` | Supported | Requires a team-wide access key; bucket-scoped keys cannot change the bucket's default retention. Set it from the bucket's **Settings** tab instead |
| `GetObjectRetention` / `PutObjectRetention` | Supported | GOVERNANCE and COMPLIANCE modes. A scoped key can add or extend a retention, never shorten one |
| `GetObjectLegalHold` / `PutObjectLegalHold` | Supported | |
| `BypassGovernanceRetention` | Team-wide keys only | Bucket-scoped keys can never delete a locked version before its retention expires |

## Multipart Upload Operations

| Action | Status | Limitations |
|--------|--------|-------------|
| `CreateMultipartUpload` | Supported | |
| `UploadPart` | Supported | |
| `UploadPartCopy` | Partial | See [encryption limitation](#uploadpartcopy-and-server-side-encryption) below |
| `CompleteMultipartUpload` | Supported | |
| `AbortMultipartUpload` | Supported | |
| `ListMultipartUploads` | Supported | |
| `ListParts` | Supported | |

## Server-Side Encryption

| Action | Status | Limitations |
|--------|--------|-------------|
| SSE-S3 (AES-256) | Supported | Managed encryption keys via Vault |
| SSE-KMS | Supported | Customer-managed keys via Vault Transit |
| SSE-C (customer-provided keys) | Supported | Client provides key with each request |

## Presigned URLs

| Action | Status | Limitations |
|--------|--------|-------------|
| Presigned GET (download) | Supported | Configurable expiration |
| Presigned PUT (upload) | Supported | Configurable expiration |

## Known Limitations

### UploadPartCopy and Server-Side Encryption

**`UploadPartCopy` is not supported for server-side encrypted objects.** This applies to all server-side encryption methods (SSE-S3, SSE-KMS, and SSE-C). Attempting a multipart server-side copy of an encrypted object returns a `501 Not Implemented` error.

**`CopyObject` is no longer affected.** Server-side copies of encrypted objects work normally as of the 2026-08-07 storage platform update, which shipped the upstream fix ([Ceph PR #63794](https://github.com/ceph/ceph/pull/63794), released in Ceph v20.2.3). Only the multipart copy path remains outstanding.

The remaining limitation is tracked upstream in [Ceph Tracker #23264](https://tracker.ceph.com/issues/23264).

**Impact:** S3 clients switch from `CopyObject` to the multipart copy path for large objects, so move, rename, and metadata-update operations on encrypted objects can still fail above a certain size. The threshold is client-specific — the AWS CLI defaults to 8 MB (`multipart_threshold`) — and above 5 GB multipart copy is the only option, since `CopyObject` cannot be used for objects larger than that.

**Workarounds:**

1. **Raise the client's multipart threshold** — Keeping objects under the threshold routes them through `CopyObject`, which now works on encrypted objects. For the AWS CLI: `aws configure set default.s3.multipart_threshold 5GB`.
2. **Client-side encryption** — Encrypt data before uploading. The storage backend sees unencrypted blobs, so all copy operations work normally. Tools like rclone (`--crypt`), Cryptomator, restic, and Duplicati support this.
3. **Download and re-upload** — Instead of a server-side copy, download the object and upload it to the new location.

We are tracking the remaining upstream fix and will update this page when it is resolved.

---

**Questions?** Contact support at support@danubedata.ro