S3-compatible storage

Amazon S3, MinIO, Wasabi, Cloudflare R2 and DigitalOcean Spaces, through one driver.

Requests are signed in PHP with AWS Signature Version 4. No SDK is required, and no shell access.

Fields

Per-provider settings

Amazon S3

• Endpoint URL — blank
• Region — the bucket's region, e.g. eu-west-1
• Path-style — off

MinIO

• Endpoint URL — https://minio.example.com (include the port if non-standard)
• Region — us-east-1 unless you configured otherwise
• Path-style — on. MinIO is the usual reason this switch exists

Cloudflare R2

• Endpoint URL — https://<account-id>.r2.cloudflarestorage.com
• Region — auto
• Path-style — on

Wasabi

• Endpoint URL — https://s3.<region>.wasabisys.com
• Region — matching the endpoint, e.g. eu-central-1
• Path-style — off for the regional endpoints

DigitalOcean Spaces

• Endpoint URL — https://<region>.digitaloceanspaces.com
• Region — the Space's region, e.g. fra1
• Path-style — off

The directory caveat

Object stores have no directories. A bucket is a flat map of keys to objects; the folder structure you see is inferred from / characters in key names.

The practical consequences:

• An "empty folder" is a fiction. Creating one writes a zero-byte marker object. It exists as long as the marker does, and disappears the moment the marker is removed — including when something else cleans up zero-byte objects.
• Deleting a folder deletes its objects. There is no directory to remove separately.
• Moving a folder rewrites keys. There is no server-side rename of a prefix, so a move is a copy of every object followed by a delete.

The driver declares true_directories as unsupported, so the interface adjusts rather than offering operations that behave surprisingly. See the capability table in Storage.

Prefixes and scope

The key prefix field restricts the whole drive to one folder within the bucket. Set it to clients/acme and the drive's root is that folder — nothing above it is reachable through this storage at all.

This is a useful second layer under profile roots: the prefix bounds what the credential can address through this drive, and profile roots bound what each user can address within it.

Note that the prefix does not replace bucket-level IAM. If the access key can read the whole bucket, a second storage without a prefix would see all of it. Scope the key too.

Permissions on the key

The driver needs, on the bucket and the prefix you are using:

• s3:ListBucket — browsing
• s3:GetObject — reading, downloading, previewing
• s3:PutObject — uploading, editing, creating folders
• s3:DeleteObject — deleting, and the delete half of a move

Grant only what the drive needs. A read-only archive drive wants ListBucket and GetObject and nothing else — then even a profile root marked writable cannot write, because the credential cannot.

Practical notes

• Region mismatches are the most common failure. A bucket in eu-west-1 addressed as us-east-1 fails in a way that reads like an authentication error. Check the region first.
• Path-style is the second most common. If MinIO or a self-hosted server refuses everything, turn it on.
• Search enumerates by key prefix. It works, but on a bucket with very many objects it is worth starting from a deeper folder. See Search.
• Transfer costs are real. Cross-drive copies and ZIP downloads pull objects through your server, so egress is billed. R2 and MinIO make this cheaper than S3 does.