S3 object storage for enterprise IT

Object storage for applications, archives and protected data

S3 stores data as objects in buckets and makes it available through an API. It is a strong fit for modern applications, backup repositories and large unstructured datasets—and can be managed through AWS CLI or an integrated S3 File Manager.

Discuss your architecture See the eEKAS example

APPLICATIONS

BACKUP

AWS CLI + FILE MANAGER

↓

S3 API · ACCESS KEYS · POLICIES

What makes an object different?

An S3 object combines the data itself, descriptive metadata and a unique key. Applications address objects through HTTP-based API operations rather than mounting a traditional disk or navigating a POSIX file system.

Buckets provide the top-level administrative boundary for access, quotas, versioning, lifecycle and retention settings.

An object has three essential parts

PayloadThe file, image, backup segment or application data.

MetadataInformation used to describe, classify or process the object.

KeyThe unique identifier through which the API retrieves the object.

Choose the access model

Block, file and object are complementary

The correct choice depends on how the application expects to access and organise data.

Model	Application sees	Best suited to	Important consideration
Block	A raw volume	Virtual machines, databases and host file systems	The host owns the file system and structure.
File	Files and directories	User shares, collaborative workflows and applications expecting SMB/NFS	Directory and locking semantics are part of the service.
Object / S3	Buckets, objects and metadata through an API	Applications, backup, archive and large unstructured datasets	Applications must use S3 semantics or an appropriate integration.

S3 is not a conventional mounted file system. A browser can provide familiar file-style interaction for people, while applications continue to use the S3 API.

Good fit or poor fit?

Use S3 where its operating model adds value

A strong fit

Backup and long-term retention repositories
Application data accessed through an S3 API
Archives and large unstructured datasets
Media assets, research data and data pipelines
Workloads that benefit from object metadata and lifecycle rules

Consider another access model

Applications that require a raw block device
VM datastores expecting block or supported shared-file protocols
Workflows dependent on traditional file locking and POSIX semantics
Frequent in-place modification of small regions inside large files
Legacy software without S3 support or a qualified gateway

Reference architecture

Separate client access from distributed data protection

The S3 endpoint accepts API requests and directs operations to the object layer. Applications can connect directly through the S3 API, while people can use a separate S3 File Manager with its own authentication and user interface.

S3 clientsApplications, backup software, SDKs and AWS CLI connect directly to the S3 API over HTTPS.

→

S3 service endpointsAuthentication, bucket policies, quotas, logging and load distribution are applied at the service layer.

→

Object data layerObjects are distributed across storage nodes using the selected replication or erasure-coding profile.

Two access experiences for the same protected object storage

Direct S3 access

Applications and tools Backup applications, SDKs, AWS CLI and other S3-compatible clients use the endpoint and credentials issued for their workload.

This is the normal API path for automated systems and existing S3 integrations.

Separate user application

Integrated S3 File Manager The File Manager has its own login and is not part of the administrator console. Authorised users connect directly and work with their permitted buckets through a browser.

As with services such as AWS or Wasabi, users can create and manage buckets, upload and download files, organise objects and use sharing functions according to their permissions.

Use AWS CLI with the private S3 endpoint

Point AWS CLI to the service URL and use the access and secret keys issued by the platform. Familiar commands such as ls, cp and sync can then address private S3 storage without sending the data path through AWS.

aws --endpoint-url https://s3.example.com s3 ls

S3 compatibility supports standard S3 workflows but does not imply support for every AWS-specific service or extension. For broader resilience, zones or sites can be separated; multi-site designs require explicit bandwidth, latency and recovery planning.

Protection and retention

Versioning, Object Lock and backup are not the same

Each control addresses a different risk. A robust design usually combines several layers.

Cluster redundancy Keeps the service available through permitted disk or node failures.

Versioning Retains multiple versions so an earlier object state can be recovered.

Object Lock / WORM Prevents deletion or modification during a defined retention period when correctly configured.

Independent copy Protects against site loss, administrative mistakes and risks outside the storage cluster.

Do not equate high availability with backup. Replication and erasure coding protect service continuity. They can also propagate accidental deletion or unwanted changes unless versioning, retention and independent copies are part of the design.

Governance without unnecessary complexity

Control buckets, users and retention graphically

Routine administration does not have to depend on S3 command-line tools. A graphical service console can create users and buckets, issue access keys, apply quotas and configure WORM, policies, CORS, lifecycle rules and access logging.

IdentityUsers and access-key rotation

BoundariesBucket ownership and quotas

GovernancePolicies, WORM and lifecycle

VisibilityAccess logging and usage

Graphical S3 bucket administration with quota, WORM and lifecycle controls

Bucket administration in the eEKAS service consoleThe interface brings common S3 governance tasks into one operational view.

Integrated end-user S3 File ManagerBrowser-based access to buckets and objects without a separate S3 client.

A capability not every vendor includes

S3 access for people—not only applications

Many object-storage products expose an S3 API and an administrator console but leave end users dependent on third-party software. eEKAS includes a browser-based S3 File Manager so authorised users can work with their own buckets through a familiar interface. No command-line knowledge or locally installed S3 client is required for everyday object access.

Create buckets and folders
Upload, download, rename, copy, move and delete objects
Download folders as ZIP archives
Create presigned links and controlled public URLs
Review object details and available versions
Manage bucket versioning, WORM, lifecycle and quota options

Application patterns

Where enterprise S3 delivers practical value

Backup repositories Store backup objects with versioning and retention controls defined according to the backup application and recovery policy.

Archive and compliance Retain immutable objects for defined periods and manage lifecycle transitions or expiry deliberately.

Application data Provide an S3-compatible endpoint for cloud-native and data-oriented applications.

Media libraries Organise large volumes of images, video and documents using object keys and metadata.

Research and analytics Build scalable repositories for datasets consumed by multiple processing tools.

Private object services Offer controlled S3 access inside an organisation without depending exclusively on a public cloud.

Choose the euroNAS S3 platform

Premium, HA Cluster and eEKAS address different S3 requirements

All three platforms can provide S3 access and an S3 File Manager, but they use different storage architectures and offer different quota and billing capabilities.

Platform	Architecture	Quota options	S3 File Manager	Billing functions	Recommended use
euroNAS Premium	Single-server Storage OS	Bucket-count quota	Included	Not included	Standalone or internal S3 services with straightforward requirements
euroNAS HA Cluster	High-availability storage pair	Bucket-count quota	Included	Not included	Internal S3 services that require storage high availability
eEKAS	Ceph-based distributed scale-out cluster	Storage-capacity and bucket-count quotas	Included	Usage collection and billing export	Scale-out enterprise S3 and customer-facing MSP or cloud-provider services

All three platforms include an S3 File Manager. Premium and HA Cluster can restrict the number of buckets, but do not assign a storage-capacity quota or provide billing functions. eEKAS supports both quota types as well as usage collection and billing export.

Recommendation for MSPs and cloud providers: use eEKAS. The customer billing workflow, usage reporting and customisable end-user S3 File Manager described on the MSP page belong to the eEKAS service model. Premium and HA Cluster remain valid S3 options for simpler internal requirements, but are not the recommended foundation for a commercial multi-customer S3 service.

Implementation example

eEKAS combines Ceph object storage with an operational service layer

eEKAS is used here as a practical example because euroNAS is the platform we know in depth. The underlying concepts—S3 endpoints, buckets, keys, policies, versioning and retention—remain applicable to other enterprise object-storage designs. The platform adds graphical provisioning, service monitoring and load-balanced access to a distributed Ceph storage cluster.

eEKAS product details Scale-out Ceph architecture

S3 service consoleUsers, buckets, keys, quotas and policies

Integrated S3 browserHuman access without command-line tools

Protection controlsVersioning, WORM and lifecycle settings

Service resilienceLoad-balanced endpoints and multi-site options

Object controls in action

Version history and bucket governance

These views show how users can recover an earlier object version and inspect the protection and lifecycle state of a bucket.

Object version historyInspect, download or restore an earlier object version.

S3 bucket properties and lifecycle controls

Bucket propertiesReview versioning, WORM, quota, public access and lifecycle state.

A different audience, a separate page

Planning to offer S3 as a managed service?

The forthcoming MSP page will focus on customer separation, usage collection, billing exports and a customisable, branded end-user S3 File Manager.

Explore S3 for MSPs →

Define the S3 service before selecting capacity

Retention, object size, access pattern, growth, site topology and recovery expectations determine the right architecture.

Discuss your architecture

Technical concepts are based on the S3 access model and distributed Ceph object storage. Product capabilities and supported configurations depend on the current euroNAS release and qualified architecture. S3 compatibility does not imply an affiliation with Amazon Web Services.