Wasabi

Wasabi has flat per-terabyte pricing with no egress fees, as long as your monthly downloads stay within your stored volume. On pay-as-you-go, files are billed for at least 90 days even if you delete them sooner (30 days on Reserved Capacity), so it fits archives better than short-lived drop folders.

Before you start

• A Wasabi account, signed in as the root user or a user that can manage users and policies.
• The region you want, for example eu-central-1 (Amsterdam) or eu-central-2 (Frankfurt).

1. Create the bucket

1. In the Wasabi console, go to Buckets and create a bucket.
2. Pick the region. It becomes part of the endpoint and can’t be changed later.
3. Leave versioning and object locking off. Versioning keeps deleted files around (and billed), and object locking stops SFTP users from deleting files.

2. Create an access key

Create a policy for the bucket, then a sub-user with that policy and programmatic access.

1. Go to Policies → Create Policy, name it cloudfile-my-bucket, and paste this policy (replace my-bucket):

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::my-bucket"
    },
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:AbortMultipartUpload"],
      "Resource": "arn:aws:s3:::my-bucket/*"
    }
  ]
}

2. Go to Users → Create User, name it cloudfile, and choose Programmatic access only.
3. Attach the cloudfile-my-bucket policy to the user, either in the user wizard or afterwards in the user’s Policies settings.
4. Finish the wizard and copy the access key and secret key. If you missed them, go to Access Keys → Create Access Key and create one for the sub-user.

Wasabi’s own examples also allow s3:ListAllMyBuckets. That’s only needed if the sub-user signs in to the console; CloudFile doesn’t need it.

3. Connect it

In CloudFile, go to Storage → Add bucket and choose Wasabi:

Click Test connection, then Save. To use the bucket, open a server and pick it under Settings → Storage.

Troubleshooting

• Writing a test file failed with a redirect or region error. The region doesn’t match the bucket. The bucket list in the Wasabi console shows each bucket’s region.
• Writing a test file failed: Access Denied. The policy isn’t attached to the user, or names a different bucket. Check the user’s Policies settings.
• Writing a test file failed with an invalid access key error. The key was mistyped or deleted. Check the sub-user’s keys under Access Keys.
• Listing the bucket failed: Access Denied. s3:ListBucket must point at arn:aws:s3:::my-bucket, without /*.
• Deleting the test file failed. Object locking or a retention period is on for the bucket.

See Your own bucket for how files are laid out in the bucket.