---
title: Buckets
description: S3 compatible object storage, with its keys written into a secret group.
order: 5
---

A bucket is object storage for the project. It belongs to the project rather than to one
environment, and its connection details land in a production secret group.

## A bucket ops makes

Choose **Add resource**, then **Bucket**. Give it a name and the production secret group
that should receive its details, and create it. Ops makes the bucket and writes six
variables into the group:

| variable | holds |
| --- | --- |
| `S3_ENDPOINT` | the endpoint URL |
| `S3_REGION` | the region |
| `S3_BUCKET` | the bucket's full name |
| `S3_PATH_STYLE` | whether to use path style addresses |
| `S3_ACCESS_KEY_ID` | the access key |
| `S3_SECRET_ACCESS_KEY` | the secret key |

Each name can be changed in the bucket's settings if your code expects another. Render the
group, see [Secrets](secrets.md), and the services that mount it can reach the bucket.

The bucket's full name is made from the project and the name you gave, and bucket names
are global, so a name that is taken is shown on the bucket's page as the reason it waits.

## A bucket you already have

Choose the mode **adopted** and fill in the endpoint, region and bucket name. Ops writes
only the bucket name into the group, and never creates or deletes the bucket itself. The
endpoint, region and path style are yours to give your code, since you chose them. The
keys are yours to mint at your storage provider: **Rotate keys** on the bucket's page
writes them into the group. A key is never shown again once saved.

## Deleting

Ops refuses to delete a bucket it made while it still holds objects. Empty it first. An
adopted bucket is only forgotten, never deleted at the provider.