Object Storage

Overview

Cosmoner object storage provides S3-compatible buckets backed by AWS S3. Each bucket runs on a prepaid tier that includes storage, egress, and request allowances. Usage is monitored continuously — if you exceed your tier's limits, the bucket is suspended until you upgrade.

Tiers

All tiers use the same underlying AWS S3 infrastructure. The difference is in the included allowances.

Choosing a Tier

Consider all three dimensions — storage, egress, and requests — when selecting a tier. A small dataset with high read traffic may need a higher tier than a large archive that is rarely accessed.

• Starter — Development, prototyping, or low-traffic assets (marketing sites, small apps).
• Growth — Production workloads with moderate traffic. Good for most SaaS applications.
• Scale — Media-heavy applications, CDN origins, or services with significant egress.
• Enterprise — Large-scale production workloads, data lakes, or high-throughput APIs.

If you're unsure, start with Starter or Growth and upgrade later. Upgrades are instant and prorated to your billing cycle.

Usage Monitoring

Cosmoner tracks storage, egress, and request usage per bucket via CloudWatch metrics. Usage is checked periodically and compared against your tier's allowances.

Warning Threshold (80%)

When any dimension reaches 80% of your tier limit, you receive an in-app notification and email alert. No action is taken on the bucket — this is an early warning to consider upgrading.

Suspension Threshold (110%)

If any dimension exceeds 110% of your tier limit, the bucket is suspended. A 10% grace buffer above the tier limit gives you time to react before suspension occurs.

While suspended:

• Read and write operations on the bucket are blocked.
• Existing data is preserved — nothing is deleted.
• The bucket remains visible in your dashboard.

To resume, upgrade to a higher tier. The bucket is reactivated immediately after the upgrade.

Upgrading

Upgrade a bucket's tier from the bucket overview page or via the API:

PATCH /v1/projects/:projectId/storage/object-storage/:bucketId/tier

{
  "tier": "GROWTH"
}

Tier changes are:

• Instant — the new allowances apply immediately.
• Prorated — billing is adjusted for the remaining billing period.

If the bucket was suspended, upgrading reactivates it automatically.

Downgrading

You can downgrade to a lower tier if your current usage fits within the target tier's limits. If any dimension (storage, egress, or requests) exceeds the lower tier's allowance, the downgrade is blocked — reduce usage or wait for the next billing cycle before retrying.

Creating a Bucket

POST /v1/projects/:projectId/storage/object-storage

{
  "name": "my-bucket",
  "provider": "AWS_S3",
  "region": "eu-north-1",
  "tier": "STARTER"
}

Bucket names are globally unique, 3–33 characters, lowercase letters, numbers, and hyphens only.

If your project does not have an active subscription, the API returns a Stripe Checkout URL to complete payment. Once payment is confirmed, the bucket is provisioned automatically.

Regions

Buckets can be created in any of the following AWS regions:

Choose a region close to your application servers to minimize latency and egress costs.

Public Access & CDN

By default, buckets are private — objects can only be accessed with signed credentials. Set publicAccess: true when creating a bucket to serve its objects over a public, unauthenticated HTTPS URL, shown as the Public URL on the bucket overview page.

If you serve public assets to end users (images, downloads, static site assets, and similar), you can additionally enable a global CDN in front of the bucket. The CDN caches objects at edge locations worldwide for lower latency and faster delivery, and is shown as the CDN URL on the bucket overview page once provisioned.

The CDN is an opt-in add-on:

• It requires publicAccess: true — it cannot be enabled on a private bucket.
• CloudFront delivery is metered at $0.12/GB and $0.015 per 10K requests, billed as extra line items on the bucket's subscription.
• It can be toggled on or off at any time, either from the bucket overview page or via the API:

PATCH /v1/projects/:projectId/storage/object-storage/:bucketId/cdn

{
  "cdnEnabled": true
}

Disabling the CDN removes the added cost; the bucket remains reachable via its regular Public URL as long as publicAccess is still enabled.

CORS

If your bucket is accessed directly from a browser (for example, uploading files from a web app or serving public assets to a single-page application), you need Cross-Origin Resource Sharing (CORS) rules so the browser allows those cross-origin requests.

You can define CORS rules when creating a bucket, and edit them at any time from the bucket's settings. Each rule specifies:

• Allowed origins — the web origins permitted to make requests (e.g. https://example.com), or * for any origin.
• Allowed methods — one or more of GET, PUT, POST, DELETE, HEAD.
• Allowed headers (optional) — request headers the browser may send (use * to allow all).
• Expose headers (optional) — response headers the browser is allowed to read (e.g. ETag).
• Max age (optional) — how long, in seconds, the browser may cache the preflight response.

To update CORS on an existing bucket:

PATCH /v1/projects/:projectId/storage/object-storage/:bucketId/cors

{
  "corsRules": [
    {
      "allowedOrigins": ["https://example.com"],
      "allowedMethods": ["GET", "PUT"],
      "allowedHeaders": ["*"],
      "maxAgeSeconds": 3600
    }
  ]
}

The request replaces the entire CORS configuration — send the complete rule set each time. An empty array removes all CORS rules.

Deleting a Bucket

DELETE /v1/projects/:projectId/storage/object-storage/:bucketId

Deleting a bucket is irreversible. All objects stored in it are permanently removed and the associated subscription item is cancelled.