Troubleshoot Object Storage

Find the symptom or the message you see, then follow the fix. Messages appear here exactly as the dashboard, the API or your S3 client shows them, and each fix links to the page that covers the task in full.

Cause

A new key takes up to a couple of minutes to reach storage in every region. Until then, storage refuses requests signed with it, usually with InvalidAccessKeyId.

Fix

Wait a couple of minutes and try again. If the key is still refused, check that the client has the whole access key ID, which starts with AKIA and is 24 characters long. Check too that the client sends requests to our endpoint: a client with no endpoint sends them to Amazon, which does not know the key. With the AWS CLI, add --debug to a command and look for s3.fra.coritan.com:7337 in the request URL (Connect an S3 client).

Cause

Storage answers InvalidAccessKeyId when it no longer accepts a key. That happens when you revoke the key, when the key's service is suspended or has ended, and when the key was limited to a bucket that you deleted. Each of these turns the key off within a couple of minutes. Temporary credentials are refused the same way once they expire, or when the request leaves out the session token.

Fix

Open the service's Access keys tab. A revoked key is no longer in the list, and a key that is turned off shows Inactive. For a suspended service, pay the overdue invoice (Failed payments and suspended services), and its keys work again within a couple of minutes of the service becoming active. In the other cases, create a new key and give it to the client. For temporary credentials, create new ones (Create temporary credentials).

Cause

Storage answers SignatureDoesNotMatch when the signature it computes differs from the one the client sent. The secret key is wrong, or only part of it was copied. The same error appears when the client sends the request to an address other than the endpoint, such as an IP address, or through a proxy that changes the Host header. Storage checks the signature against the endpoint's host and port.

Fix

Paste the secret key again from where you saved it, with no space or line break around it. Use the endpoint exactly as the dashboard gives it, such as https://s3.fra.coritan.com:7337, and send requests to it directly. If you lost the secret key, create a new key, because we cannot show a secret key again.

Cause

Storage answers AccessDenied when the key's permissions or scope do not cover the request. A read-only key cannot upload or delete, a key limited to one bucket cannot reach another, and no key can create or delete a bucket. That is why storage refuses aws s3 mb and aws s3 rb, and rclone when it tries to create the bucket before an upload. Storage also refuses a request with no signature, such as a bucket's address opened in a web browser.

Fix

Check the key's Scope and Permissions on the Access keys tab. To upload or delete, use a key with Read and write. For another bucket, use a key limited to that bucket, or one whose scope is All buckets. Create and delete buckets on the Buckets tab (Create and delete buckets). With rclone, set no_check_bucket = true in the remote (rclone). To share an object with someone who has no key, send a presigned URL. To let anyone read a bucket without a key, turn on its public URL (Serve a bucket publicly).

Cause

Storage answers 403 AccessDenied with Change this setting in the dashboard or the Object Storage API. when a request signed with an access key tries to change a bucket or object setting, such as versioning, CORS, lifecycle rules, retention or a legal hold. No key can change them.

Fix

Change the setting on the bucket's page in the dashboard, or through the API (Bucket settings). Reading a setting works with any key whose scope covers the bucket, except encryption, which no key can read.

Cause

Storage answers NoSuchBucket when the endpoint has no bucket with that name. The bucket lives in another region, the name lacks your prefix, or the bucket was deleted.

Fix

On the Buckets tab, find the bucket's full name and its Region. Send requests to that region's endpoint, which the Endpoints card on the Overview tab lists, and use the full name, such as u7-assets. A bucket that none of your services lists was deleted, together with its objects.

Cause

The client uses virtual-hosted style, which puts the bucket name in the host, such as u7-assets.s3.fra.coritan.com. A region answers those hosts only where the dashboard offers them. A certificate error for the endpoint's own host, such as s3.fra.coritan.com, means the endpoint has no port while the Endpoints card shows one, so the client connects to port 443, which does not serve that region.

Fix

Turn on path style, as each setup in Connect an S3 client does, and give the endpoint exactly as the Endpoints card shows it, :7337 included when it has one.

Cause

Something between your client and us blocks outgoing connections to the endpoint's port, such as a firewall, a proxy or a VPN. Port 7337 answers in every region, and port 443 only where the Endpoints card shows an endpoint with no port.

Fix

Run curl -I https://s3.fra.coritan.com:7337 on the same machine. Any HTTP status in the answer, even 403, means your network reaches us, so check the endpoint in the client. No answer means the port is blocked: allow outgoing HTTPS on TCP port 7337, or ask whoever runs the network to allow it. Where the card shows an endpoint with no port, try that endpoint.

Cause

The signature names the endpoint with a port that the request did not use: a request signed for s3.fra.coritan.com:7337 and sent to port 443, or the other way round. A presigned URL works at the address it was made for.

Fix

Give the client the endpoint you connect to, exactly as the Endpoints card shows it, and create the presigned URL again after the endpoint changes.

Cause

The client sends plain HTTP. Port 7337 accepts HTTPS only, and it answers a plain HTTP request with 400 Bad Request.

Fix

Start the endpoint with https://. In s3cmd, set use_https = True in ~/.s3cfg, or pass --ssl.

Cause

Storage answers 403 for a link that has expired. A link from the API lasts 15 minutes unless you asked for longer, and 1 hour at most. A link that an S3 client signed with your key also stops working when you revoke the key. Each link works only with the method it was signed for, and an upload link signed with a content type needs the same Content-Type header on the upload.

Fix

Create a new link (Share a file with a presigned URL). Send the request with the method the API returned and every header in headers. For a file that someone needs for longer, send a new link each time, or give them a read-only key limited to the bucket.

Cause

The object's key is wrong, the bucket is not a website and the address names no key, or the public URL is off. A suspended service, or a bucket our staff turned off, answers 404 too.

Fix

Check the key, including its case and any folder in front of it. Serve a bucket publicly lists each case.

Cause

The domain's TXT or CNAME record is missing or wrong. The domain's row says which.

Fix

Publish the records the row shows where the domain's DNS is hosted, then select Check domain on the domain's row (Serve a bucket on your own domain).

Cause

We keep a copy of each object of 10 MB or less for up to an hour, or for as long as the object's Cache-Control allows, up to a day.

Fix

Purge the cache on the bucket's Public access tab (The cache).

Cause

The name breaks a naming rule, or your account already uses it. The message under Name says which rule, such as Dots and hyphens cannot be next to each other. The message A bucket named u7-assets already exists means one of your services has a bucket with that name. u7-assets was deleted recently and is still being removed. Pick another name, or wait for the removal to finish. means you deleted a bucket with that name in the last 7 days.

Fix

Change the name to follow Bucket names, or choose another one. The name of a deleted bucket is free again 7 days after the delete.

Cause

The service holds 25 buckets, the most one service may hold. Create bucket… is greyed out, the Create a bucket page says This service is at its bucket limit, and the API answers 409 with This service already has 25 buckets, which is the most one service may hold.

Fix

Delete a bucket you no longer need (Delete a bucket). It stops counting as soon as you delete it. You can also order another service, which holds up to 25 buckets of its own.

Cause

No region can take a bucket at the moment, or the region you chose has stopped taking them. The order page says No region offers Object Storage right now, and the create bucket page says No region is available right now. Creating a bucket in a region that has stopped taking them fails with That region does not offer object storage. An order for such a region fails during setup with the same message, and the service's status becomes failed.

Fix

Choose another region if the list offers one. Otherwise, try again later. For a service whose status is failed, contact support with its service ID.

Cause

The bucket holds objects that the last hourly measurement did not count, so the dialog offered no box to destroy them. We refuse the delete with u7-assets is not empty. Delete it with force to destroy its contents as well.

Fix

Wait for the next measurement and delete the bucket again with the box ticked. You can also delete the objects first (Delete objects and folders), or delete the bucket through the API with force=true (Delete a bucket through the API).

Cause

On a bucket that keeps versions, older versions and delete markers count as contents, even when no current object is left. We refuse the delete with u7-assets still holds object versions. Delete it with force to destroy every version as well. On a bucket with Object Lock, we refuse while any version is under retention or has a legal hold, with a message such as u7-backups holds 3 locked versions, so it cannot be deleted yet.

Fix

For versions, tick Destroy any older versions and delete markers in it in the dialog, or add force=true through the API. For locked versions, wait for the last retention to end and take off every legal hold first (Delete a bucket with Object Lock).

Cause

The service is not active. The banner above the tabs says why: Waiting for payment, Setting up or Suspended. Until the service is active, the dashboard hides Create bucket…, Delete bucket…, Create key…, Upload… and New folder…. You can still browse buckets, download objects and revoke keys.

Fix

For Waiting for payment, select Open invoices and pay the first invoice. Setting up takes under a minute, so reload the page. For Suspended, pay the overdue invoice (Failed payments and suspended services).

Cause

Your browser sends each upload straight to the region's endpoint. The message after Could not upload and the file's name says what went wrong. Could not reach the storage endpoint means your browser could not connect, usually because a firewall, proxy or VPN blocks the port. The upload link expired or was refused means storage answered 403. Upload failed with a number means storage answered with that HTTP status.

Fix

For Could not reach the storage endpoint, try another network, or ask whoever runs yours to allow outgoing HTTPS on the port of the region's endpoint, 7337 unless the endpoint has no port. For the other two, reload the page and upload the file again. Send a large file with an S3 client, which uploads it in parts (Connect an S3 client).

Cause

A page on your website sent a request to the bucket, and no CORS rule matched the page's origin, the method or a header the page sent. Once a bucket has CORS rules, browsers block what they do not allow. A public URL or custom domain answers no other website until the bucket has a rule that allows it.

Fix

Add or correct a rule on the CORS card of the bucket's Settings tab. List the page's exact origin, scheme and port included (How the bucket answers browsers).

Cause

Lifecycle rules run once a day, so an object can stay up to a day past its time. A run checks at most 100,000 objects in a bucket and the next run carries on, so in a large bucket objects can stay longer. Until it goes, an object is listed, readable and billed.

Fix

Wait for the next run, and read Recent runs on the bucket's Lifecycle tab. Check that the rule is not Off and that its prefix and tags match the object exactly (How rules run).

Cause

The folder has an empty folder object, whose key ends in /. New folder… writes one, and so do some S3 clients.

Fix

Delete the folder itself with Delete folder… in its menu, or tick it and delete it (Delete objects and folders).

Cause

We measure each bucket once an hour. The object count and size on the Buckets tab, in the object browser's header and on the Overview tab come from the last measurement.

Fix

Wait for the next measurement. The Measured column on the Buckets tab says when we last measured each bucket. The list of objects comes straight from storage, and the refresh button beside the bucket's name lists the folder again.

Cause

No measurements yet means we have not measured any of the service's buckets in the window you chose. A new service or bucket waits up to an hour for its first measurement, and a service with no buckets has nothing to measure.

Fix

Create a bucket if the service has none, and look again after the next hourly measurement.

Cause

Requests cost money as well as storage, once the month's free amounts run out. Some tools make more requests than their work suggests. A sync with rclone sync or aws s3 sync lists the bucket each time it runs, and each page of up to 1,000 objects in the list is a Class A operation. A large file sent in parts makes a Class A operation for each part. Uploads and downloads in the dashboard count too. The free amounts are your account's, so every pay as you go service on it draws on the same ones (Which requests count).

Fix

On the service's Overview tab, the Requests chart shows the days with the most operations, and the This month card shows which meter grew. Download the month's use from the Billing tab to see which bucket made them (Download a month's usage). Run sync jobs less often or on a narrower prefix, and delete objects you no longer need. To hear about it sooner next time, set a budget.

Cause

The bucket keeps versions. A delete adds a delete marker, and the data stays as an older version, which counts as stored data until you delete it for good. The Size column on the Buckets tab counts every version.

Fix

Turn on Show versions in the object list and delete the versions you no longer need, or add a lifecycle rule with Delete old versions (Versions and your bill).

Cause

We rate each hour's use two to three hours after the hour ends. Estimated so far, the This month card and the table on the Billing tab count only the hours we have rated. Through the API, rated_through is the end of the last rated hour.

Fix

Nothing is wrong. Look again later: we add each hour as we rate it, and the invoice counts every rated hour (The month so far).

Cause

This month's charges on the service reached 50%, 80% or 100% of its budget. We email the account's owner and its team members with the Billing or Admin role, once a month for each of those. We check every hour, so when the charges passed more than one of them within an hour, only the alert for the highest comes. The service goes on working, and we bill what it uses.

Fix

Open the service's Overview tab to see which meter grew, and the Requests chart to see when. Delete what you no longer need, or make fewer requests, as This month costs more than you expected describes. To change when the alerts come, save a new amount under Budget on the Billing tab, or select Remove budget to stop them (Set a budget). A new amount starts its alerts over, so charges already past 50% of it send an alert at the next hourly check (Budgets).

Cause

A pay as you go service's renewal invoice has a line for each meter it billed, such as Object Storage Class A operations: u7 photos, 2.3456 million operations, 8 Oct to 7 Nov 2026. The line names the meter and the service, then the quantity billed after the free amounts, then the dates the use falls in. The service itself costs $0, so its renewal shows no other charge for it.

Fix

Download the use for each calendar month the dates cover, and add up the column for that meter: gb_months, class_a or class_b. Take away each month's free amounts to reach the billed quantity, then multiply by the rate on the service's Billing tab (When you are billed). The free amounts follow calendar months and the invoice follows the renewal date, so one invoice can cover the end of one month and the start of the next.

Cause

Object Storage is pay as you go, and your account plan's free storage applies to every service you order. The dashboard no longer creates a separate free service.

Fix

Order Object Storage, which costs nothing (Order Object Storage). A service the dashboard created from your plan before goes on working, billed the same way (Storage from your account plan).

Cause

The add-on is no longer sold, and one you already have renews at its price. It adds 250 GB-month to your free storage each month.

Fix

To pay only for what you use, remove it (Remove an add-on). 250 GB-month at the storage rate costs less than the add-on (The storage add-on).

Cause

We do not record when a key is used. The Last used column on the Access keys tab always shows Never, and the API always returns last_used_at as null.

Fix

Nothing is wrong with the key. To keep track of where each key is used, give it a label that names the place, such as ci deploy.

Cause

The dashboard and the API show a secret key only once, when you create the key.

Fix

Create a new key, move your applications to it, then revoke the old key (Create and revoke access keys).

Cause

We could not create it, or your account already had a bucket with that name, or had one that you deleted in the last 7 days. When we could not create it, the setup line in the Activity table on the Billing tab ends with The first bucket was not created: and a reason. When the name was taken, the line does not mention the bucket.

Fix

Create the bucket on the Buckets tab, with another name if the name is taken (Create a bucket).

Cause

A rule sends nothing while it is paused, for keys its prefix and suffix leave out, and for changes made before you added it or turned it back on. We pause a rule whose every delivery failed for a day.

Fix

Open the bucket's Notifications tab and read the rule's Status and the Delivery log, where Response shows what your address answered (Retries and pausing).

Cause

The other provider refused the access key ID or the secret, such as with The source did not accept the access key ID. A key with a session token does not work.

Fix

Copy the access key ID and the secret again from the other provider, and check that the key can list and read the bucket. Create a long-lived access key if yours has a session token. Troubleshooting lists every message.

Cause

Your tool sends x-amz-server-side-encryption: AES256 (aws s3 cp --sse AES256 does). We accept it once default encryption is available, and it can answer 500 InternalError until then.

Fix

Remove the setting from the tool and upload again, or wait until the Default encryption card in a bucket's Settings tab reads On or Off (Encrypt the objects in a bucket).

400 An object key is required or Object keys are at most 1024 bytes

The presign request has no key, a key that ends in / with get or delete, or a key longer than 1024 bytes (Presign an object).

400 A version can only be downloaded

The presign request has a version_id with put or delete. Only get takes one.

404 Object storage service not found

The service ID is not an Object Storage service on your account. List your services with GET /api/v1/client/object-storage/services (Object Storage).

404 Bucket not found

The bucket ID is not a bucket of this service, or you deleted the bucket. Take the id from List buckets.

404 Access key not found

The key ID is not a key of this service, or you revoked the key.

409 This service is pending; it can be changed once it is active

The service is not active, and the message names its status. See Buttons to create or change things are missing.

422

A value in the request breaks a rule, and detail says which one, such as Bucket names cannot have a dot next to another dot or a hyphen. Object Storage limits lists every rule.

429 Too many requests for this action. Try again later. from a budget route

Your account set or removed budgets 30 times in the last hour, from the dashboard or the API. Wait the seconds that the Retry-After header gives, then send the request again (Set or remove a budget).

429 with "error": "rate_limited" from a bucket's settings or rules

Your account reached the hourly limit for that kind of change, which Object Storage limits lists. Wait the seconds that the Retry-After header gives, then send the request again.

502 with a message that starts Gateway refused, Could not list, Could not sign the request or Could not delete objects

The region's storage refused or failed the request. Try again in a minute. If it keeps happening, contact support with the whole message.

503 Object storage is not enabled on this platform

Storage in the bucket's region cannot take requests right now. Try again later, and contact support if it lasts.

Errors explains the shape of every error response.

Contact support and include:

• The Service ID from the service's Billing tab.
• The bucket's name and region.
• The access key ID of the key involved. Never send a secret key, to us or to anyone else.
• The endpoint your client uses, and the client's name and version.
• The whole error message, and when it happened.