--- title: "Frazer Storage: S3 object storage next to your servers · Frazer" description: "S3 buckets in every Frazer region, reached by your workloads with their own identity and no stored key. Versioning, Object Lock and lifecycle rules, three copies on three servers and a nightly off-site copy." url: https://frazer.ai/storage index: https://frazer.ai/llms.txt tokens: 1884 --- > For agents: every page on frazer.ai is indexed at https://frazer.ai/llms.txt. # Frazer Storage: S3 object storage next to your servers · Frazer **Frazer Storage** frazer.ai # Object storage next to your servers. No keys in your code. S3 buckets in every Frazer region, on servers Frazer runs. Your clusters and services reach them with their own identity, so no access key sits in code, Git or an image. Versioning, Object Lock and lifecycle rules come with every bucket. [Create a bucket](https://frazer.ai/start?product=storage) [Read the docs](https://frazer.ai/docs) ``` # frazer serverless stacks create notes --from frazer.stack.yaml --dry-run apiVersion: frazer.ai/v1 kind: Stack name: notes services: notes-api: source: {repo: acme/notes, branch: main} bind: {S3_BUCKET: bucket/notes-uploads} buckets: notes-uploads: {versioning: true} ``` ``` # S3_BUCKET, AWS_ENDPOINT_URL_S3, AWS_REGION # come from the binding. Credentials are short-lived and # come from the service's own identity: no access key. import os import boto3 s3 = boto3.client("s3") s3.upload_file("note.md", os.environ["S3_BUCKET"], "notes/note.md") ``` A bucket bound to a service, and the code that uses it demo organization 01 · How it works Fig. 1 ## Your workload is the credential. STS trades its identity for short-lived keys. **Fig. 1** From a workload to three copies, with no stored key 02 · Keep what you store Fig. 2 ## Keep every version. Lock what must stay. Each bucket shows its size, versioning, lock, lifecycle rules, the identity that may reach it and its off-site copy. A lock in compliance mode changes only through an approved plan. *The Buckets page of the demo project acme-production in us-virginia1: 4 buckets, 2.2 TB in all, each with versioning on, its lock or retention, lifecycle rules, the identity that may reach it and its off-site copy. Below, the lifecycle of acme-production-db-backups: delete noncurrent versions 30 days after they are replaced; abort incomplete multipart uploads after 7 days; object lock, compliance mode, 30 days on every new object.* **Fig. 2** The Buckets page of a project, with one bucket's rules product UI, demo organization - ### Versioning An overwrite or a delete keeps the previous version until a lifecycle rule removes it. - ### Object Lock Governance or compliance mode. A locked object cannot be deleted before its date, by anyone. - ### Lifecycle rules Expire old versions and abort stale uploads on a schedule; each expiry shows in the console. 03 · Designed for load ## Built for load from the first second. And the test that checks each line. The object store is designed to take full load on a new bucket from its first second, with no warm-up. Each line names what it is designed to handle and how we test it. What Frazer Storage is designed to handle, and the test for each | What | Designed to handle | Tested with | | --- | --- | --- | | Requests on a new bucket | ≥ 2,000 PUT/s and ≥ 10,000 GET/s from the first second | warp, mixed, 64 KiB objects | | Time to first byte on GET | p50 ≤ 10 ms, p99 ≤ 50 ms | warp, 64 KiB objects | | Throughput | ≥ 2 GiB/s on three servers | warp, 32 MiB objects | | Listing a large bucket | 1,000 keys listed in ≤ 100 ms at p99 | 50 million objects in one bucket | | A server lost under load | < 0.1 % errors; healthy within an hour of rejoining | a server killed during warp | What we do not claim: eleven nines, durability across zones, or the aggregate throughput of the largest clouds. 04 · What you get ## An S3 bucket, run for you. With the parts that keep data safe. - ### The S3 API Any S3 SDK or tool, at `s3.us-virginia1.frazer.run`, over IPv4 and IPv6. - ### No static keys Workloads assume a role with their cluster or service identity, through STS. - ### Versioning and Object Lock Every version kept until a rule removes it; locks in governance or compliance mode. - ### Lifecycle rules Expire noncurrent versions and abort stale multipart uploads. - ### Notifications Persistent bucket notifications, delivered through Frazer events. - ### Quotas and metering Quotas that answer `403 QuotaExceeded`; byte-hours metered every 60 seconds. - ### Import Copy in from S3-compatible storage or Google Cloud Storage with a read-only connection. 05 · Controls ## Who reaches a bucket. And what happens at the limit. ### Who may do what Project roles Map to bucket roles in the project's own bucket account. Workloads Reach the buckets they are bound to with their own identity, through STS. No key to copy. Compliance locks Changing a compliance-mode lock needs an approved plan. ### What is logged - Every bucket, rule and lock change is a plan with an audit entry. - Each lifecycle expiry shows in the console. - Usage as byte-hours every 60 seconds, reconciled when the interval closes. ### At the cap - At a budget cap, buckets **keep serving**. - Writes are blocked only after 30 days past due; deleting needs a separate 30-day notice. - Past a quota, writes return `403 QuotaExceeded`. 06 · Pricing ## One rate per GiB-month. No egress fees within fair use. Frazer Storage bills by the GiB-month stored, metered as byte-hours every minute. The backups Frazer keeps for your databases and VMs come out of an allowance for every server you bring. [See every price](https://frazer.ai/pricing#lines) Storage $0.012 / GiB-month for objects, volumes of every class and backups Allowance Your disks · 100 GB backups per server included, pooled across the account Requests in a site $0 Egress No egress fees within fair use Questions ## Frazer Storage, answered. Which tools work with Frazer Storage? Clients that speak the S3 API: SDKs, command-line tools and backup tools. The region's endpoint is `s3.us-virginia1.frazer.run`, and it answers over IPv4 and IPv6. How does my code get credentials without a key? Your cluster or serverless service presents its own identity token from Frazer's OIDC issuer, and STS returns short-lived keys for the buckets it may use. A serverless binding also writes `S3_BUCKET`, `AWS_ENDPOINT_URL_S3` and `AWS_REGION`. There is nothing to rotate. How durable is a bucket? What we state is what we run: three copies on three servers in the region, and a nightly copy at a second provider. We do not claim eleven nines. Do buckets run on my servers? No. Buckets run on servers Frazer operates in each Frazer region, and Frazer runs the storage engine: upgrades, disks and recovery, with your objects replicated across the site's servers. Egress to your clusters in the same region is free. What happens to my buckets at a budget cap? They keep serving. Writes are blocked only after an invoice is 30 days past due, and deleting data needs a separate 30-day notice. Can I bring data from another provider? Yes. Connect S3-compatible storage or Google Cloud Storage read-only, with OIDC federation where the provider offers it, and copy the objects into Frazer Storage. ## More in Data - [**Databases** Postgres with PITR](https://frazer.ai/databases) - [**In-memory store** Pick the engine and version](https://frazer.ai/memory) - [**Secrets** Write-only for people](https://frazer.ai/secrets) - [**Volumes and snapshots** NVMe or replicated](https://frazer.ai/volumes) ## Create a bucket. Reach it with no key. [Create a bucket](https://frazer.ai/start?product=storage) [Read the docs](https://frazer.ai/docs)