> ## Documentation Index
> Fetch the complete documentation index at: https://docs.casebender.com/llms.txt
> Use this file to discover all available pages before exploring further.

# S3-Compatible Storage Certification

> Qualification policy for non-AWS products using the CaseBender S3 adapter

An S3-compatible API is not automatically equivalent to AWS S3 and is not
automatically supported. Certify each product, exact version, endpoint mode,
bucket policy, and CaseBender release independently.

## Required contract

The release matrix is authoritative. A candidate commonly needs:

* verified HTTPS, including the deployed private CA path;
* access to an existing bucket without bucket-administration permission;
* upload, HEAD/metadata, download, SHA-256 integrity, copy, pagination,
  conditional create, versioning, delete, and delete-marker behavior;
* server-side encryption;
* retention and legal hold when required for the `records` profile; and
* cleanup limited to a unique test prefix and exact versions.

Do not infer capability from an advertised S3 API level. Conditional writes,
checksum headers, version IDs, copy semantics, delete markers, Object Lock, and
private-CA behavior differ among products and versions.

## Qualification procedure

1. Record the product name and exact server version, CaseBender revision/image
   digests, endpoint mode, CA digest, bucket policy, and identity policy.
2. Use pre-created dedicated test buckets or a dedicated prefix.
3. Run from the same network, DNS, proxy, CA, and identity context as the web
   and worker.
4. Set each capability flag truthfully. `false` means skipped and cannot satisfy
   a required matrix operation.
5. Run the application upload/quarantine/scan/promote/download/delete lifecycle.
6. Exercise backup, restore, migration, rollback, retention, and legal-hold
   workflows required by the customer.
7. Sanitize, hash, review, and sign the evidence bundle.

For Ceph RGW:

```bash theme={null}
STORAGE_TEST_ENDPOINT='https://<s3-compatible-host>' \
STORAGE_TEST_BUCKET='<dedicated-test-bucket>' \
AWS_REGION='<region>' \
STORAGE_TEST_CA_BUNDLE='<ca-file>' \
STORAGE_TEST_ODF_VERSION='<exact-odf-version-or-n-a>' \
STORAGE_TEST_CEPH_VERSION='<exact-product-version>' \
STORAGE_TEST_CAP_METADATA=true \
STORAGE_TEST_CAP_PAGINATION=true \
STORAGE_TEST_CAP_COPY=true \
STORAGE_TEST_CAP_CONDITIONAL_CREATE='<true-or-false>' \
STORAGE_TEST_CAP_VERSIONING='<true-or-false>' \
STORAGE_TEST_CAP_DELETE_MARKERS='<true-or-false>' \
STORAGE_TEST_CAP_ENCRYPTION=true \
STORAGE_TEST_CAP_OBJECT_LOCK='<true-or-false>' \
./scripts/storage/validate-ceph-rgw.sh
```

The general smoke contract is:

```bash theme={null}
STORAGE_TEST_PROVIDER=s3 \
STORAGE_TEST_ENDPOINT='https://<s3-compatible-host>' \
STORAGE_TEST_BUCKET='<dedicated-test-bucket>' \
AWS_REGION='<region>' \
./scripts/storage/validate-storage.sh
```

The general script is supplementary and does not cover the complete
exact-version release gate.

## Evidence rules

Use `scripts/storage/certification-evidence.template.json` and validate with:

```bash theme={null}
node scripts/storage/validate-certification-matrix.mjs \
  --release \
  --evidence '<sanitized-evidence.json>'
```

Evidence must name an exact target version and include a digest. It must not
contain access keys, session tokens, connection strings, private keys, signed
URLs, customer object names, or object contents.

## Emulator limitation

`./scripts/storage/run-emulator-contracts.sh s3` checks the S3 adapter against
LocalStack. It creates an emulator artifact that explicitly says it is not live
certification. Never reuse that result for Ceph RGW, MinIO, AWS S3, or another
S3-compatible product.

## Change control

Requalify after any server upgrade, gateway/configuration change, TLS/CA
rotation, identity/policy change, versioning/Object Lock change, network/proxy
change, CaseBender release, or storage SDK update.

See [Provider Selection and Certification](/en/deployment/storage-provider-selection)
and [OpenShift ODF and Ceph RGW](/en/deployment/storage-openshift-odf-rgw).