Browse articles

Object storage

# Bucket settings: public access, CORS, versioning, object lock, tags, lifecycle

Configure a private or public access policy per prefix, CORS rules, versioning, object lock, tags, and automatic lifecycle deletion for your object storage buckets.

3 min readUpdated: October 23, 2026[Baca dalam Bahasa Indonesia](/docs/pengaturan-bucket)

Every bucket has settings equivalent to an S3 console. Open **Object storage**, click the bucket name, and scroll to **Bucket settings**. Each section is saved separately, so you can change one setting without touching the others.

## 1\. Access policy

-   **Private**: only your account's access keys can read and write. This is the default for every bucket.
-   **Public (read-only)**: anyone can download objects via URL; writing still requires an access key.

With **Restrict to prefix (optional)**, only objects under that prefix are public, for example `public`. Empty means the whole bucket. A public object URL follows this pattern:

```bash
https://storage.linuxteknosia.cloud/media-example-co/public/logo.png
```

## 2\. Versioning

Enable **versioning** to keep every version of an object when it is overwritten or deleted, so older versions can be restored. Older versions count toward the bucket quota. On a bucket with object lock, versioning is required and cannot be turned off.

## 3\. Object lock (WORM)

Object lock is only available for buckets created with the object lock option. Set the **Default retention** for new objects:

-   **Governance**: the protection can be bypassed by the owner.
-   **Compliance**: objects cannot be deleted by anyone until the retention period ends.

Enter the number of retention days and save.

## 4\. CORS

Without CORS rules, browsers on other domains cannot access the bucket directly, for example for uploads with presigned URLs.

1.  Click **Add rule**.
2.  Fill in **Allowed origins (one per line)**, for example `https://app.example.com`.
3.  Choose the **Allowed methods**: GET, PUT, POST, DELETE, HEAD.
4.  Enter **Max age (seconds)** and save.

Each rule needs at least one origin and one method. The origin must match exactly, including scheme and port.

## 5\. Tags

Tags help group buckets, for example `env=production` or `team=data`. Click **Add tag**, enter a key and value, and save.

## 6\. Lifecycle (automatic deletion)

Lifecycle rules delete objects automatically after N days, for example logs or temporary files, so the quota stays free without cron jobs.

1.  Enter a **Rule ID**, for example `expire-logs`.
2.  Enter a **Prefix (empty = all)**, for example `logs/`.
3.  Enter **Delete after (days)** with a number above 0, make sure the rule is **enabled**, and save.

## 7\. Check from an S3 client

```bash
aws --endpoint-url https://storage.linuxteknosia.cloud s3api get-bucket-cors --bucket media-example-co
aws --endpoint-url https://storage.linuxteknosia.cloud s3api get-bucket-versioning --bucket media-example-co
curl -I https://storage.linuxteknosia.cloud/media-example-co/public/logo.png
```

The bucket page also shows **Usage examples** and the access keys that can reach the bucket.

## Troubleshooting

-   **"versioning tidak bisa dimatikan pada bucket dengan object lock"**: this is intentional; create a new bucket without object lock if you do not need it.
-   **"object lock hanya bisa diaktifkan saat bucket dibuat"**: create a new bucket with the object lock option and move the data.
-   **"aturan CORS butuh minimal satu origin dan satu method"**: complete the rule.
-   **"aturan lifecycle butuh masa kedaluwarsa (hari) > 0"**: enter a number of days.
-   **The public URL returns 403**: the object is outside the public prefix or the access policy is still private.
-   **The browser shows a CORS error**: check the origin and method, and that the rule has been saved.

## See also

-   [Creating a bucket](/docs/bucket)
-   [Laravel](/docs/laravel), [Node.js](/docs/nodejs)

Still need help?

Open a support ticket from the dashboard and our team will reply as soon as possible.

[Help center](/en/help)[Open a ticket](/app/support/new)