---
name: devsecops-devsecops-cos-configure
title: Configuring IBM Cloud Object Storage for storing evidence
description: Complete these steps to create an IBM Cloud Object Storage instance and IBM Cloud Object Storage bucket to store evidence that is used by the IBM Cloud DevSecOps pipelines.
last-updated: 2025-03-11
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/devsecops?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Configuring IBM Cloud Object Storage for storing evidence
{: #cd-devsecops-cos-config}

Complete these steps to create an IBM Cloud Object Storage instance and IBM Cloud Object Storage bucket to store evidence that is used by the IBM Cloud DevSecOps pipelines.
{: shortdesc}

## Create a Cloud Object Storage instance
{: #cd-devsecops-cos-instance-create}

Create an [IBM Cloud Object Storage instance](https://cloud.ibm.com/objectstorage/create){: external}.

## Create a Cloud Object Storage bucket
{: #cd-devsecops-cos-bucket-create}

In Cloud Object Storage, files are grouped in buckets. You might think of buckets like directories, except that no subdirectories are in buckets.

1. In Cloud Object Storage, click **Buckets**.
2. Click **Create bucket**.
3. Choose the **Customize your bucket** option.
4. Give the bucket a unique, memorable name to help you remember what the bucket is for. Over time, you might create many buckets.
5. Set Resiliency to **Regional**. Regional resiliency has the best performance with the lowest cost. However, if the ability to survive a regional outage is essential, set the resiliency to "Cross Region."
6. For best performance, set **Location** to the same location as your toolchain location.
7. Usually, the default for Storage class is suitable for use, so you don't need to use **ADVANCED CONFIGURATION**.

## Create a service credential
{: #cd-devsecops-cos-service-credential}

1. In Cloud Object Storage, click **Service Credential**.
2. Click **New Credential**.
3. Select **Include HMAC Credential** to include HMAC keys in the credential.
3. Provide the details:
   *  **Name:** Name of the credential.
   *  **Role:** Role for the credential. The **Object writer** and **Reader** role is suggested for handling evidence.

## Provide bucket access to the service credential
{: #cd-devsecops-cos-bucket-access}

1. In Cloud Object Storage, click **Buckets**.
2. Select the bucket that was created in the previous step.
3. Click **Access policies**, and select the **Service IDs** option
4. Select the service credential that was created in the previous step, and select the **Object writer** and **Reader** role.
5. Click **Create Access Policy**.

## Copy the API Key of the service credential
{: #cd-devsecops-cos-apikey-copy}

1. In Cloud Object Storage, click **Service Credential**.
2. Click **expand** the service credential to view the **apikey**. 
3. Note the *apikey* because you need it later when setting up your DevSecOps pipelines.

## Related information
{: #cd-devsecops-cos-related-content}

* [IBM Cloud Object Storage buckets as evidence locker](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-cos-bucket-evidence&format=markdown)
* [IBM Cloud Object Storage configure buckets as evidence locker](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-cos-bucket-evidence&format=markdown#cd-devsecops-cos-bucket-configuration)
* [IBM Cloud Object Storage evidence](https://cloud.ibm.com/docs/devsecops?topic=devsecops-devsecops-evidence&format=markdown#devsecops-v2-evidence-lockers)