Connecting to IBM Cloud Object Storage

Cloud Object Storage direct endpoints for use with VPC

To send a REST API request, you must set a target endpoint or a URL, and each Cloud Object Storage location must have its own set of URLs. Direct endpoints provide your servers with high-speed, direct connections to IBM Cloud services, which incur no added bandwidth costs. With the Cloud Object Storage direct endpoint, a VPC can connect to a Cloud Object Storage bucket located anywhere in the world.

You don't incur charges for traffic from your VPCs to all Cloud Object Storage endpoints that are listed in the following tables.

• A VPC client also has access to the Cloud Object Storage bucket over the public endpoint.
• A VPC client has access to the Cloud Object Storage configuration API over the public endpoint and direct endpoint. You can use the Cloud Object Storage configuration API to configure some Cloud Object Storage features on buckets, and to view bucket metadata.
• A VPC client can access a Cloud Object Storage bucket when context-based restrictions are in place by setting the network zone to the VPC ID. VPC clients can't access buckets that are restricted to using a traditional bucket firewall.

Regional endpoints

Buckets that are created at a regional endpoint distribute data across three data centers, which are spread across a metropolitan area. Any one of these data centers can suffer an outage, or even destruction, without affecting availability.

Cross-region endpoints

Buckets that are created at a cross-region endpoint distribute data across three regions. Any one of these regions can suffer an outage or even destruction without affecting availability. Requests are routed to the nearest region's data center by using Border Gateway Protocol (BGP) routing.

If an outage occurs, requests are automatically rerouted to an active region. Advanced users who want to write their own failover logic can do so by sending requests to the specific region's endpoint and bypassing the BGP routing.

Single data center endpoints

Single data centers aren't colocated with IBM Cloud® services, such as IAM or Key Protect, and they offer no resiliency if a site has an outage or is destroyed.

If a networking failure results in a partition, such that the data center can't reach a core IBM Cloud® region for access to IAM, authorization information is read from a cache that might become stale. This action can result in a lack of enforcement of new or altered IAM policies for up to 24 hours.