Object Storage Service (OBS)

Companies and cloud service providers are facing the challenge to keep pace with exponential data growth. This includes not only the physical scaling of the storage itself, but also the administration of large amounts of data. From a consumer perspective, data needs to be available everywhere and all the time. This requires proper security mechanics that ensure that only target consumer services have access to the data.

For these storage demands the Object Storage Service (OBS) is the perfect fit. A highly secure, reliable and scalable storage solution that allows you to store any volume of unstructured data in any format. It is accessible from any location at any time via various accessibility options like REST APIs. OBS provides different storage classes allowing you to cost-effectively manage your data depending on your accessibility demands. The warm storage class is suitable for infrequently accessed data. It offers lower storage costs at a slightly higher latency compared to the standard class. The cold storage class is the best fit for rarely accessed data, such as archives where access does not need to be real-time.

OBS data is stored in the Deutsche Telekom's datacenters. These run in Europe and comply with GDPR requirements. This ensures that Open Telekom Cloud services built on top of this infrastructure also easily and heedlessly comply to the GDPR.

OBS achieves an availability of 99.95% and a durability of up to 99.9999999999% (12 nines). This ensures that your data is available, accessible and protected against data loss and data corruption at all times.

In a lot of cases, stored data is infrequently or even rarely accessed. With OBS, you are provided with 3 storage classes, allowing you to optimize your costs based on data accessibility demands, making it the perfect fit for cloud native applications.

OBS is physically as well as logically secured. Policies or Access Control Lists make it possible to granulary define who is able to access data. This is strictly enforced by the implemented least-privilege principle. In addition, all your data stored in your bucket can be protected via default bucket encryption or individually be encrypted on object level.

Lifecycle rules allow for the specification of rules for your bucket so that objects are automatically transferred to storage classes or even deleted after a specified period. This allows you to automatically move objects to the warm or cold storage class, trading in latency for a more cost-efficient storage. In the case of enabled versioning, it is possible to create seperate rules for historical as well as the current version of your data.

OBS provides multiple methods to manage access and permissions for your objects and buckets. These can be either configured by

• IAM Policy
• Bucket Access Control Lists (ACLs) or
• specific Bucket & Object Policies.

Bucket & Object Policies allow granular definition of who is allowed to access or perform which kinds of action on which resources. ACLs allows you to specify read & write access rights to specific users or user groups on the bucket.

Versioning allows you to store multiple historic versions of an object. This protects you against accidental data deletion, overwriting or generic application faults by enabling you to restore your object to a former version of itself. Versioning will increase your storage consumption, as objects are stored multiple times in your OBS using a dedicated object version ID.

OBS supports object encryption via the Open Telekom Cloud Key Management Service. KMS uses the industry standard XTS-AES-256 encryption algorithm. When default encryption is enabled, all newly uploaded objects will be encrypted by default and stored in your bucket. In case you need a more granular management, it is even possible to individually encrypt objects throughout the upload process.

By enabling the logging functionality, OBS will create and store generated logs inside your bucket. Afterwards, you can conveniently analyze actions executed on your bucket in detail. The event notifications functionality can be used to inform you once a specific event such as the creation or deletion of an object has occured. This way you can keep track of what is happening and analyse activities inside your bucket.

OBS allows you to host entire static websites, or also allows for the usage of resources stored in OBS via cross-origin requests. In order to avoid that a 3rd party website makes use of your content, you can

• whitelist URLs accessing the content 
• blacklist URLs that should not be able to access your OBS storage.

This way you can ensure only authorized websites or web applications can access your data.

The OBS Service supports the creation of a parallel file system (PFS) based on POSIX. Using the OBS as parallel file system enables you to e.g. connect your virtual machine (ECS) to the file system using a POSIX supporting client. The parallel file system functionality is well suited for High Performance Computing as well as media asset archiving scenarios.

The object storage service cross-region replication functionality allows you to replicate the objects stored in a bucket to a different region. This will make your data available in a total of 6 availability zones spread across 4 physical datacenter. Therefore, usage will increase the security and resilience level of your data and fulfill demands of geo-redundancy according to BSI, KRITIS or other regulatory requirements.

In order to prevent unauthorized modification or deletion of data and objects, it is possible to configure an object lock which acts similar to a „WORM“ functionality. You can simply define a time period objects should be locked while the objects put into the bucket inherit the period and cannot be modified or deleted until expiration. This is useful to protect against ransomware attacks.

Price calculator
Pricing Models: Storage
Service description incl. price list (PDF)

User Guide and API Description

Automating with APIs
OBS from Java application
Event notification for OBS