S3 Compatibility#

Strata is intended as a drop-in Ceph RGW replacement. The honest measure of that claim is the Ceph s3-tests suite — the de-facto upstream compatibility benchmark.

What we support#

A summary of where Strata sits today against the AWS S3 surface:

• Buckets + objects + listing + versioning + multipart — full surface, including ListObjects v1/v2, ListObjectVersions, conditional headers, range GET, presigned URLs.
• Access control — bucket / object ACL, bucket policy, public-access block, ownership controls, CORS.
• Encryption — SSE-S3 (AES-256), SSE-KMS (AWS KMS or Vault Transit), SSE-C. Master-key rotation via strata admin rewrap.
• Object Lock — COMPLIANCE + GOVERNANCE, legal hold, bypass-governance flag.
• Lifecycle / replication / inventory / logging / notification — rule storage + worker-driven execution (STRATA_WORKERS=).
• IAM + STS — CreateUser, CreateAccessKey, AssumeRole, access points.
• SigV4 — path-style, virtual-hosted, presigned, streaming chunk decoder.

Detailed bucket / object / IAM / auth tables below.

Headline#

tests=177  passed=162  failed=15  errors=0  skipped=0
pass rate: 91.5%

(Run on the default executable subset: test_bucket_create or test_bucket_list or test_object_write or test_object_read or test_object_delete or test_multipart or test_versioning_obj or test_bucket_list_versions. See scripts/s3-tests/README.md for the per-test gap breakdown and historical runs.)

The 15 remaining failures split into:

• 11 deliberate gaps — SigV2 (deprecated 2018, never implemented), test_bucket_list_prefix_unreadable (URL-decode happens before our handler sees the byte), anonymous-list against STRATA_AUTH_MODE=required (intentional posture).
• 4 real bugs tracked as separate P2 ROADMAP entries — multipart copy GET-side checksum echo divergence (3 tests) + multipart Complete duplicate PartNumber (1 test).

Re-run the suite locally with scripts/s3-tests/run.sh. Output lands in scripts/s3-tests/report/.

For the operator + SDK-author index of every operation (handler pointers, AWS-divergence one-liners), see Reference — S3 API operations.

Bucket-level operations#

Status legend: ✅ supported · ⚠️ partial · ❌ not supported.

Object-level operations#

IAM / STS surface#

?Action= requests against the gateway base URL drive the IAM control plane. The handler dispatches on the Action parameter — see the Reference — S3 API row for the entry point.

Managed-policy attach / detach is exposed via the admin API (/admin/v1/iam/users/{name}/policies), not via SigV4 ?Action= — managed policies and policy gating are documented in https://danchupin.github.io/strata/best-practices/web-ui/.

Auth surfaces#

Explicitly NOT supported#

These surfaces are NOT implemented today. Each row links to the ROADMAP entry tracking it (or notes “out of scope” if it is intentionally deferred).

• Cross-account ACLs. Strata IAM users live in a flat account namespace — there is no cross-account principal model.
• Requester Pays buckets. Bucket-payment shifting is an AWS-billing surface and out of scope.
• Transfer Acceleration. AWS edge-network feature; out of scope.
• Intelligent-Tiering. P3 ROADMAP Intelligent-Tiering — needs hot/cold access counters per object.
• S3 Select / Select Object Content. P3 ROADMAP Select / Select Object Content.
• Object Lambda. Out of scope ((out of scope) — Object Lambda in ROADMAP).
• SigV2. Deprecated upstream; not on the roadmap.
• Object Lock COMPLIANCE-violation distinct audit row. P3 ROADMAP Object Lock COMPLIANCE audit log — audit_log records the denied DELETE but does not flag it with a typed retention-violation reason.
• aws-chunked-trailer streaming variant. Newer aws-cli releases use a trailer-based chunked encoding that the bufio-based decoder does not parse. Plain x-amz-content-sha256: <hex> and STREAMING-AWS4-HMAC-SHA256-PAYLOAD both work; tracked under Known latent bugs in ROADMAP.
• Multipart copy GET-side checksum echo divergence. P2 ROADMAP Multipart copy GET-side checksum echo divergence — 3 of 15 remaining s3-tests failures.
• Multipart Complete duplicate PartNumber. P2 ROADMAP Multipart Complete rejects duplicate PartNumber in Parts list — 1 of 15 remaining s3-tests failures.

Posture caveats#

A few defaults that operators sometimes assume work AWS-style and don’t:

• STRATA_AUTH_MODE=required (recommended for production) rejects anonymous list before the bucket-policy / ACL gate — the s3-tests test_bucket_list_objects_anonymous family fail under this posture by design. Use optional if you need anonymous reads to flow through to the policy gate.
• The SigV4 signing surface includes the original Host header. Behind a load balancer or ingress controller, you must preserve the upstream Host (upstream-vhost: $host on ingress-nginx; proxy_set_header Host $host on raw nginx) — see https://danchupin.github.io/strata/deploy/kubernetes/ and https://danchupin.github.io/strata/architecture/auth/.
• The headline 91.5% pass rate is on the executable subset filter (multipart + versioning + listing + object IO). The full s3-tests run surfaces additional fixtures around website hosting, CORS, and replication that exercise paths the default subset skips. Run S3_TESTS_FILTER=all scripts/s3-tests/run.sh for the full picture.

Where to look next#

• https://danchupin.github.io/strata/get-started/ — bring up a gateway and run a few PUT/GET round-trips.
• https://danchupin.github.io/strata/architecture/auth/ — SigV4 internals, presigned URLs, STS.
• https://danchupin.github.io/strata/architecture/router/ — query-string dispatch shape behind the bucket / object tables above.
• https://danchupin.github.io/strata/operate/monitoring/ — what to alert on when surface starts misbehaving.
• scripts/s3-tests/README.md — full per-test breakdown + historical baselines.
• ROADMAP.md — P-item entries for every “not supported” row above.