Amazon S3 to STACKIT Object Storage

A versioned, encrypted bucket with a lifecycle rule

A small estate written for this page and assessed by StackToIT on 4 November 2026. Left: the input. Right: the resource blocks of the STACKIT Terraform the engine wrote; the review comments that sit above each block in the file are left out here.

resource "aws_s3_bucket" "documents" {
  bucket = "acme-customer-documents"
}

resource "aws_s3_bucket_versioning" "documents" {
  bucket = aws_s3_bucket.documents.id
  versioning_configuration {
    status = "Enabled"
  }
}

resource "aws_s3_bucket_server_side_encryption_configuration" "documents" {
  bucket = aws_s3_bucket.documents.id
  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "AES256"
    }
  }
}

resource "aws_s3_bucket_public_access_block" "documents" {
  bucket                  = aws_s3_bucket.documents.id
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

resource "aws_s3_bucket_lifecycle_configuration" "documents" {
  bucket = aws_s3_bucket.documents.id
  rule {
    id     = "expire-old-versions"
    status = "Enabled"
    filter {}
    noncurrent_version_expiration {
      noncurrent_days = 90
    }
  }
}

resource "stackit_objectstorage_credentials_group" "consumers" {
  for_each   = var.objectstorage_consumers
  project_id = var.project_id
  name       = each.key
}

resource "stackit_objectstorage_credential" "consumers" {
  for_each             = var.objectstorage_consumers
  project_id           = var.project_id
  credentials_group_id = stackit_objectstorage_credentials_group.consumers[each.key].credentials_group_id
}

resource "stackit_objectstorage_bucket" "documents" {
  project_id = var.project_id
  name       = "acme-customer-documents"
}

• Bucket and keys in Terraform

  The bucket keeps its name, and a credentials group with a key is written for each consumer you list.

• Versioning and lifecycle through the S3 API

  The STACKIT provider has no attributes for them, but STACKIT’s S3 API takes them. StackToIT writes the exact documents for that step.

• Encryption at rest

  The AES256 default encryption needs no setting: a STACKIT bucket applies it anyway.

• Public access guardrail named

  STACKIT has no public access block. The code says so and asks you to confirm that no bucket policy makes the bucket public.

The S3 API documents StackToIT wrote

Applied to the new bucket through STACKIT’s S3 API, before any data is copied.

{
  "Status": "Enabled"
}

{
  "Rules": [
    {
      "ID": "expire-old-versions",
      "Status": "Enabled",
      "Filter": {
        "Prefix": ""
      },
      "NoncurrentVersionExpiration": {
        "NoncurrentDays": 90
      }
    }
  ]
}

The data copy runbook

Written beside the bucket for your team, step by step.

1. 01

   Decide and prepare

   Check the open decisions, create the bucket and apply the S3 API documents.

2. 02

   Copy while the writers run

   A first copy with checksums, including the version history, while the applications keep writing to S3.

3. 03

   Cutover window

   Stop the writers, copy what changed, and switch the consumers to the STACKIT endpoint and keys.

4. 04

   Verify and accept

   Compare counts, key lists and content, check with the application, and retire the source after acceptance.

The decisions recorded for this bucket

The assessment of this one bucket names who answers what before the data moves.

Source: the StackToIT assessment of this bucket, 4 November 2026.

What the plan knows about the move

Beyond the Terraform, the plan holds the steps of the copy for both tools and the checks that end it.

• Wave 1, no dependencies

  The bucket sits in the first wave of the dependency order and depends on no other unit, so it can move first.

• Two copy tools, no replication

  The plan holds initial copy, delta sync, write freeze, final sync, reconcile and cleanup steps for the AWS CLI and for rclone. S3 Replication is not offered, because it copies between Amazon S3 buckets.

• Checks after the transfer

  Object count and bytes, key lists, content, versions, an application check and a rollback limit. Three manual reconcile steps compare source and target with the writers stopped.

• The way back

  On a no-go the clients still point at the source, which is current to the freeze. The owner records the point after which a rollback loses data before the window.

• Nine work packages

  They run from the service-gap steps through copy, consumer switch and the go-or-rollback record to retiring the source.

• Unknowns stay named

  Data size, change rate, tolerated downtime, recovery point and data classification are not in the source. The plan lists them as not known and assumes no default.

Questions storage teams ask

Sources

• AWS Docs: What is Amazon S3?
• STACKIT Docs: Object Storage