OCI Object Storage to STACKIT Object Storage, step by step

A bucket, assessed

The estate was written for this page and assessed on 4 November 2026. Left: the versioned media bucket. Right: the record the run keeps for it in assessment.json, copied from the run. assessment.json is written as a single line, so the pane shows selected fields of each unit, indented and nested as in the file, with the values unchanged.

resource "oci_objectstorage_bucket" "media" {
  compartment_id = var.compartment_id
  namespace      = var.namespace
  name           = "media"
  access_type    = "NoPublicAccess"
  storage_tier   = "Standard"
  versioning     = "Enabled"
}

{
  "id": "oci_objectstorage_bucket.media",
  "wave": 1,
  "result": {
    "class": "RECONFIGURE",
    "confidence": "LOW",
    "target": {
      "service": "STACKIT Object Storage"
    },
    "reason": "A bucket becomes a STACKIT Object Storage bucket with an S3 API. Clients change endpoint and credentials; lifecycle, replication and access rules are rewritten."
  }
}

• Mapped, with a cost to clients

  The bucket becomes a STACKIT Object Storage bucket with an S3 API. Clients change endpoint and credentials; lifecycle, replication and access rules are rewritten.

• Why LOW and not MEDIUM

  The archive bucket, linked to nothing the catalogue lacks, is MEDIUM: the ceiling while the oci provider has no lock file entry. The media bucket is LOW because the lifecycle policy, the pre-authenticated request and the object that point at it are unknown to the catalogue.

• Six settings stay with you

  access_type, compartment_id, name, namespace, storage_tier and versioning are listed as critical settings left to you; no STACKIT bucket block is written for this source.

The lifecycle policy the run hands over

The lifecycle policy, the pre-authenticated request and the object are not in the catalogue of this build. Each is MANUAL_REVIEW with nothing assessed or drafted. The rule below deletes objects under tmp/ after 30 days. assessment.json is written as a single line, so the pane shows selected fields of each unit, indented and nested as in the file, with the values unchanged.

resource "oci_objectstorage_object_lifecycle_policy" "media" {
  namespace = var.namespace
  bucket    = oci_objectstorage_bucket.media.name

  rules {
    name        = "expire-tmp"
    action      = "DELETE"
    is_enabled  = true
    time_amount = 30
    time_unit   = "DAYS"
    target      = "objects"

    object_name_filter {
      inclusion_prefixes = ["tmp/"]
    }
  }
}

{
  "id": "oci_objectstorage_object_lifecycle_policy.media",
  "wave": 2,
  "result": {
    "class": "MANUAL_REVIEW",
    "confidence": "LOW",
    "reason": "oci_objectstorage_object_lifecycle_policy is not in the knowledge base catalogue; an architect has to decide the target. Nothing of this resource is assessed or drafted (unknown source type)."
  }
}

• STACKIT lists the calls

  The supported-operations page lists Put, Get and Delete Bucket Lifecycle Configuration, so a rule like this can be set through the S3 API. Re-create it there and test it on a bucket with test data.

• The pre-authenticated request

  The request in the demo gives read access to exports/report.csv until 1 January 2027. STACKIT lists query-parameter authentication for presigned URLs; each OCI link needs a replacement, and its consumers need the new one.

The migration in order

1. 01

   1. Assess and read the data-movement file

   migration/data-movement.md lists both buckets as stateful units with the mechanism UNKNOWN and the state DECISION_REQUIRED. The method depends on the size of the data, the downtime the business tolerates and the consistency the application needs; the Terraform states none of them, so they are yours to supply.

2. 02

   2. Create the STACKIT buckets

   Names on STACKIT must be unique across the whole system, 3 to 63 characters, letters, numbers and hyphens, starting and ending with a letter or number. On OCI a name only has to be unique within the tenancy namespace, so a short name such as media is likely taken. Plan a naming scheme first.

3. 03

   3. Create credentials

   The run names a credentials group and a credential as part of the STACKIT target. On STACKIT you create credentials inside a credential group in the Portal; the dialog shows the access key ID and the secret access key once. On OCI the S3 API uses a customer secret key, whose secret also cannot be retrieved after generation. Store both in your secret store before you close anything.

4. 04

   4. Copy through the two S3 endpoints

   Oracle offers a path-style endpoint of the form https://NAMESPACE.compat.objectstorage.REGION.oci.customer-oci.com; STACKIT documents https://object.storage.eu01.onstackit.cloud with the region eu01; its client set-up page names no other region, so take the endpoint for any other region from STACKIT. A sync tool with one remote per side, for example rclone, can copy bucket to bucket. Oracle does not support AWS signature version 2, so use a client that signs with version 4. STACKIT limits a project to 500 MB/s of transfer and 2,500 requests per second, so 10 TB takes at least about 5.5 hours. This is general practice; the run performs no copy.

5. 05

   5. Check versions and sizes

   STACKIT keeps at most 1,000 versions per object and takes objects up to 5 TB, in up to 10,000 parts of at most 5 GB. Compare object counts and total bytes per bucket before you switch clients.

6. 06

   6. Switch clients, then retire

   Change endpoint and credentials in each application, run both buckets in parallel for as long as your rollback plan needs, and delete the OCI buckets and their links last.

Where the two services differ in practice

STACKIT facts are from the supported-operations, limits, credentials and CLI-client pages; a call that is not listed there is not confirmed as unsupported, only not listed. Get Bucket Notification Configuration is the only notification call listed, so event-driven consumers need their own design.

What to change before you apply

• Write the STACKIT side

  No STACKIT bucket block is written for this source. Create the buckets, the credential group and the credentials from the target the report names, with the naming scheme you chose.

• Decide the archive data

  The archive bucket uses the Archive tier. The tier does not carry over as a setting, so decide where cold data lives and what retrieval you accept.

• Rewrite the access model

  OCI access runs through IAM groups and policies. On STACKIT, access is per credentials and bucket policy; map each consumer.

• Pin the provider

  Commit the lock file for oracle/oci 9.11.0. Until then every unit is capped at MEDIUM and the source check by OpenTofu is not run.

Questions storage teams ask

Sources

• Oracle Cloud: Amazon S3 Compatibility API
• STACKIT Docs: Supported operations on buckets and objects
• STACKIT Docs: Limits of Object Storage
• STACKIT Docs: Create and delete Object Storage credentials
• STACKIT Docs: Set up a CLI client for Object Storage