Object storage next to your servers.
No keys in your code.
S3 buckets in every Frazer region, on servers Frazer runs. Your clusters and services reach them with their own identity, so no access key sits in code, Git or an image. Versioning, Object Lock and lifecycle rules come with every bucket.
# frazer serverless stacks create notes --from frazer.stack.yaml --dry-run
apiVersion: frazer.ai/v1
kind: Stack
name: notes
services:
notes-api:
source: {repo: acme/notes, branch: main}
bind: {S3_BUCKET: bucket/notes-uploads}
buckets:
notes-uploads: {versioning: true}# S3_BUCKET, AWS_ENDPOINT_URL_S3, AWS_REGION
# come from the binding. Credentials are short-lived and
# come from the service's own identity: no access key.
import os
import boto3
s3 = boto3.client("s3")
s3.upload_file("note.md", os.environ["S3_BUCKET"], "notes/note.md")Your workload is the credential.
STS trades its identity for short-lived keys.
Keep every version.
Lock what must stay.
Each bucket shows its size, versioning, lock, lifecycle rules, the identity that may reach it and its off-site copy. A lock in compliance mode changes only through an approved plan.
Versioning
An overwrite or a delete keeps the previous version until a lifecycle rule removes it.
Object Lock
Governance or compliance mode. A locked object cannot be deleted before its date, by anyone.
Lifecycle rules
Expire old versions and abort stale uploads on a schedule; each expiry shows in the console.
Built for load from the first second.
And the test that checks each line.
The object store is designed to take full load on a new bucket from its first second, with no warm-up. Each line names what it is designed to handle and how we test it.
| What | Designed to handle | Tested with |
|---|---|---|
| Requests on a new bucket | ≥ 2,000 PUT/s and ≥ 10,000 GET/s from the first second | warp, mixed, 64 KiB objects |
| Time to first byte on GET | p50 ≤ 10 ms, p99 ≤ 50 ms | warp, 64 KiB objects |
| Throughput | ≥ 2 GiB/s on three servers | warp, 32 MiB objects |
| Listing a large bucket | 1,000 keys listed in ≤ 100 ms at p99 | 50 million objects in one bucket |
| A server lost under load | < 0.1 % errors; healthy within an hour of rejoining | a server killed during warp |
What we do not claim: eleven nines, durability across zones, or the aggregate throughput of the largest clouds.
An S3 bucket, run for you.
With the parts that keep data safe.
The S3 API
Any S3 SDK or tool, at
s3.us-virginia1.frazer.run, over IPv4 and IPv6.No static keys
Workloads assume a role with their cluster or service identity, through STS.
Versioning and Object Lock
Every version kept until a rule removes it; locks in governance or compliance mode.
Lifecycle rules
Expire noncurrent versions and abort stale multipart uploads.
Notifications
Persistent bucket notifications, delivered through Frazer events.
Quotas and metering
Quotas that answer
403 QuotaExceeded; byte-hours metered every 60 seconds.Import
Copy in from S3-compatible storage or Google Cloud Storage with a read-only connection.
Who reaches a bucket.
And what happens at the limit.
Who may do what
- Project roles
- Map to bucket roles in the project's own bucket account.
- Workloads
- Reach the buckets they are bound to with their own identity, through STS. No key to copy.
- Compliance locks
- Changing a compliance-mode lock needs an approved plan.
What is logged
- Every bucket, rule and lock change is a plan with an audit entry.
- Each lifecycle expiry shows in the console.
- Usage as byte-hours every 60 seconds, reconciled when the interval closes.
At the cap
- At a budget cap, buckets keep serving.
- Writes are blocked only after 30 days past due; deleting needs a separate 30-day notice.
- Past a quota, writes return
403 QuotaExceeded.
One rate per GiB-month.
No egress fees within fair use.
Frazer Storage bills by the GiB-month stored, metered as byte-hours every minute. The backups Frazer keeps for your databases and VMs come out of an allowance for every server you bring.
See every priceFrazer Storage, answered.
Which tools work with Frazer Storage?
Clients that speak the S3 API: SDKs, command-line tools and backup tools. The region's endpoint is s3.us-virginia1.frazer.run, and it answers over IPv4 and IPv6.
How does my code get credentials without a key?
Your cluster or serverless service presents its own identity token from Frazer's OIDC issuer, and STS returns short-lived keys for the buckets it may use. A serverless binding also writes S3_BUCKET, AWS_ENDPOINT_URL_S3 and AWS_REGION. There is nothing to rotate.
How durable is a bucket?
What we state is what we run: three copies on three servers in the region, and a nightly copy at a second provider. We do not claim eleven nines.
Do buckets run on my servers?
No. Buckets run on servers Frazer operates in each Frazer region, and Frazer runs the storage engine: upgrades, disks and recovery, with your objects replicated across the site's servers. Egress to your clusters in the same region is free.
What happens to my buckets at a budget cap?
They keep serving. Writes are blocked only after an invoice is 30 days past due, and deleting data needs a separate 30-day notice.
Can I bring data from another provider?
Yes. Connect S3-compatible storage or Google Cloud Storage read-only, with OIDC federation where the provider offers it, and copy the objects into Frazer Storage.