Docs

Torch Object Storage

Working with buckets

Creating buckets

A bucket is a container that holds your data as objects. You must create a bucket before uploading any objects.

Prerequisites

Make sure that you have created a Volcano Engine account and completed real name verification. For more information, see Account registration and Real Name Verification.

Make sure that you have activated TOS for your account or Identity and Access Management (IAM) users. For more information, see Activate TOS.

Notes

By default, the owner of an account has full permissions. Identity and Access Management (IAM) users have no permissions by default. If an IAM user needs to perform this operation, the account owner must grant the user the tos:CreateBucket permission using an IAM or bucket policy.

You can create up to 100 buckets for each account and its sub-account(s).

Steps

In the left navigation pane, click Buckets. Then, in the upper-left corner of the displayed page, click Create bucket.

Set the bucket parameters and click Create.

Parameter			Description	Constraints and limitations
Basic configurations	Name	Enter the name of the bucket. After you create the bucket, you cannot change its name. The bucket name must: Be globally unique within TOS, meaning no duplication is allowed across all regions and accounts. Consist only of numbers, hyphens (-), and lowercase letters (a-z). Start and end with a number or letter. Be between 3 and 63 characters long.	-
		Region	Select the region where you want to create a bucket. After you create a bucket, you cannot change its region.	-
		Versioning	Enable this feature to keep historical versions of overwritten and deleted objects.	-
		Bucket policy	The following options are available for the bucket policy: Private (Default): Only the bucket owner and authorized accounts have read and write permissions to objects. This is the recommended setting. Public read or Public read/write: All users have read access (full read and write access) to objects and will incur data transfer charges. Allowing all users to read and write objects can cause data leaks and financial losses. We recommend setting the policy to Private instead. To enable more granular access control, configure bucket ACLs, bucket policies, and IAM policies after creating the bucket.	-
		Object ACL default policy	Select whether to enable Object ACL default policy. This option is disabled by default. Default private (Default): Newly uploaded objects are private by default. Inherited bucket ACL: Newly uploaded objects inherit the bucket's ACL by default For details on the relationship between object ACL and bucket ACL, see Managing object permissions using bucket ACLs.	-
		Project	(Optional) Select the project to which the bucket belongs from the drop-down list.	A project is a virtual concept that comprises a set of resources, users, and roles. It provides a unified view of and access to resources, as well as control over user and role permissions within the project. For more information, see Resource management. To create a project, click Create new projects on the right. This will take you to the IAM console.
Advanced settings	Hierarchical namespace	Select whether to enable hierarchical namespace. Off (Default): The bucket will be created with a flat namespace (FNS bucket). This traditional object storage structure is ideal for general storage needs. On: The bucket will be created with a hierarchical namespace (HNS bucket). A hierarchical namespace adds directory hierarchy capabilities to a flat namespace, making it more suitable for big data, data lakes, and AI workloads. Learn more in What is hierarchical namespace.	Once Hierarchical namespace is enabled, it cannot be disabled. Choose carefully.
		Enable recycle bin	Select whether to enable the Recycle Bin feature for the bucket. Off (Default): Deletion operations will permanently delete objects or directories. On: Deleted objects or directories are first moved to the Recycle Bin.	This parameter only appears when the Hierarchical namespace feature is enabled. Objects in the Recycle Bin are automatically cleaned up according to Withdrawn policy. By default, objects are retained for seven days before being permanently deleted. You can adjust the retention period for objects or directories within the bucket. While objects or directories are still in the Recycle Bin, you can manually restore or permanently delete them.
		Multi-AZ Redundancy	Select whether to enable Multi-AZ Redundancy. If you enable multi-AZ redundancy, TOS will store your data across multiple availability zones in the same region. This ensures that your storage service will be stable even if one zone fails. Learn more in Multi-AZ redundancy.	Multi-AZ redundancy is currently only available in China (Beijing), China (Shanghai), China (Guangzhou), and Asia Pacific (Johor). For buckets with hierarchical namespace enabled, check the console to see if multi-AZ redundancy is available. Multi-AZ storage costs more than single-AZ storage. Once enabled, multi-AZ redundancy cannot be disabled. For details on how much it costs to store data in more than one AZ, check out Storage.
		Default storage type	Configure the storage type for the bucket. The storage types available in TOS are as follows: Standard Storage (Default): High availability, reliability, and performance, suitable for frequently accessed data. Infrequent Access Storage: Designed for less frequently accessed data with a minimum storage duration of 30 days. Intelligent Tiering: Automatically moves data between tiers based on how it is accessed, ideal for data with unpredictable access patterns. Flashback Archive: Optimized for rarely accessed data with a minimum storage duration of 90 days. Archive/Cold Archive: Suited for long-lived, rarely accessed data with flexible latency requirements. The minimum storage duration is 90 days for Archive and 180 days for Cold Archive. Deep Cold Archive: Cost-effective storage for extremely cold data with ultra-long retention needs. The minimum storage duration is 180 days.	The following storage types are only available in China (Beijing), China (Shanghai), and China (Guangzhou): Cold Archive. Deep Cold Archive. This storage type is currently in closed beta. Please contact your account manager for access. For more information, see Storage type. If you have enabled multi-AZ redundancy, you can only choose the storage type from the following options: Standard Storage (Multi-AZ), Infrequent Access Storage (Multi-AZ), and Flashback Archive (Multi-AZ). For more information on multi-AZ, see Multi-AZ redundancy.
		Server-Side encryption	Configure the server-side encryption method for the bucket. Once configured, all objects uploaded to the bucket will automatically inherit its encryption settings, unless otherwise specified. The available encryption options are: None: No encryption applied. SSE-TOS: TOS-managed encryption. Objects are encrypted automatically upon upload and decrypted during download using TOS-hosted keys. For more information, see Server-side encryption. SSE-KMS: Uses keys managed by Volcano Engine's Key Management Service (KMS) to encrypt and decrypt objects. For more information, see Server-side encryption.	SSE-TOS and SSE-KMS are only supported in China (Beijing), China (Shanghai), Asia Pacific (Johor), and Asia Pacific (Jakarta). If you are using SSE-KMS for server-side encryption for the first time, you must first activate KMS. Although activating KMS is free, using the service incurs charges. Using SSE-KMS for server-side encryption generates API call fees, and creating KMS keys generates key management fees. These fees are charged by KMS. For more information, see Key Management Billing Description.
		Encryption algorithm	Select the encryption algorithm for the key. Options include AES256 and SM4.	This parameter only appears when SSE-KMS or SSE-TOS is selected for Server-Side encryption. The AES-256 algorithm is only supported in China (Beijing), China (Shanghai), Asia Pacific (Johor), and Asia Pacific (Jakarta). The SM4 algorithm is only supported in China (Beijing) and China (Shanghai).
		Encryption Key Type	Custom Key is selected by default.	This parameter only appears when SSE-KMS is selected for Server-Side encryption.
		Key Project	Select the project to which the custom key belongs. The system will then display the available custom keys under that project. To create a new project, click Create new projects. For more information, see Project management.	This parameter only appears when SSE-KMS is selected for Server-Side encryption.
		Custom Key	Select a KMS key. TOS uses this key to encrypt objects in the bucket on the server. To use a new key, first create one by following the Key Management Quick Start guide.	This parameter only appears when SSE-KMS is selected for Server-Side encryption.
		Log analysis	Select whether to enable Log analysis. TOS offers free real-time queries of the most recent seven days of TOS activity through the log analysis feature, which is based on Torch Log Service (TLS). Once you have enabled log analysis, you can query and analyze access logs for your bucket in real time. By default, logs are saved for seven days. This period is customizable. However, TLS will charge you extra for logs kept beyond seven days. For more information on TLS pricing, see TLS Billing.	First-time users must grant TOS permission to access Volcano Engine TLS. Learn more in Log analysis.
		RenameObject	Select whether to enable RenameObject. Once you have enabled RenameObject, you can rename objects by calling the RenameObject API. Learn more in Using RenameObject.	RenameObject does not work with versioning. You cannot use this feature if versioning is enabled on your bucket.
		Tag	Add one or more tag to your bucket. For more information, see Tagging buckets.	-
		Retention policy	Select whether to enable the retention policy feature. For more information, see Configuring WORM retention.	-

Last updated: 2026.10.22 14:12:37