Storage in Practice

Access Patterns

Three access patterns cover most use cases:

1. Public assets (profile avatars, product images, public documents)
   → Public bucket policy, serve via CDN, immutable URLs
   → No auth overhead, maximum cache effectiveness

2. Private user files (invoices, contracts, medical records)
   → Private bucket, presigned URLs with short TTL
   → URL expires so sharing a link doesn't give permanent access

3. Internal service-to-service (backups, exports, ML training data)
   → IAM credentials with least-privilege bucket/prefix access
   → No presigned URLs needed — services authenticate directly

Presigned Download URLs

Private files are not publicly accessible. Generate a time-limited URL when a user needs to download:

import { GetObjectCommand } from '@aws-sdk/client-s3';
import { getSignedUrl } from '@aws-sdk/s3-request-presigner';

async function getDownloadUrl(key: string, userId: string, ttlSeconds = 3600): Promise<string> {
	// Verify the file belongs to this user before signing
	const file = await db.query(
		'SELECT storage_key FROM user_files WHERE storage_key = $1 AND user_id = $2',
		[key, userId]
	);

	if (file.rows.length === 0) throw new Error('File not found');

	return getSignedUrl(
		s3,
		new GetObjectCommand({
			Bucket: 'user-uploads',
			Key: key,
			ResponseContentDisposition: `attachment; filename="${encodeURIComponent(key.split('/').pop()!)}"`
		}),
		{ expiresIn: ttlSeconds }
	);
}

// Route: generate download link
app.get('/files/:key/download', async (req, res) => {
	const url = await getDownloadUrl(req.params.key, req.user.id);
	res.redirect(302, url); // 302 because URL expires — don't cache
});

TTL guidance:

• Document downloads: 1 hour
• Streaming video: 4–8 hours (must outlast the session)
• Presigned PUT for upload: 5–15 minutes
• API access tokens tied to presigned URL: match token TTL

Bucket Organization

user-uploads/
  avatars/{userId}/{hash}.webp          ← public bucket
  documents/{userId}/{uuid}.pdf         ← private bucket
  temp/{userId}/{uuid}                  ← private, lifecycle deletes after 24h

app-assets/
  static/{hash}/{filename}              ← public bucket, CDN origin

backups/
  postgres/{date}/{snapshot}.tar.gz     ← private, lifecycle to Glacier after 30d
  exports/{jobId}/{filename}.csv        ← private, lifecycle deletes after 7d

Use prefixes to apply lifecycle policies and IAM policies independently without managing multiple buckets.

Bucket Policies and IAM

MinIO service account with prefix-scoped access:

# Create service account limited to one prefix
mc admin user svcacct add myminio app-user \
  --access-key app-access-key \
  --secret-key app-secret-key \
  --policy '{
    "Version": "2012-10-17",
    "Statement": [{
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:PutObject", "s3:DeleteObject"],
      "Resource": ["arn:aws:s3:::user-uploads/documents/*"]
    }, {
      "Effect": "Allow",
      "Action": ["s3:ListBucket"],
      "Resource": ["arn:aws:s3:::user-uploads"],
      "Condition": {
        "StringLike": { "s3:prefix": ["documents/*"] }
      }
    }]
  }'

// Per-tenant isolation: each tenant gets a dedicated prefix
// The app service account can only access its tenant prefix
const tenantKey = (tenantId: string, filename: string) => `tenants/${tenantId}/${filename}`;

// For stronger isolation: per-tenant service accounts with mc admin user svcacct
// Tenant A's key cannot access tenant B's prefix

Cost Optimization

Object storage cost has two components: storage ($/GB/month) and requests ($/1000 requests).

S3 Standard:          $0.023/GB    + $0.005/1000 PUT  + $0.0004/1000 GET
S3 Standard-IA:       $0.0125/GB   + $0.01/1000 PUT   + $0.001/1000 GET
S3 Glacier Instant:   $0.004/GB    + $0.02/1000 PUT   + $0.01/1000 GET
S3 Glacier Deep:      $0.00099/GB  + retrieval: hours

MinIO (self-hosted):  ~$0.005/GB (hardware cost) + $0 per request

Lifecycle policies automate cost optimization:

import { PutBucketLifecycleConfigurationCommand } from '@aws-sdk/client-s3';

await s3.send(
	new PutBucketLifecycleConfigurationCommand({
		Bucket: 'user-uploads',
		LifecycleConfiguration: {
			Rules: [
				{
					ID: 'temp-cleanup',
					Status: 'Enabled',
					Filter: { Prefix: 'temp/' },
					Expiration: { Days: 1 }
				},
				{
					ID: 'old-documents-to-ia',
					Status: 'Enabled',
					Filter: { Prefix: 'documents/' },
					Transitions: [
						{ Days: 90, StorageClass: 'STANDARD_IA' },
						{ Days: 365, StorageClass: 'GLACIER' }
					]
				},
				{
					ID: 'abort-multipart',
					Status: 'Enabled',
					Filter: {},
					AbortIncompleteMultipartUpload: { DaysAfterInitiation: 1 }
				}
			]
		}
	})
);

Deduplication: if multiple users upload the same file, store once:

import { createHash } from 'crypto';
import { HeadObjectCommand } from '@aws-sdk/client-s3';

async function deduplicatedUpload(buffer: Buffer, contentType: string) {
	const sha256 = createHash('sha256').update(buffer).digest('hex');
	const key = `deduped/${sha256}`;

	// Check if already stored
	try {
		await s3.send(new HeadObjectCommand({ Bucket: 'user-uploads', Key: key }));
		return key; // already exists
	} catch {
		// Upload
		await s3.send(
			new PutObjectCommand({
				Bucket: 'user-uploads',
				Key: key,
				Body: buffer,
				ContentType: contentType
			})
		);
		return key;
	}
}

// user_files table references the deduped key
// Multiple users can point to the same key

Backup Strategy

3-2-1 rule: 3 copies, 2 different media, 1 offsite.

For MinIO:

# Mirror MinIO to S3 (offsite backup)
mc mirror --watch --remove \
  myminio/user-uploads \
  s3/mycompany-backup/user-uploads

# Snapshot PostgreSQL + mirror to MinIO
#!/bin/bash
DATE=$(date +%Y-%m-%d-%H%M)
DUMP_FILE="postgres-${DATE}.sql.gz"

pg_dump $DATABASE_URL | gzip > /tmp/$DUMP_FILE

mc cp /tmp/$DUMP_FILE myminio/backups/postgres/$DUMP_FILE

rm /tmp/$DUMP_FILE

# CronJob in Kubernetes
apiVersion: batch/v1
kind: CronJob
metadata:
  name: postgres-backup
spec:
  schedule: '0 2 * * *' # 2am daily
  jobTemplate:
    spec:
      template:
        spec:
          containers:
            - name: backup
              image: postgres:16
              command:
                - /bin/sh
                - -c
                - |
                  DATE=$(date +%Y-%m-%d)
                  pg_dump $DATABASE_URL | gzip | \
                    mc pipe myminio/backups/postgres/${DATE}.sql.gz
              env:
                - name: DATABASE_URL
                  valueFrom:
                    secretKeyRef:
                      name: db-credentials
                      key: url

Verify backups work — test restore quarterly:

#!/bin/bash
# Download and restore to a test database
LATEST=$(mc ls myminio/backups/postgres/ | sort | tail -1 | awk '{print $NF}')
mc cp myminio/backups/postgres/$LATEST /tmp/restore.sql.gz
gunzip /tmp/restore.sql.gz
psql $TEST_DATABASE_URL < /tmp/restore.sql
echo "Restore completed. Row counts:"
psql $TEST_DATABASE_URL -c "SELECT count(*) FROM users;"

Orphaned File Cleanup

Files get orphaned when DB records are deleted but storage objects remain:

async function cleanupOrphanedFiles() {
	// Get all storage keys the DB knows about
	const dbKeys = new Set(
		(await db.query('SELECT storage_key FROM user_files')).rows.map((r) => r.storage_key)
	);

	// List all objects in storage
	const orphans: string[] = [];
	let continuationToken: string | undefined;

	do {
		const response = await s3.send(
			new ListObjectsV2Command({
				Bucket: 'user-uploads',
				Prefix: 'documents/',
				ContinuationToken: continuationToken
			})
		);

		for (const obj of response.Contents ?? []) {
			if (obj.Key && !dbKeys.has(obj.Key)) {
				// Skip recent files — give uploads time to complete DB write
				const age = Date.now() - (obj.LastModified?.getTime() ?? 0);
				if (age > 24 * 60 * 60 * 1000) {
					orphans.push(obj.Key);
				}
			}
		}

		continuationToken = response.NextContinuationToken;
	} while (continuationToken);

	console.log(`Found ${orphans.length} orphaned files`);

	// Delete in batches of 1000 (S3 limit)
	for (let i = 0; i < orphans.length; i += 1000) {
		const batch = orphans.slice(i, i + 1000);
		await s3.send(
			new DeleteObjectsCommand({
				Bucket: 'user-uploads',
				Delete: { Objects: batch.map((Key) => ({ Key })) }
			})
		);
	}
}

Run weekly via a CronJob or a one-off manual trigger.

Operational Checklist

□ Versioning enabled on buckets with irreplaceable user data
□ Lifecycle policies set: temp cleanup, old file tiering, multipart abort
□ Backup schedule: daily snapshot + offsite mirror
□ Restore tested: quarterly restore drill to test database
□ Access: least-privilege service accounts, no root credentials in app code
□ Monitoring: bucket usage, request rate, 5xx errors from storage
□ Orphan cleanup: weekly job removes files with no DB reference
□ CDN: static assets served via cache, not direct from origin
□ Content-Type set correctly on upload (browsers rely on it)
□ Signed URL TTL matches use case (short for uploads, longer for streaming)

Monitoring Storage

import { CloudWatchClient, GetMetricStatisticsCommand } from '@aws-sdk/client-cloudwatch';

// For MinIO: expose Prometheus metrics
// curl http://localhost:9000/minio/v2/metrics/cluster

// Key metrics to alert on:
// minio_bucket_usage_total_bytes > threshold → storage filling up
// minio_s3_requests_errors_total rate > 1%   → error rate spike
// minio_s3_ttfb_seconds_distribution p99 > 1s → latency degradation

# prometheus alert rules
groups:
  - name: storage
    rules:
      - alert: StorageHighErrorRate
        expr: rate(minio_s3_requests_errors_total[5m]) / rate(minio_s3_requests_total[5m]) > 0.01
        for: 2m
        annotations:
          summary: 'Storage error rate > 1%'

      - alert: StorageCapacityWarning
        expr: minio_node_disk_used_bytes / minio_node_disk_total_bytes > 0.8
        for: 10m
        annotations:
          summary: 'Storage disk {{ $labels.disk }} > 80% full'