What is the difference between Vault and Cold Vault storage?

Vault has higher retrieval costs and longer access times than Standard, but lower per-GB storage cost. Cold Vault is cheaper still per GB but with even longer retrieval (and a higher retrieval cost). Vault is right for data accessed monthly; Cold Vault is right for true archives accessed quarterly or less.

How does KYOK encryption differ from BYOK?

BYOK (Bring Your Own Key) means you supply the encryption key, but the key may be unwrapped inside IBM's infrastructure for crypto operations. KYOK (Keep Your Own Key) uses Hyper Protect Crypto Services where the key is held in an HSM with technical assurance that even IBM operators cannot access it. KYOK is appropriate for the strictest compliance regimes (financial services, healthcare under specific regulations).

IBM Cloud Object Storage Builder

StorageIBM Cloud

Build COS bucket configurations with storage classes, encryption, lifecycle rules, and object lock.

Last verified: May 2026

IBM Cloud Object Storage Configuration

Build COS bucket configurations with storage classes, encryption, lifecycle rules, object lock, and IAM policies.

Required Fields

instanceNamebucketsbuckets[0].namebuckets[0].storageClass

{
  "instanceName": "prod-cos-instance",
  "plan": "standard",
  "resourceGroup": "prod-resources",
  "buckets": [
    {
      "name": "prod-app-data",
      "storageClass": "smart",
      "location": "us-south",
      "locationType": "regional",
      "versioning": true,
      "objectLock": {
        "enabled": true,
        "defaultRetention": {
          "mode": "compliance",
          "days": 365
        }
      },
      "encryption": {
        "algorithm": "AES256",
        "keyProtect": {
          "instanceId": "key-protect-prod",
          "rootKeyId": "crk-cos-key-id"
        }
      },
      "activityTracking": {
        "readDataEvents": true,
        "writeDataEvents": true
      },
      "metricsMonitoring": {
        "usageMetricsEnabled": true,
        "requestMetricsEnabled": true
      }
    },
    {
      "name": "prod-backup-archive",
      "storageClass": "cold",
      "location": "us",
      "locationType": "cross_region",
      "lifecycleRules": [
        {
          "id": "archive-after-90",
          "status": "Enabled",
          "transition": {
            "days": 90,
            "storageClass": "accelerated_archive"
          }
        },
        {
          "id": "expire-after-7-years",
          "status": "Enabled",
          "expiration": { "days": 2555 }
        }
      ]
    }
  ],
  "iamPolicies": [
    {
      "role": "Writer",
      "subjects": ["ServiceId-app-service"],
      "resourceAttributes": {
        "bucketName": "prod-app-data"
      }
    }
  ]
}

Generated Output

Output will appear here...

About This Tool

IBM Cloud Object Storage (COS) is S3-compatible object storage with tiered storage classes (Standard, Vault, Cold Vault, Smart Tier), encryption options, and lifecycle policies. The COS Bucket Builder produces complete bucket configurations — storage class, encryption (default, BYOK, KYOK), lifecycle rules, object lock for compliance, and cross-region replication. Output is Terraform-ready and matches `ibm_cos_bucket` parameters.

Real-World Scenario

A regulatory requirement mandates 7-year retention of transaction logs that cannot be deleted by anyone, including system administrators. You configure a COS bucket with object lock in compliance mode and a 2557-day retention, plus KYOK encryption with keys held in Hyper Protect. The configuration goes through Terraform and the audit team has both the documented config and Terraform-state evidence. The audit signs off, and no further effort is needed to maintain the retention guarantee.

When to Use This Tool

•Provisioning a new COS bucket with the right storage class for the access pattern (Standard for hot, Cold Vault for archive).
•Adding a lifecycle policy that transitions objects older than 30 days from Standard to Vault, and to Cold Vault after 90 days.
•Configuring object lock for a compliance-sensitive bucket where objects must not be deletable for a retention period (regulatory write-once-read-many).
•Setting up cross-region replication so a critical bucket is asynchronously replicated to a second region for disaster recovery.

Pro Tips

TIP

Use Smart Tier if your access pattern is unpredictable. It moves objects between hot and cold storage automatically based on access, charging a small monitoring fee but saving you from the wrong-class lock-in.

TIP

Set object lock thoughtfully — once enabled, the retention period cannot be shortened. A 7-year retention you enabled accidentally on a 100 TB bucket is a 7-year storage bill you cannot reduce.

How It Works Under the Hood

The builder collects bucket name, region (or cross-region/regional), storage class, encryption (default, KMS-managed, KYOK), lifecycle rules, object lock config, and replication targets. It validates the combination — for example, object lock requires versioning enabled — and emits an `ibm_cos_bucket` Terraform resource with all the configuration. Replication produces a separate `ibm_cos_bucket_replication_rule` resource.

Frequently Asked Questions

What is the difference between Vault and Cold Vault storage?: Vault has higher retrieval costs and longer access times than Standard, but lower per-GB storage cost. Cold Vault is cheaper still per GB but with even longer retrieval (and a higher retrieval cost). Vault is right for data accessed monthly; Cold Vault is right for true archives accessed quarterly or less.
How does KYOK encryption differ from BYOK?: BYOK (Bring Your Own Key) means you supply the encryption key, but the key may be unwrapped inside IBM's infrastructure for crypto operations. KYOK (Keep Your Own Key) uses Hyper Protect Crypto Services where the key is held in an HSM with technical assurance that even IBM operators cannot access it. KYOK is appropriate for the strictest compliance regimes (financial services, healthcare under specific regulations).

Was this tool helpful?

Disclaimer: This tool runs entirely in your browser. No data is sent to our servers. Always verify outputs before using them in production. AWS, Azure, and GCP are trademarks of their respective owners.