What works with Zata

Which S3 features Zata supports, and the limits to know before you start.

Zata speaks the Amazon S3 API, so most S3 tools and SDKs work without changes. Use this page to check whether a feature your app needs is supported, and which limits apply.

Connection

Feature	On Zata
Path-style URLs (https://idr01.zata.ai/my-bucket)	Supported (recommended)
Virtual-host style URLs (https://my-bucket.idr01.zata.ai)	Supported. Bucket names with a dot fail the certificate check in this style, so use path-style for them.
Signature V4	Supported (recommended)
Signature V2	Supported
Region name	Not checked. Use us-east-1.
HTTPS	Required. http:// is redirected to https://. The certificates are public (Let's Encrypt), so you never need a custom certificate.
Endpoints	https://idr01.zata.ai (Indore) and https://bom01.zata.ai (Mumbai). Each bucket and each access key belongs to one region.

Two things in newer tools need a setting:

• Default checksums in AWS SDKs and the AWS CLI (versions from January 2025): large uploads fail with XAmzContentSHA256Mismatch until you set checksums to "when required". See Tools built on the AWS SDK.
• Tools that sign the Accept-Encoding header get 403 SignatureDoesNotMatch, because this header changes on the way to Zata. rclone needs sign_accept_encoding = false (rclone on Linux), and Go apps need a small fix (Go). Python tools are not affected.

Features

Feature	Supported	Notes
Buckets, objects and folders	Yes	Folders are name prefixes, as on Amazon S3.
Multipart upload	Yes	See Limits.
Server-side copy (CopyObject)	Yes
Presigned URLs	Yes	Download (GET) and upload (PUT) links work. An upload must send the same Content-Type that was signed. See Share a file.
Versioning	Yes	Turn it on in the bucket settings. See Bucket settings and Delete and restore files.
Object Lock	Yes	Governance mode, compliance mode and legal hold. Can only be turned on when the bucket is created. See Object Lock.
Lifecycle rules	Yes	Rules that filter by object size, or keep the newest N old versions, work in Mumbai only. See Lifecycle rules.
Bucket and object tags	Yes	See Tags.
ACLs	Yes	See Bucket ACL and Object ACL.
Bucket policies	Partly	A subset of the AWS policy language: no IAM policies and no ${...} variables. Principals are Zata user IDs, not AWS account IDs. See What policies support.
S3 Select	Yes
CORS (browser access)	On request	Ask Zata support. See Browser and SDK access.
Server-side encryption (SSE-S3, SSE-C, SSE-KMS)	No	Requests with encryption headers are rejected (InvalidRequest). Turn the tool's encryption option off, or encrypt files before you upload them.
Storage classes	Standard only	GLACIER, DEEP_ARCHIVE, STANDARD_IA and other classes are rejected (InvalidArgument). Leave the storage class empty or set STANDARD.
STS, temporary credentials, IAM roles, AssumeRole	No	Use sub-users to give limited access.
IAM users and IAM policies	No	Use sub-users and bucket policies.
Server access logs	No	You cannot see Zata's request logs. Use your tool's debug output; Zata support can check the logs on Zata's side.

Limits

Limit	Value
Single upload (one PUT request)	Up to 5 GB. Larger files must use multipart upload, otherwise EntityTooLarge.
Multipart part size	At least 5 MB for every part except the last, otherwise EntityTooSmall
Parts per multipart upload	Up to 10,000
Part order	Parts can be uploaded in any order.
Unfinished multipart uploads	Keep using storage until they are completed or cancelled. See Large uploads.
ETag of a multipart upload	Ends in -N (the number of parts) and is not the file's MD5. A different ETag does not mean the file is damaged.
Clock difference	Requests are rejected with RequestTimeTooSkewed when your computer's clock is more than about 15 minutes off.

Sub-user keys

A sub-user's access key works like the owner's key, with these differences:

• It cannot create buckets (AccessDenied).
• Its bucket list is empty, even for buckets it can use. Open the bucket by its name.
• It can only do what the account owner allowed on each bucket. See Access types.