Data Transfer Policy#

Wasabi’s free egress policy applies to the following use case: you store data in Wasabi, access it at a reasonable rate, and your use case does not impose an unreasonable burden on their service. To better understand what “reasonable rate” and “unreasonable burden” mean in this context, refer to the guidelines below.

• If your monthly outbound data transfer is less than or equal to your active storage volume, then your storage use case is a very good fit for Wasabi’s free egress policy.
• If your monthly outbound data transfer is greater than your active storage volume, then your storage use case is not a good fit for Wasabi’s free egress policy.

For example, if you store 100 TB of data in Wasabi and, within a monthly billing cycle, download (egress) no more than 100 TB of data, then your storage use case complies with their policy. If your monthly downloads exceed 100 TB, then your use case does not comply.

If your usage frequently exceeds the guidelines of the free egress policy, Wasabi reserves the right to throttle or suspend your service.

API Usage Policy#

Wasabi’s free API request policy applies to the following use case: you store data in Wasabi, access it at a reasonable rate, and your use case does not impose an unreasonable burden on their service. To better understand what “reasonable rate” and “unreasonable burden” mean in this context, refer to the guidelines below.

• If you are using a commercial application that has been validated by Wasabi, you can generally expect to comply with Wasabi’s free API request policy.
• If you use an unvalidated application that causes inefficient and unreasonable load on the Wasabi service, they reserve the right to throttle or suspend your service.

If your usage frequently exceeds the guidelines of the free API request policy, Wasabi reserves the right to throttle or suspend your service.

Bucket Policies#

Below is a sample policy for publicly readable bucket content (premise: you must have already emailed Wasabi and had public access enabled on your account).

1
{
2
  "Version": "2012-10-17",
3
  "Statement": [
4
    {
5
      "Sid": "AllowPublicRead",
6
      "Effect": "Allow",
7
      "Principal": "*",
8
      "Action": "s3:GetObject",
9
      "Resource": "arn:aws:s3:::your-bucket-name/*"
10
    }
11
  ]
12
}

For details on how to restrict bucket access to specific IP addresses, see How to restrict access to a bucket to specific IP address?.

Below is an example bucket policy for this scenario. Be sure to replace the IP address from the documentation above with Cloudflare’s proxy IPs.

1
{
2
  "Id": "S3PolicyId1",
3
  "Version": "2012-10-17",
4
  "Statement": [
5
    {
6
      "Sid": "AllowRead",
7
      "Effect": "Allow",
8
      "Principal": {
9
        "AWS": "*"
10
      },
11
      "Action": "s3:GetObject",
12
      "Resource": [
13
        "arn:aws:s3:::bucket-name",
14
        "arn:aws:s3:::bucket-name/*"
15
      ]
16
    },
17
    {
18
      "Sid": "IPBasedNarrowFurther",
19
      "Effect": "Deny",
20
      "Principal": {
21
        "AWS": "*"
22
      },
23
      "Action": "s3:GetObject",
24
      "Resource": [
25
        "arn:aws:s3:::bucket-name",
26
        "arn:aws:s3:::bucket-name/*"
27
      ],
28
      "Condition": {
29
        "NotIpAddress": {
30
          "aws:SourceIp": "11.22.33.44/32"
31
        }
32
      }
33
    }
34
  ]
35
}

If you need more complex rules, you can use AWS’s policy generator:

https://awspolicygen.s3.amazonaws.com/policygen.html

CDN Configuration#

Here I’ll use Sharon CDN as an example. CDNs like Cloudflare are actually even simpler to set up.

Go to https://cdn.sharon.io/ and purchase a plan. It’s recommended to choose the JP region so your bucket region can simply be set to Tokyo.

After purchase, go to the dashboard and open the CDN panel.

Add a site.

Select your plan and enter the domain name you want to use for object storage. For the first setup, don’t enable HTTPS yet; first get the origin address, configure DNS, and then apply for an SSL certificate. Finally, enable HTTPS on the CDN side.

Configure the bucket as the origin. Refer to the “Wasabi Regions and Service URLs” section above. Set the protocol to HTTPS and port 443. For origin settings, follow the origin.

For Tokyo, the origin address is:

your-bucket-name.s3.ap-northeast-1.wasabisys.com

Set up DNS for your domain and complete the deployment.

Request a certificate.

Finally, go back to the CDN settings, select the certificate you just requested, and enable HTTPS caching.

Configure cache rules (you must do this) according to the types of content stored in your bucket.

At this point the CDN configuration is complete. You can upload an image to your object storage bucket for testing.

https://s3.ap-northeast-1.wasabisys.com/demo/avatar/mx74sampxehcwagjxa9wt402es7px9v6/1757255863397-ertg01phq4.webp

The URL above is the original public link from object storage.

What you want now is the new URL via CDN:

https://cdn.catcat.blog/avatar/mx74sampxehcwagjxa9wt402es7px9v6/1757255863397-ertg01phq4.webp

Check the request: if the Status Code is 304 and HIT, it means the cache was hit.

CNAME in the Console#

Test by visiting your domain.

Original address:

Cloudflare CDN address: