Create static access key for Object Storage

Mint S3-compatible static key for a SA; note: secret shown once, capture it now

yc iam access-key create --service-account-name <name> --format json | jq -r '"AWS_ACCESS_KEY_ID=\(.access_key.key_id)\nAWS_SECRET_ACCESS_KEY=\(.secret)"'
tool
yc32 commands
tags
ycsecretssecurity

More yc commands

  • Use aws s3 against Yandex Object Storage
    aws --endpoint-url=https://storage.yandexcloud.net s3 sync ./dist s3://<name>/<id>/ --delete --exclude '*.map'

    Sync to YC bucket via S3 API; modern: use --delete to mirror and prune stale objects

  • List Object Storage buckets
    yc storage bucket list --format json | jq -r '.[] | "\(.name)\t\(.max_size/1073741824)GiB\t\(.default_storage_class)"'

    List buckets with size cap in GiB and storage class in one pass

  • Apply S3 lifecycle to expire old objects
    aws --endpoint-url=https://storage.yandexcloud.net s3api put-bucket-lifecycle-configuration --bucket <name> --lifecycle-configuration '{"Rules":[{"ID":"expire-logs","Status":"Enabled","Filter":{"Prefix":"logs/"},"Expiration":{"Days":30}}]}'

    Auto-expire objects under prefix after 30d to cut storage cost

  • Create registry and configure Docker
    yc container registry create --name <name> && yc container registry configure-docker

    Create CR and wire docker creds helper; modern: uses yc as a credential helper, no docker login

  • Push image to Container Registry
    docker tag <name>:<id> cr.yandex/$(yc container registry get --name <name> --format json | jq -r .id)/<name>:<id> && docker push cr.yandex/$(yc container registry get --name <name> --format json | jq -r .id)/<name>:<id>

    Tag with resolved registry id then push; avoids hardcoding the cr.yandex/<reg-id>

all 32 yc commands