Storage ownership and cost
With bring your own storage, file bytes stay in the connected customer bucket while Astral manages transfer metadata, policy, and audit. The customer remains responsible for provider storage, request, egress, retention, and recovery costs.
Use short-lived credentials
Configure a dedicated role or service identity limited to the approved bucket and prefix. Astral resolves the referenced credential at runtime and does not place long-lived secrets in connection records.
- Deny public bucket access.
- Restrict object operations to the tenant prefix.
- Keep credential lifetimes short and rotate the underlying trust relationship.
- Do not reuse a human administrator key.
Validate before using the connection
- Create the storage connection with its provider, region, bucket, and allowed prefix.
- Run the built-in health check.
- Verify upload, download, and deletion against a non-production test object.
- Only then assign the connection to production transfers.