Creating an S3 storage device

• Decide how to provide S3 credentials to the Content Platform Engine.

  There are two options: static credentials with a secret key, or using a credentials manager. With static credentials you set the credentials manually, and with a credentials manager they are provided on the fly by a credentials manager that retrieves them from a source you define. Credentials managers are useful if you need to periodically change credentials. For more information about credential managers see Credentials Managers for Amazon S3 storage devices.

• If you choose to use static credentials for authentication, obtain credentials for connecting to the S3 object storage provider.

  To create an S3 storage device for IBM Cloud Object Store, you need to first create the HMAC credentials in IBM Cloud console. HMAC credentials consist of an Access Key and Secret Key paired for use with S3-compatible tools and libraries that require authentication. See the following IBM Cloud topic for more details: Using HMAC credentials

  When you view the user credentials, the following section represents the HMAC credential and includes the S3 access key ID and S3 secret access key you need to create the S3 advanced storage device:

  cos_hmac_keys:{
               access_key_id: 7exampledonotusea6440da12685eee02
               secret_access_key: 8not8ed850cddbece407exampledonotuse43r2d2586 
  }

• If you choose to use a credentials manager for authentication, create the credentials manager that will provide the credentials to the S3 storage device. See Setting up a credentials manager with an EC2 role and Setting up a credentials manager with a web identity provider
• Determine the device connection URL to the S3 storage.
• Create an S3 bucket where the Content Cortex content will be stored.
  Note: You are responsible for configuring the S3 bucket and its related attributes outside of Content Platform Engine. You must pursue any issues that are related to configuration and set-up with the storage vendor.
• If you want to specify a S3 storage class for the S3 storage device, you can use the JVM configuration parameter Content.S3.StorageClass.Value to specify the storage class. For example, you can set Content.S3.StorageClass.Value_{E8CCFED2-3B14-CFD4-8546-8E4925300000}=GLACIER_IR, where, the GUID is the object ID of the S3 storage device. When you configure the JVM parameter for the S3 storage device, all content that is uploaded to the S3 storage device is stored by using the GLACIER_IR storage class.

• The Content Platform Engine supports the use of the AWS S3 Intelligent-Tiering storage class for both S3 advanced storage devices and S3 fixed content devices. The S3 Intelligent-Tiering storage class optimizes storage costs by automatically moving data between access tiers based on changing access patterns.

  The Content Platform Engine supports only Frequent Access, Infrequent Access, and Archive Instant Access tiers. Do not activate the Archive Access and Deep Archive Access tiers in AWS when you use S3 Intelligent-Tiering storage class with Content Platform Engine.

  To use the S3 Intelligent-Tiering storage class with Content Platform Engine, you must set the JVM parameter as -DContent.S3.StorageClass.Value_{Device_ID}=INTELLIGENT_TIERING where, {Device_ID} is the object ID of the S3 advanced storage device or S3 fixed content device.

  Alternatively, you can achieve the same goal by creating a lifecycle management policy in AWS to move content between storage classes, allowing for more customized and flexible configuration options.

• Determine whether an SSL connection will be used between the Content Platform Engine and the S3 storage.

-Dhttps.protocols=TLSv1.2

• If your Content Platform Engine is running on WebSphere® Application Server, you must deploy the S3 client certificate directly in the WebSphere Application Server Administrative Console. For details, see Deploying a client certificate on WebSphere.
• If your Content Platform Engine is running on Oracle WebLogic Server, you can export the certificate from the region's host, for example, https://s3-us-west-1.amazonaws.com/, and then import the WebLogic JRE as a signer certificate.