Skip to main content
Keep an AWS S3 client unchanged while Cloud Adapter translates supported requests to Google Cloud Storage. This quickstart writes one object through the S3 API, verifies it natively in Google Cloud, exercises a translated not-found response, and removes the test object.
AWS API requests pass through Tensor9 Cloud Adapter to Google Cloud services.AWS API requests pass through Tensor9 Cloud Adapter to Google Cloud services.

​
What you will prove

This test does not migrate existing objects, versions, bucket policies, or signed links.

​
Before you begin

You need an installed AWS-origin Cloud Adapter endpoint, a configured S3 to Cloud Storage service adapter, an origin-side test identity, a Google Cloud runtime identity with access to one test bucket, AWS CLI v2, and gcloud for native verification. Review S3 on Google Cloud. The core object lifecycle is supported. Multipart upload is composed through temporary objects; ListMultipartUploads and UploadPartCopy are outside this target profile. Bucket policy, ACL, retention, and legal-hold behavior are not provided by this object endpoint.

​
Set test values

Use the origin-facing bucket name in AWS commands and the native bucket name in Google Cloud commands. They may differ. AWS_REQUEST_CHECKSUM_CALCULATION=WHEN_REQUIRED keeps this smoke test on the required S3 checksum path. Validate optional flexible-checksum behavior separately if your application enables it. The commands below use an explicit --endpoint-url. To route every S3 client in the process instead, set AWS_ENDPOINT_URL_S3="$T9_CLOUD_ADAPTER_ENDPOINT" and omit the command-level override.

​
Verify target access first

Confirm that your verification identity can see the target bucket without using Cloud Adapter:
This is a read-only verification identity. The adapter’s runtime identity is configured separately and should have only the target permissions needed by the mapped operations.

​
Write through the S3 API

Keep the ETag and command timestamp from the response. The normal AWS CLI output does not expose arbitrary response headers; use an SDK with structured, redacted response metadata when a support workflow requires them. Do not log authorization headers or request bodies.

​
Read it through both sides

The S3 ETag and Cloud Storage generation are not interchangeable identifiers. Use each API’s returned identity in its own context.

​
Exercise the error mapping

Expect an AWS-shaped not-found error. S3 can return permission denied instead when the caller lacks permission to establish that the object is missing. First separate that origin-side authorization case from the adapter’s Google Cloud backend permission. If the request times out, inspect Cloud Storage before retrying a mutation.

​
Clean up

The final describe should report that the current object is no longer readable. Versioned or soft-delete-enabled targets can retain prior versions or recovery state; use an unversioned disposable target for this quickstart or remove the created version explicitly. Remove only the files and object created by this test; retain the shared bucket unless its owner authorizes deletion.

​
Before production traffic

Inventory the application’s S3 operations, conditional headers, pagination, metadata, multipart behavior, versioning, and retry policy. Test each documented operation with representative sizes. Plan data migration separately because a new target bucket starts empty. Establish target quotas, lifecycle policy, observability, backup, and an uncertain-write procedure. Next, read the complete S3 target profile, then add the lifecycle to CI/CD.