Cloud Storage Guide — MyAdminDesk

This is an original planning guide. It is not a vendor manual, an official standard, or legal advice. Example addresses use documentation ranges. Review every command before you paste it.

A store has a shape and a reader

Storage on this desk is a choice among a disk attached to a machine, a shared file store, and an object store for files you address by name. The comparison tool helps you name the shape. The storage-class selector helps you sketch a class for an object store. Neither tool creates a bucket or a disk.

Public is a decision you write, and the default is no. A bucket or a share that the internet can list is the mistake, not a convenient way to hand a file to a colleague. A colleague gets a named identity. The world does not.

A class and a tier are cost decisions after you know how the files are read. You do not pick the cheapest class for files a person reads every hour, and you do not pick the hottest class for a dump you will not open. The cost guide can price the choice. This page records it.

Delete and versioning are a pair. If you might need the previous object, versioning or a copy comes before any delete. A lifecycle rule that deletes is a later ticket with a restore test, not a checkbox in the first hour.

One store, private, with a name you can say

Name the files. Are they a disk for one machine, a share for a few machines, or objects? Use the comparison with that sentence. Record the shape. One shape is enough.

If the shape is an object store, sketch a class with the selector and write who reads it. The name of the store should say the environment. A lab name is obviously a lab. You do not create it until the provider or the infrastructure guide has a window.

Write the access you will allow: one identity, one action you can say, such as read or write. If the draft grants anonymous read, remove it. Listing a whole store is not a feature you leave on.

Write where the backup copy will live, even if the backup guide owns the job. Replication inside one account is not a backup you have restored. Say that in the note so nobody treats a second region as a finished recovery.

# Storage note. Default is private.
# One shape: disk, share, or object.
# Anonymous list or read is a line you delete.
# A lifecycle delete waits for a restore test.
# example.com is not a bucket name you own.

A change you can finish

This window writes the shape and the access. Creating the store is later, in an account you administer.

Rollback of a plan is the previous paragraph. Rollback of a deleted object does not exist without a version or a copy you already have.

Name the files and who reads them.
Choose disk, share, or object.
If object storage, sketch a class and record it.
Write one identity and one action.
Remove anonymous access from any draft.
Write that a second copy is not yet a tested restore.
Leave create and lifecycle deletes for later tickets.

Mistakes that outlive the command

cloud storage fails in the same few ways. Each one looks finished on the day you type it. The list is here so the ticket can forbid them before the window, not so you can recognise them in an incident review.

A public list on a new store.
Anonymous read because a link was easier.
The cheapest class for files people read all day.
A lifecycle delete in the first hour.
Calling replication a tested backup.
Two shapes for one undecided set of files.
A bucket name you do not control.
A customer extract uploaded to learn the console.
A key in a file you meant to store.
Deleting the only copy to tidy a lab.

Decisions to write down before the window

One decision for cloud storage: The files and the reader are named. One shape is chosen. The store name shows the environment. Access is one identity and one action. Anonymous access is absent. The class matches how the files are read, or the class waits. No lifecycle delete is armed. Replication is not called a restore. No customer extract is the sample. No secret is stored as the sample file. Create waits for its own ticket. And the cost note can name this store.

The hour you stop

Write the account, the project or subscription, the region, and the clock time before you change anything for cloud storage. If this account is serving people and you do not have a way back, this hour is a plan. A plan you can read tomorrow is a success. A change you cannot undo is not.

Use a lab account, a lab project, or a lab subscription you administer. You do not point a CLI, a pipeline, or a browser tool at an account you do not run. The tools on this site run in the browser. They draft text. They do not log in, and they do not scan.

prompt-for-this is a reminder that a secret is missing. It is not an access key, a token, a password, or a kubeconfig you save. The real secret stays in the password store or the platform's secret store. If a file, a log, a ticket, or a pipeline still contains a live secret, stop and rotate it. Then delete the copy.

One change. A network, a virtual machine, a policy, and a pipeline do not share a window. If two things move and the outcome is wrong, you will not know which one did it. The rollback is the previous file, the previous plan, or the resource you can delete because it was only a lab.

A second person reads the scope aloud: which account, which region, which name. If they cannot find it in the ticket, the ticket is not ready. Silence is not agreement.

Documentation addresses stay in the note. 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24, and 2001:db8::/32 are not prefixes you type into a production network. example.com is not your zone. A generated file that opens 0.0.0.0/0 is a file you edit before it is applied. A source you can name is the rule you keep.

Do not apply a draft you have not read. A cost estimate, a policy, a manifest, and a Terraform plan are reading material. Apply, a resize of a live machine, and a delete of a bucket are later decisions with their own proof. Read the names. Then decide.

Keep the previous file. A generator draft is not the previous file. The previous file is what you put back if the new one is wrong. You practised the path back, including the serial console or a second admin, before you changed a network or a lockout setting.

If a step fails twice, stop. The failure is the result. Adding a command from a forum beside a half-applied stack produces an account nobody can explain. Rebuild the lab from the copy you kept.

When the checks pass, the next account waits until someone else can repeat the proof from the notes. cloud storage is done for this window when the proof is written, not when a CLI printed a success line.

This page is a planning guide. It is not a vendor manual, not an official standard, not legal advice, and not an audit opinion. If an auditor must see the decision, they see the ticket and the evidence, not this paragraph.

Hand the finished note to the neighbouring guide that owns the next step, and leave this account alone until that guide has its own window.

Storage checks before the store is created

Confirm this before you call the change done: The shape is one word the team shares. The reader is a named identity. A public flag is no. The class note matches the read pattern, or is blank on purpose. No delete rule is active. The sample files are invented. The account is one you administer. A backup sentence exists. The store was not created in this window. A second person can say who reads it. The name is not example.com. The ticket has no key. The hostname in the prompt matches the hostname in the ticket for cloud storage. The result line includes the time and the person, not only the command. You can point at the rollback value without searching a chat history. And done is a sentence a second person can repeat: the proof for cloud storage happened, and the next host is not started early. If one of those fails, stop.

Tools for this guide

These tools run in the browser on this site. They do not log into your machines.

Guides in this cluster

These supporting pages belong to this pillar.