Object Storage (blob buckets) | CARTO Documentation

CARTO Self-Hosted requires object storage that you provide and manage in your own cloud account. Complete all steps on this page before deploying CARTO. See How CARTO uses Object Storage for background.

Supported providers

Provider

Service

Google Cloud

Cloud Storage (GCS)

Amazon Web Services

Amazon S3

Microsoft Azure

Azure Blob Storage

Required buckets

The bucket names shown in the Admin Console (Kots) and in customizations.yaml (Helm) differ. There are no naming constraints; use any names that comply with your cloud provider's rules.

Bucket

Required

Purpose

Temp Bucket

Yes

Upload and import datasets into CARTO

Assets Bucket

Yes

Store generated map thumbnails and customization assets

Export Bucket

Optional

Export data from your data warehouse

Export bucket provider: The export bucket must be created in the provider that matches your data warehouse:

Data Warehouse

Required Storage Provider

BigQuery

Google Cloud Storage

Snowflake

AWS S3

Redshift

AWS S3

Amazon RDS (PostgreSQL)

AWS S3

Oracle

AWS S3

Setting up your buckets

Select your cloud provider and follow the steps to create the buckets, configure CORS, and set up access permissions before deploying CARTO:

1. Create the buckets

Create the following buckets in GCS:

Temp Bucket (Kots) / Import Bucket (Helm)
Assets Bucket (Kots) / Thumbnails Bucket (Helm)
Export Bucket (optional, only if you plan to export data from your data warehouse)

Custom markers won't work unless the Assets / Thumbnails bucket is public.

2. Configure CORS

Temp/Import and Assets/Thumbnails buckets require CORS configured at the bucket level:

[
  {
    "origin": ["*"],
    "method": ["GET", "PUT", "POST"],
    "responseHeader": [
      "Content-Type",
      "Content-MD5",
      "Content-Disposition",
      "Cache-Control",
      "x-goog-content-length-range",
      "x-goog-meta-filename"
    ],
    "maxAgeSeconds": 3600
  }
]

How do I set up CORS? Check the GCS provider docs.

3. Configure access permissions

Ensure that the identity used to access your GCS buckets has read/write permissions on all of them. It should have the roles/storage.admin role over the buckets that will be used.

Provide the Project ID of the GCP project where your buckets are located. You will need this when configuring CARTO.

If you can't set up Service Account Keys due to security constraints, you can use keyless identity federation instead: Use Workload Identity in GCP.

1. Create the buckets

Create the following buckets in your AWS S3 account:

Temp Bucket (Kots) / Import Bucket (Helm)
Assets Bucket (Kots) / Thumbnails Bucket (Helm)
Export Bucket (optional, only if you plan to export data from your data warehouse)

When creating your S3 buckets:

ACLs must be enabled — CARTO sets public-read permissions on individual thumbnail objects.
If server-side encryption is enabled, the user must be granted permissions over the KMS key — see AWS documentation.

Custom markers won't work unless the Assets / Thumbnails bucket has ACLs enabled.

2. Configure CORS

Temp/Import and Assets/Thumbnails buckets require CORS configured at the bucket level:

[
  {
    "AllowedHeaders": [
      "Content-Type",
      "Content-MD5",
      "Content-Disposition",
      "Cache-Control"
    ],
    "AllowedMethods": ["PUT", "POST", "GET"],
    "AllowedOrigins": ["*"],
    "ExposeHeaders": [],
    "MaxAgeSeconds": 3600
  }
]

How do I set up CORS? Check the S3 provider docs.

3. Configure access permissions

Create an IAM user and generate a programmatic Access Key ID and Secret Access Key with read/write access permissions over the buckets. All buckets must be in the same AWS region.

If you can't set up Access Keys due to security constraints, you can use keyless identity federation instead: Use EKS Pod Identity in AWS.

1. Create the containers

Create the following containers in your Azure Blob storage account:

Temp Bucket (Kots) / Import Bucket (Helm)
Assets Bucket (Kots) / Thumbnails Bucket (Helm)
Export Bucket (optional, only if you plan to export data from your data warehouse)

Custom markers won't work unless the Assets / Thumbnails container is public.

2. Configure CORS

Temp/Import and Assets/Thumbnails containers require CORS configured at the storage account level:

[
  {
    "origin": ["*"],
    "method": ["GET", "PUT", "POST"],
    "responseHeader": [
      "Content-Type",
      "Content-MD5",
      "Content-Disposition",
      "Cache-Control",
      "Access-Control-Request-Headers",
      "X-MS-Blob-Type"
    ],
    "maxAgeSeconds": 3600
  }
]

How do I set up CORS? Check the Azure provider docs.

3. Configure access

Generate an Access Key from the storage account's Security properties. You will need this when configuring CARTO.

Supported providers

Required buckets

Setting up your buckets

1. Create the buckets

2. Configure CORS

3. Configure access permissions

1. Create the buckets

2. Configure CORS

3. Configure access permissions

1. Create the containers

2. Configure CORS

3. Configure access

Checklist