> For the complete documentation index, see [llms.txt](https://docs.carto.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.carto.com/carto-self-hosted/planning/prerequisites/object-storage.md).

# Object Storage (blob buckets)

CARTO Self-Hosted requires object storage that **you provide and manage** in your own cloud account. Complete all steps on this page before deploying CARTO. See [How CARTO uses Object Storage](/carto-self-hosted/concepts/object-storage.md) for background.

## Supported providers

| Provider            | Service             |
| ------------------- | ------------------- |
| Google Cloud        | Cloud Storage (GCS) |
| Amazon Web Services | Amazon S3           |
| Microsoft Azure     | Azure Blob Storage  |

## Required buckets

The bucket names shown in the Admin Console (Kots) and in `customizations.yaml` (Helm) differ. There are no naming constraints; use any names that comply with your cloud provider's rules.

{% tabs %}
{% tab title="☸️ Kots (Admin Console)" %}

| Bucket            | Required | Purpose                                                 |
| ----------------- | -------- | ------------------------------------------------------- |
| **Temp Bucket**   | Yes      | Upload and import datasets into CARTO                   |
| **Assets Bucket** | Yes      | Store generated map thumbnails and customization assets |
| **Export Bucket** | Optional | Export data from your data warehouse                    |
| {% endtab %}      |          |                                                         |

{% tab title="🛞 Helm (customizations.yaml)" %}

| Bucket                | Required | Config key                                                   | Purpose                                                 |
| --------------------- | -------- | ------------------------------------------------------------ | ------------------------------------------------------- |
| **Import Bucket**     | Yes      | `workspaceImportsBucket`                                     | Upload and import datasets into CARTO                   |
| **Thumbnails Bucket** | Yes      | `workspaceThumbnailsBucket`                                  | Store generated map thumbnails and customization assets |
| **Export Bucket**     | Optional | `workspaceExportsBucket` (BigQuery) / `awsExportBucket` (S3) | Export data from your data warehouse                    |
| {% endtab %}          |          |                                                              |                                                         |
| {% endtabs %}         |          |                                                              |                                                         |

**Export bucket provider:** The export bucket must be created in the provider that matches your data warehouse:

| Data Warehouse              | Required Storage Provider |
| --------------------------- | ------------------------- |
| **BigQuery**                | Google Cloud Storage      |
| **Snowflake**               | AWS S3                    |
| **Redshift**                | AWS S3                    |
| **Amazon RDS (PostgreSQL)** | AWS S3                    |
| **Oracle**                  | AWS S3                    |

***

## Setting up your buckets

Select your cloud provider and follow the steps to create the buckets, configure CORS, and set up access permissions before deploying CARTO:

{% tabs %}
{% tab title="Google Cloud Storage" %}

### 1. Create the buckets

Create the following buckets in GCS:

1. **Temp Bucket** (Kots) / **Import Bucket** (Helm)
2. **Assets Bucket** (Kots) / **Thumbnails Bucket** (Helm)
3. **Export Bucket** (optional, only if you plan to export data from your data warehouse)

{% hint style="info" %}
Custom markers won't work unless the Assets / Thumbnails bucket is public.
{% endhint %}

### 2. Configure CORS

Temp/Import and Assets/Thumbnails buckets require CORS configured at the **bucket level**:

```json
[
  {
    "origin": ["*"],
    "method": ["GET", "PUT", "POST"],
    "responseHeader": [
      "Content-Type",
      "Content-MD5",
      "Content-Disposition",
      "Cache-Control",
      "x-goog-content-length-range",
      "x-goog-meta-filename"
    ],
    "maxAgeSeconds": 3600
  }
]
```

{% hint style="info" %}
How do I set up CORS? Check the [GCS provider docs](https://cloud.google.com/storage/docs/using-cors).
{% endhint %}

### 3. Configure access permissions

Ensure that the identity used to access your GCS buckets has read/write permissions on all of them. It should have the `roles/storage.admin` role over the buckets that will be used.

Provide the **Project ID** of the GCP project where your buckets are located. You will need this when configuring CARTO.

{% hint style="info" %}
If you can't set up Service Account Keys due to security constraints, you can use keyless identity federation instead: [Use Workload Identity in GCP](/carto-self-hosted/configuration/security/cloud-identities/use-workload-identity-in-gcp.md).
{% endhint %}
{% endtab %}

{% tab title="AWS S3" %}

### 1. Create the buckets

Create the following buckets in your AWS S3 account:

1. **Temp Bucket** (Kots) / **Import Bucket** (Helm)
2. **Assets Bucket** (Kots) / **Thumbnails Bucket** (Helm)
3. **Export Bucket** (optional, only if you plan to export data from your data warehouse)

{% hint style="danger" %}
When creating your S3 buckets:

* **ACLs must be enabled** — CARTO sets `public-read` permissions on individual thumbnail objects.
* If server-side encryption is enabled, the user must be granted permissions over the KMS key — see [AWS documentation](https://repost.aws/knowledge-center/s3-bucket-access-default-encryption).
  {% endhint %}

{% hint style="info" %}
Custom markers won't work unless the Assets / Thumbnails bucket has ACLs enabled.
{% endhint %}

### 2. Configure CORS

Temp/Import and Assets/Thumbnails buckets require CORS configured at the **bucket level**:

```json
[
  {
    "AllowedHeaders": [
      "Content-Type",
      "Content-MD5",
      "Content-Disposition",
      "Cache-Control"
    ],
    "AllowedMethods": ["PUT", "POST", "GET"],
    "AllowedOrigins": ["*"],
    "ExposeHeaders": [],
    "MaxAgeSeconds": 3600
  }
]
```

{% hint style="info" %}
How do I set up CORS? Check the [S3 provider docs](https://docs.aws.amazon.com/AmazonS3/latest/userguide/enabling-cors-examples.html).
{% endhint %}

### 3. Configure access permissions

Create an IAM user and generate a programmatic **Access Key ID** and **Secret Access Key** with read/write access permissions over the buckets. All buckets must be in the **same AWS region**.

{% hint style="info" %}
If you can't set up Access Keys due to security constraints, you can use keyless identity federation instead: [Use EKS Pod Identity in AWS](/carto-self-hosted/configuration/security/cloud-identities/use-eks-pod-identity-in-aws.md).
{% endhint %}
{% endtab %}

{% tab title="Azure Blob Storage" %}

### 1. Create the containers

Create the following containers in your Azure Blob storage account:

1. **Temp Bucket** (Kots) / **Import Bucket** (Helm)
2. **Assets Bucket** (Kots) / **Thumbnails Bucket** (Helm)
3. **Export Bucket** (optional, only if you plan to export data from your data warehouse)

{% hint style="info" %}
Custom markers won't work unless the Assets / Thumbnails container is public.
{% endhint %}

### 2. Configure CORS

Temp/Import and Assets/Thumbnails containers require CORS configured at the **storage account level**:

```json
[
  {
    "origin": ["*"],
    "method": ["GET", "PUT", "POST"],
    "responseHeader": [
      "Content-Type",
      "Content-MD5",
      "Content-Disposition",
      "Cache-Control",
      "Access-Control-Request-Headers",
      "X-MS-Blob-Type"
    ],
    "maxAgeSeconds": 3600
  }
]
```

{% hint style="info" %}
How do I set up CORS? Check the [Azure provider docs](https://learn.microsoft.com/en-us/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services#enabling-cors-for-azure-storage).
{% endhint %}

### 3. Configure access

Generate an **Access Key** from the storage account's Security properties. You will need this when configuring CARTO.
{% endtab %}
{% endtabs %}

***

## Checklist

{% tabs %}
{% tab title="☸️ Kots (Admin Console)" %}

* [ ] **Temp Bucket** created
* [ ] **Assets Bucket** created
* [ ] **Export Bucket** created (only if you'll export data)
* [ ] CORS applied to Temp and Assets buckets
* [ ] CARTO has read/write access to all buckets
* [ ] Bucket names and credentials are ready to enter in the Admin Console
  {% endtab %}

{% tab title="🛞 Helm (customizations.yaml)" %}

* [ ] **Import Bucket** created (`workspaceImportsBucket`)
* [ ] **Thumbnails Bucket** created (`workspaceThumbnailsBucket`)
* [ ] **Export Bucket** created (only if you'll export data)
* [ ] CORS applied to Import and Thumbnails buckets
* [ ] CARTO has read/write access to all buckets
* [ ] Bucket names and credentials are ready to add to `customizations.yaml`
  {% endtab %}
  {% endtabs %}

Once your buckets are ready, configure CARTO to use them in [Configure your own buckets](/carto-self-hosted/configuration/data-and-storage/configure-your-own-buckets.md).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.carto.com/carto-self-hosted/planning/prerequisites/object-storage.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.