Object storage is the durable layer that holds your originals, packaged renditions, thumbnails, and generated derivatives, addressed by an S3-compatible API. For an adult platform it is both the system of record for irreplaceable content and the private origin that the delivery tier pulls from.
This page covers the model and the controls that matter when the objects are sensitive and the request volume is high.
The bucket and key model
A bucket is a namespace; an object is a byte payload plus metadata identified by a key. Everything else — renditions, thumbnails, manifests, moderation artefacts — is just a key layout convention. A layout that scales separates concerns by prefix so that listing, lifecycle rules, and access policy can be scoped precisely:
originals/<content-id>/— the untouched upload, never served to viewers.renditions/<content-id>/<profile>/— packaged HLS/DASH or progressive output.thumbs/<content-id>/— images and sprite sheets for the catalogue.moderation/<content-id>/— classification output and review artefacts.
Keep keys immutable. Versioning or content-addressed keys let you replace a rendition without breaking caches or invalidating signed URLs that point at the old object.
Keep originals private
The single most important rule: originals must never be publicly readable. They are the source of truth, they may contain embedded metadata you do not want exposed, and they are what you re-derive from after a policy change or takedown. Serve only packaged derivatives, and only through the delivery tier, with the bucket itself restricted to edge and pipeline identities.
If a bucket is reachable from the public internet, every cache, token, and geo control you built at the edge can be bypassed by requesting the origin directly.
Access keys and least privilege
Use separate credentials per function, never one global key:
- Ingest writes to
originals/and cannot read renditions. - Transcode reads originals and writes renditions.
- Delivery reads only packaged prefixes and thumbnails.
- Moderation reads and writes only its own prefix.
Scope each key to the narrowest prefix and action set, rotate them on a schedule, and prefer short-lived credentials where the platform supports assuming a role rather than holding a long-lived secret.
Presigned URLs
A presigned URL grants time-limited access to one object without exposing a key. Use them for:
- Direct browser or app uploads into a quarantine prefix, so bytes never transit your API.
- Time-boxed downloads of a private original for an internal reviewer.
- Short-lived access to a single derivative when a full token-gated delivery path is not warranted.
Keep the expiry as short as the workflow allows, bind the URL to one key and one method, and treat a leaked presigned URL as a leaked object until it expires.
Malware scanning and upload hygiene
User-generated uploads are hostile input. Scan every object before it can be published, and structure the pipeline so scanning is unavoidable:
- Upload lands in a
quarantine/prefix via a presigned URL. - A scanner inspects it; the result is recorded as object metadata or a sidecar record.
- Only objects that pass are promoted into
originals/and scheduled for transcode. - Objects that fail are retained for review or deleted per policy.
Validate content type by inspecting bytes, not the client-supplied header, cap object size, and strip or preserve embedded metadata deliberately — some containers carry geolocation or device identifiers.
Quotas and capacity
Set quotas per bucket and per tenant so one runaway pipeline cannot exhaust shared capacity. Track stored bytes, object count, and request rates separately, because they scale differently: a thumbnail-heavy catalogue can explode object count while consuming modest bytes. Alert on growth rate, not just absolute usage, and treat lifecycle transitions as the main lever for controlling stored cost.
Where AdultInfra fits
AdultInfra treats object storage as the private origin behind delivery and AI pipelines, with prefix-scoped credentials, quarantine-and-scan ingest, and lifecycle rules tuned for adult catalogues. If you are consolidating scattered buckets or locking down public originals, start with the platform overview and bring one content prefix.