Provider examples

Use any service that accepts path-style S3 requests and AWS Signature Version 4.

AWS S3

Use the regional HTTPS endpoint, the bucket's region and a narrowly scoped IAM principal. Block public access at the account and bucket levels.

MinIO and self-hosted services

Use an HTTPS reverse proxy in production. Loopback HTTP is accepted for local development. Ensure the proxy preserves request paths and does not rewrite signed headers.

CORS

Trestle proxies authenticated downloads and uploads, so the bucket ordinarily needs no browser CORS policy. Add CORS only if a later signed-delivery mode deliberately exposes provider URLs.

Failure checks

Verify DNS, TLS trust, region, clock synchronization, bucket spelling and credentials. Provider errors are reduced to safe diagnostics; response bodies and secrets are not returned to the browser.