Integration guides

Connect OVHcloud Object Storage

Detectant supports current-generation regional OVHcloud S3 Object Storage through the regional .io endpoint. Local Zones, legacy Swift-S3 endpoints and .perf endpoints are not supported.

Before you connect

  1. Create a dedicated Object Storage user in the OVHcloud project that owns the bucket.
  2. Add the dedicated Detectant user to the S3 container with the Read-only role.
  3. Create S3 credentials for that user. Do not use an Administrator account.
  4. Note the bucket’s region. Detectant derives the endpoint and signing region and always uses path-style requests.

The supported regions are gra, rbx, sbg, eu-west-par, eu-south-mil, de, uk, waw, bhs, ca-east-tor, sgp, ap-southeast-syd and ap-south-mum.

Connect the bucket

In Dashboard → Integrations, choose Add integration, select OVHcloud, then enter the region, bucket, optional prefix and dedicated user’s access key ID and secret access key.

Choose New files only to baseline existing objects without scanning them. Choose Existing and new files to preview the eligible existing-object count and remaining monthly allowance. Existing objects are not released for scanning until you confirm the preview. Objects beyond the current allowance remain queued until the next billing period; Detectant does not rediscover or enqueue them repeatedly.

Credentials are encrypted and never returned. Replacing credentials verifies the new credentials before deleting the old encrypted credential and schedules an immediate poll.

Polling health

  • Baselining: Detectant is building the initial inventory.
  • Healthy: The baseline or latest check completed. The dashboard shows the last checked time and next scheduled check.
  • Checks currently run every five minutes. A check with no new or changed objects does not create a scan.
  • Temporary failure: A provider or network request failed. The dashboard keeps the last successful check visible and shows the failed attempt and retry schedule separately.
  • Credentials rejected: Replace revoked, incorrect or insufficient credentials.
  • Object limit exceeded: The configured scope exceeds the first-release limit of 100,000 listed entries. Use a narrower prefix or bucket.
  • Allowance paused: Queued scans resume at the next billing-period boundary without downloading object content first.

Storage classes and versions

Detectant reads the current object revision only and treats ETags as opaque. Standard, High Performance and other immediately readable objects follow the normal read path. Archived objects are never restored automatically. Restore them in OVHcloud before scanning; an unavailable archived object is recorded as restore required. Access and decryption failures are recorded separately.

Troubleshooting

  • Confirm the bucket is in the selected region and is reachable through https://s3.<region>.io.cloud.ovh.net.
  • Confirm the dedicated user can list the configured bucket/prefix and read at least one object in that scope.
  • If setup succeeds for an empty scope but later reports rejected credentials, verify object-read permission for newly added objects.
  • For dotted bucket names, keep the OVHcloud preset selected; Detectant’s fixed path-style addressing avoids TLS hostname ambiguity.
  • After credential rotation, use Replace credentials rather than deleting the integration. Detectant verifies the replacement and polls immediately.