The cloud_object_storage service has 5 resource kinds, each listed below with its endpoints, fields, and dependencies. Values resolve late, so you reference another resource with ${kind.ref_name}. For defaults, validation rules, and examples, run wxctl explain <kind>.
  • Envelope: A config is one or more YAML documents separated by ---. Each has top-level kind and ref_name, then the fields below at the top level (not nested under spec).
  • ref_name: Unique handle for this resource within the config. Used to reference it from other resources, then stripped before the API call (not a schema field).
  • References: Reference another resource by its ref_name: ${<kind>.<ref_name>} resolves to its id, ${<kind>.<ref_name>.<field>} to a specific field. Values resolve late, at plan/apply time.

​
adls_container

Azure Data Lake Storage container (Gen1 or Gen2). Runs on SaaS · ID field filesystem Endpoints
OperationMethodPath
CreatePOST/adls/{filesystem}
ReadGET/adls/{filesystem}
DeleteDELETE/adls/{filesystem}
Fields
FieldTypeRequiredDescription
connectionstringRequiredReference to a storage_connection of type: adls_gen1 or adls_gen2. Carries auth credentials.
filesystemstringOptionalADLS Gen2 filesystem (container) name. Required when the linked connection’s type: adls_gen2; ignored for Gen1.
data_lake_store_namestringOptionalADLS Gen1 store name. Required when the linked connection’s type: adls_gen1; ignored for Gen2.
pathstringOptionalOptional sub-path inside the filesystem / store. Mutable.
Depends on
  • connection → storage_connection (required)
Consumers
  • storage_registration → .bucket (optional)

​
gcs_bucket

Google Cloud Storage bucket. Runs on SaaS · ID field name Endpoints
OperationMethodPath
CreatePOST/gcs/{name}
ReadGET/gcs/{name}
DeleteDELETE/gcs/{name}
Fields
FieldTypeRequiredDescription
connectionstringRequiredReference to a storage_connection of type: google_cs.
namestringRequired
locationstringRequired
storage_classstringOptional
Computed outputs: endpoint. Depends on
  • connection → storage_connection (required)
Consumers
  • storage_registration → .bucket (optional)

​
s3_bucket

S3-compatible bucket (IBM COS, AWS S3, MinIO, Ceph). Runs on SaaS + Software · ID field name Endpoints
OperationMethodPath
CreatePOST/cos/{name}
ReadGET/cos/{name}
UpdatePUT/cos/{name}
DeleteDELETE/cos/{name}
Fields
FieldTypeRequiredDescription
connectionstringRequiredReference to a storage_connection supplying credentials. The connection’s type: drives bucket behaviour (LocationConstraint, storage-class validation, endpoint derivation). Immutable, credential rotation happens on the connection; changing which connection backs a bucket would move its ownership.
namestringRequiredBucket name, globally unique in the backing account’s namespace. Immutable.
regionstringRequiredBacking region. Used to derive the regional S3 endpoint and the LocationConstraint value on bucket CREATE.
storage_classstringOptionalStorage class. Enum validation varies by the linked storage_connection.type, cross-resource validator WXCTL-V503. For ibm_cos: [standard, vault, cold, smart, onerate_active]. For aws_s3/amazon_s3/s3: AWS classes (STANDARD, STANDARD_IA, ONEZONE_IA, GLACIER, DEEP_ARCHIVE, INTELLIGENT_TIERING). For minio/ibm_ceph: free-form.
tagsarray<string>OptionalBucket tags (max 10, per S3 limit). Mutable via PUT ?tagging; other fields are immutable.
force_destroybooleanOptionalWhen true, DELETE paginates ListObjectsV2 + DeleteObjects before removing the bucket. Safety cap at 10,000 objects.
Computed outputs: endpoint, bucket_location. Depends on
  • connection → storage_connection (required)
Consumers
  • ingestion_job → .source.file_paths (optional)
  • s3_object → .bucket (required)
  • s3_object → .region (required)
  • spark_engine → .associated_catalogs (optional)
  • storage_registration → .bucket (required)

​
s3_object

An object inside an s3_bucket. Runs on SaaS + Software · ID field key Endpoints
OperationMethodPath
CreatePOST/cos/{bucket}/{key}
ReadGET/cos/{bucket}/{key}
UpdatePUT/cos/{bucket}/{key}
DeleteDELETE/cos/{bucket}/{key}
Fields
FieldTypeRequiredDescription
bucketstringRequired
regionstringRequiredBacking region of the containing bucket. Typically populated via ${s3_bucket.<ref>.region} so the object follows the bucket’s region.
keystringRequiredObject key. S3 limit is 1024 UTF-8 bytes, not characters, multibyte keys are measured post-encoding.
contentstringOptionalInline literal content. Exactly one of content or path must be set (WXCTL-V501).
pathstringOptionalLocal filesystem path, resolved relative to CWD. The file must exist at apply time. Files larger than 100 MB are rejected without being opened.
content_typestringOptionalMIME type. Auto-detected from the key extension when omitted; falls back to application/octet-stream.
metadataobjectOptionalUser metadata sent as x-amz-meta-* headers. The handler automatically adds x-amz-meta-wxctl-sha256 holding the streaming SHA-256 of the body for drift detection.
Computed outputs: etag. Depends on
  • bucket → s3_bucket (required)
  • region → s3_bucket (required)
Consumers
  • ingestion_job → .source.file_paths (optional)

​
storage_connection

Credential-holding kind for object-store / file-system backends. Runs on SaaS + Software · ID field ref_name Endpoints
OperationMethodPath
CreatePOST/local/storage_connections
ReadGET/local/storage_connections/{ref_name}
DeleteDELETE/local/storage_connections/{ref_name}
Fields
FieldTypeRequiredDescription
typestringRequiredStorage backend family. Drives the active variant, fields outside the active variant emit WXCTL-V401 (warn) at validation; unknown values likewise emit WXCTL-V401 rather than blocking (the API catalog grows faster than this list).
Consumers
  • adls_container → .connection (required)
  • gcs_bucket → .connection (required)
  • s3_bucket → .connection (required)