[{"data":1,"prerenderedAt":535},["ShallowReactive",2],{"post-\u002Fblog\u002Fs3-in-2027-egress-bill-changes":3,"blog-index":452},{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"date":10,"author":11,"tags":12,"guide":17,"related":18,"body":21,"_type":446,"_id":447,"_source":448,"_file":449,"_stem":450,"_extension":451},"\u002Fblog\u002Fs3-in-2027-egress-bill-changes","blog",false,"","S3 in 2027: the egress bill changes on 12 January","The EU Data Act removes switching fees in January 2027 — but not everyday egress. The five things you need to know about your buckets before that date.","2026-11-08","Clement Baranger",[13,14,15,16],"s3","pricing","governance","cloud","s3-storage-pricing-comparison",[19,20],"s3-total-cost-of-ownership","multipart-5mb-floor-10000-parts",{"type":22,"children":23,"toc":432},"root",[24,32,37,44,95,104,110,117,129,141,146,152,171,176,182,187,192,198,217,223,228,238,248,258,264,269,277,287,292,310,320,361,371,377,382,415,420,424],{"type":25,"tag":26,"props":27,"children":28},"element","p",{},[29],{"type":30,"value":31},"text","Search for \"S3 2027\" and five of the first eight results are a car. The rest are\ntrend pieces about GPUs and vector databases. Nobody is writing about the thing\nthat actually has a date attached to it: on 12 January 2027, the EU Data Act makes\nit illegal to charge an EU customer for the egress involved in leaving.",{"type":25,"tag":26,"props":33,"children":34},{},[35],{"type":30,"value":36},"That is not a forecast. It is a paragraph in a regulation, and it lands harder on\nobject storage than on any other part of a cloud bill, because object storage is\nthe part nobody has a complete inventory of.",{"type":25,"tag":38,"props":39,"children":41},"h2",{"id":40},"the-short-version",[42],{"type":30,"value":43},"The short version",{"type":25,"tag":45,"props":46,"children":47},"ul",{},[48,60,78,90],{"type":25,"tag":49,"props":50,"children":51},"li",{},[52,58],{"type":25,"tag":53,"props":54,"children":55},"strong",{},[56],{"type":30,"value":57},"12 January 2027",{"type":30,"value":59}," — Article 29 of the EU Data Act (Regulation 2023\u002F2854) takes\nfull effect: no switching fees, egress included, when an EU customer moves to\nanother provider or back on-premises.",{"type":25,"tag":49,"props":61,"children":62},{},[63,68,70,76],{"type":25,"tag":53,"props":64,"children":65},{},[66],{"type":30,"value":67},"Everyday egress is still billed.",{"type":30,"value":69}," The ban covers the export you do ",{"type":25,"tag":71,"props":72,"children":73},"em",{},[74],{"type":30,"value":75},"to\nleave",{"type":30,"value":77},". Ordinary traffic, cross-region reads and CDN pulls stay chargeable.",{"type":25,"tag":49,"props":79,"children":80},{},[81,83,88],{"type":30,"value":82},"The financial lock-in weakens. The ",{"type":25,"tag":53,"props":84,"children":85},{},[86],{"type":30,"value":87},"technical",{"type":30,"value":89}," lock-in does not: someone still\nhas to enumerate what is in the buckets, who can read it, and what it costs.",{"type":25,"tag":49,"props":91,"children":92},{},[93],{"type":30,"value":94},"Three of the five items below are things you cannot learn from a bucket\nlisting — and that is the actual 2027 problem.",{"type":25,"tag":26,"props":96,"children":97},{},[98],{"type":25,"tag":99,"props":100,"children":103},"img",{"alt":101,"src":102},"Timeline of the three EU dates — switching charges capped at cost since September 2025, switching egress banned on 12 January 2027 while ordinary egress stays billable, and the Cyber Resilience Act fully applicable on 11 December 2027 — with the three inventory commands a migration plan needs","\u002Fdiagrams\u002Fs3-in-2027-egress-bill-changes.svg",[],{"type":25,"tag":38,"props":105,"children":107},{"id":106},"what-actually-happens",[108],{"type":30,"value":109},"What actually happens",{"type":25,"tag":111,"props":112,"children":114},"h3",{"id":113},"the-date-precisely",[115],{"type":30,"value":116},"The date, precisely",{"type":25,"tag":26,"props":118,"children":119},{},[120,122,127],{"type":30,"value":121},"The Data Act entered into force in January 2024 and became applicable on\n12 September 2025. Chapter VI (Articles 23 to 31) targets cloud lock-in. Since\nthat September date, providers can only charge ",{"type":25,"tag":71,"props":123,"children":124},{},[125],{"type":30,"value":126},"at cost",{"type":30,"value":128}," for switching, customer\nnotice periods are capped at two months, and a 30-day transition window is\nmandatory. From 12 January 2027, the switching charge itself is gone.",{"type":25,"tag":26,"props":130,"children":131},{},[132,134,139],{"type":30,"value":133},"Read the scope carefully, because most vendor summaries do not: the ban applies to\ndata egress and administrative penalties incurred ",{"type":25,"tag":53,"props":135,"children":136},{},[137],{"type":30,"value":138},"when switching or running in\nparallel across providers",{"type":30,"value":140},". It does not abolish fixed-term commitments, and it\ndoes not touch the egress you generate in normal operation. AWS had already\ndropped exit fees in March 2024, before the rules required it; the regulation\nturns a courtesy into an obligation for everyone.",{"type":25,"tag":26,"props":142,"children":143},{},[144],{"type":30,"value":145},"The practical consequence: leaving becomes a technical project with no invoice\nattached, instead of a technical project with a penalty attached. That is a much\nbetter problem, and a much more honest one.",{"type":25,"tag":111,"props":147,"children":149},{"id":148},"the-scale-you-are-working-at",[150],{"type":30,"value":151},"The scale you are working at",{"type":25,"tag":26,"props":153,"children":154},{},[155,157,162,164,169],{"type":30,"value":156},"In December 2025 AWS reported S3 passing ",{"type":25,"tag":53,"props":158,"children":159},{},[160],{"type":30,"value":161},"500 trillion objects",{"type":30,"value":163},", and raised the\nmaximum single object to ",{"type":25,"tag":53,"props":165,"children":166},{},[167],{"type":30,"value":168},"50 TB",{"type":30,"value":170},". Both numbers matter for the same reason: at\nthat size, the debris is not debris. An abandoned multipart upload of a 50 TB\nobject keeps its parts — billed as storage, invisible in a listing — until someone\naborts it.",{"type":25,"tag":26,"props":172,"children":173},{},[174],{"type":30,"value":175},"This is not an edge case. Large uploads are the ones that get interrupted: a\nlaptop closes, a CI job is cancelled, a network drops at hour six. The parts stay.",{"type":25,"tag":111,"props":177,"children":179},{"id":178},"the-new-client-is-not-a-person",[180],{"type":30,"value":181},"The new client is not a person",{"type":25,"tag":26,"props":183,"children":184},{},[185],{"type":30,"value":186},"S3 stopped being a place where a human browses files. With S3 Vectors generally\navailable in December 2025 — two billion vectors per index — a bucket is now a\nretrieval layer behind a model, written and read by code that has no idea what a\nfolder is.",{"type":25,"tag":26,"props":188,"children":189},{},[190],{"type":30,"value":191},"That changes what a credential means. A presigned URL handed to an agent is a\ncapability with a timer, and the timer is the security control. Which is why the\nrclone advisory of October 2026 is worth reading twice: a presigned PUT URL could\nread any bucket in the account, fixed in 1.75.2. The client was doing what clients\ndo — trusting the URL it was given.",{"type":25,"tag":111,"props":193,"children":195},{"id":194},"the-exposure-is-not-theoretical",[196],{"type":30,"value":197},"The exposure is not theoretical",{"type":25,"tag":26,"props":199,"children":200},{},[201,203,208,210,215],{"type":30,"value":202},"The Cloud Exposure Index counted ",{"type":25,"tag":53,"props":204,"children":205},{},[206],{"type":30,"value":207},"484,142 public buckets",{"type":30,"value":209}," and 18.05 billion\nfiles in October 2026, 71.9% of them on S3. Tenable's analysis found sensitive\ndata in ",{"type":25,"tag":53,"props":211,"children":212},{},[213],{"type":30,"value":214},"16.7% of AWS buckets",{"type":30,"value":216}," it sampled. Very little of that was a deliberate\ndecision to publish; most of it was a policy nobody re-read after a migration.",{"type":25,"tag":38,"props":218,"children":220},{"id":219},"where-it-bites",[221],{"type":30,"value":222},"Where it bites",{"type":25,"tag":26,"props":224,"children":225},{},[226],{"type":30,"value":227},"Three failures, in the order they will find you.",{"type":25,"tag":26,"props":229,"children":230},{},[231,236],{"type":25,"tag":53,"props":232,"children":233},{},[234],{"type":30,"value":235},"1. You cannot renegotiate what you cannot enumerate.",{"type":30,"value":237}," A migration plan needs\nper-bucket size, object count, version count, incomplete uploads, and where the\negress actually goes. The console shows objects. It does not show the uploads that\nnever became objects, the non-current versions still billed, or which bucket is\nresponsible for the egress line.",{"type":25,"tag":26,"props":239,"children":240},{},[241,246],{"type":25,"tag":53,"props":242,"children":243},{},[244],{"type":30,"value":245},"2. You cannot prove who signed what.",{"type":30,"value":247}," After an incident, \"an agent with the\nwrong key\" is not an answer. Which key, which session, which endpoint, which\ntimestamp — the controls that produce those answers (ABAC on object tags, short\npresigned lifetimes, session-scoped credentials) are all configuration you have to\nwrite down.",{"type":25,"tag":26,"props":249,"children":250},{},[251,256],{"type":25,"tag":53,"props":252,"children":253},{},[254],{"type":30,"value":255},"3. \"S3-compatible\" is a claim, not a specification.",{"type":30,"value":257}," The moment leaving becomes\nfree, the second provider stops being hypothetical. That is when checksum headers\n(CRC64NVME is now the SDK default) start failing against older gateways,\npath-style addressing reappears, and a provider's \"compatible\" turns out to mean\n\"compatible with what our SDK did in 2023\".",{"type":25,"tag":38,"props":259,"children":261},{"id":260},"doing-it-right",[262],{"type":30,"value":263},"Doing it right",{"type":25,"tag":26,"props":265,"children":266},{},[267],{"type":30,"value":268},"A checklist you can run this week, not in December 2027.",{"type":25,"tag":26,"props":270,"children":271},{},[272],{"type":25,"tag":53,"props":273,"children":274},{},[275],{"type":30,"value":276},"Inventory, per bucket, and keep the output.",{"type":25,"tag":278,"props":279,"children":281},"pre",{"code":280},"aws s3api list-multipart-uploads --bucket my-bucket\naws s3api list-object-versions --bucket my-bucket --max-items 100\naws s3api get-bucket-tagging --bucket my-bucket\n",[282],{"type":25,"tag":283,"props":284,"children":285},"code",{"__ignoreMap":7},[286],{"type":30,"value":280},{"type":25,"tag":26,"props":288,"children":289},{},[290],{"type":30,"value":291},"The first one is the one people skip. Anything listed there is storage you are\npaying for and cannot see in a normal listing.",{"type":25,"tag":26,"props":293,"children":294},{},[295,300,302,308],{"type":25,"tag":53,"props":296,"children":297},{},[298],{"type":30,"value":299},"Stop the bleeding at the source.",{"type":30,"value":301}," A lifecycle rule with\n",{"type":25,"tag":283,"props":303,"children":305},{"className":304},[],[306],{"type":30,"value":307},"AbortIncompleteMultipartUpload",{"type":30,"value":309}," set to a few days turns a permanent leak into a\ndelay. It does not clean up what already exists — that is a one-off abort.",{"type":25,"tag":26,"props":311,"children":312},{},[313,318],{"type":25,"tag":53,"props":314,"children":315},{},[316],{"type":30,"value":317},"Attribute the egress before someone asks.",{"type":30,"value":319}," Cost allocation tags on buckets, and\na look at which prefixes leave the cloud. A bill you can explain is a bill you can\nnegotiate.",{"type":25,"tag":26,"props":321,"children":322},{},[323,328,330,336,338,344,346,351,353,359],{"type":25,"tag":53,"props":324,"children":325},{},[326],{"type":30,"value":327},"Make access expressible.",{"type":30,"value":329}," Tag-based policies (",{"type":25,"tag":283,"props":331,"children":333},{"className":332},[],[334],{"type":30,"value":335},"s3:ExistingObjectTag",{"type":30,"value":337},") let you\nsay \"tenant A may read tenant A's objects\" without enumerating prefixes. Note the\nlimits we wrote about before: tags are not visible to ",{"type":25,"tag":283,"props":339,"children":341},{"className":340},[],[342],{"type":30,"value":343},"ListObjectsV2",{"type":30,"value":345},", and\n",{"type":25,"tag":283,"props":347,"children":349},{"className":348},[],[350],{"type":30,"value":335},{"type":30,"value":352}," is unsupported on ",{"type":25,"tag":283,"props":354,"children":356},{"className":355},[],[357],{"type":30,"value":358},"PutObject",{"type":30,"value":360},".",{"type":25,"tag":26,"props":362,"children":363},{},[364,369],{"type":25,"tag":53,"props":365,"children":366},{},[367],{"type":30,"value":368},"Test the second provider now,",{"type":30,"value":370}," while nothing forces you to. One bucket, one\nkey, one file with a checksum. You will learn more in twenty minutes than in a\nquarter of architecture review.",{"type":25,"tag":38,"props":372,"children":374},{"id":373},"how-s3-explorer-fits",[375],{"type":30,"value":376},"How S3 Explorer fits",{"type":25,"tag":26,"props":378,"children":379},{},[380],{"type":30,"value":381},"The tooling gap in this article is narrow and real: a bucket viewer that shows\nobjects but not the debris, the versions, the tags or the request pattern leaves\nyou exactly where the regulation found you.",{"type":25,"tag":26,"props":383,"children":384},{},[385,387,392,394,399,401,406,408,413],{"type":30,"value":386},"S3 Explorer shows, per connection: a ",{"type":25,"tag":53,"props":388,"children":389},{},[390],{"type":30,"value":391},"connection test that reports the bucket\ncount",{"type":30,"value":393}," before you browse, bucket cards that flag ",{"type":25,"tag":53,"props":395,"children":396},{},[397],{"type":30,"value":398},"incomplete uploads",{"type":30,"value":400}," older\nthan a configurable threshold with the key, age and size of each, ",{"type":25,"tag":53,"props":402,"children":403},{},[404],{"type":30,"value":405},"object\nmetadata and version tabs",{"type":30,"value":407},", and a ",{"type":25,"tag":53,"props":409,"children":410},{},[411],{"type":30,"value":412},"per-request metrics panel",{"type":30,"value":414}," so the traffic\nyou are paying for is visible while you work. Connections are per profile, which\nis what makes a second provider a two-minute test rather than a project.",{"type":25,"tag":26,"props":416,"children":417},{},[418],{"type":30,"value":419},"It is a desktop client for Windows, macOS and Linux, and it is built by the\npublisher of this blog. That is the disclosure; the checklist above stands on its\nown without it.",{"type":25,"tag":421,"props":422,"children":423},"hr",{},[],{"type":25,"tag":26,"props":425,"children":426},{},[427],{"type":25,"tag":71,"props":428,"children":429},{},[430],{"type":30,"value":431},"The Data Act dates come from the European Commission's Data Act page and the\nregulation text; the 12 January 2027 deadline and its scope (switching only, not\nongoing egress) follow Article 29 and the Commission's guidance as summarised by\nMoveInfra, October 2026. Object counts, public bucket figures and the rclone\nadvisory are dated inline. Figures for egress pricing come from a 2026 comparison\nacross 18 providers and will move.",{"title":7,"searchDepth":433,"depth":433,"links":434},2,[435,436,443,444,445],{"id":40,"depth":433,"text":43},{"id":106,"depth":433,"text":109,"children":437},[438,440,441,442],{"id":113,"depth":439,"text":116},3,{"id":148,"depth":439,"text":151},{"id":178,"depth":439,"text":181},{"id":194,"depth":439,"text":197},{"id":219,"depth":433,"text":222},{"id":260,"depth":433,"text":263},{"id":373,"depth":433,"text":376},"markdown","content:blog:s3-in-2027-egress-bill-changes.md","content","blog\u002Fs3-in-2027-egress-bill-changes.md","blog\u002Fs3-in-2027-egress-bill-changes","md",[453,460,467,473,480,486,493,498,504,509,514,522,524,530],{"_path":454,"title":455,"description":456,"tags":457},"\u002Fblog\u002Fabac-object-tags-vs-prefix-policies","Object tags or prefixes: which access model survives growth","Prefixes decide what a principal can list, tags decide what it can read. Two AWS limits break tag-only designs, and prefix policies run out at about 60 tenants.",[13,458,15,459],"iam","access-control",{"_path":461,"title":462,"description":463,"tags":464},"\u002Fblog\u002Fassumerole-chaining-one-hour-ceiling","Chained AssumeRole sessions stop at one hour, silently","A role that assumes another role gets 3600 seconds, whatever its MaxSessionDuration allows. The exact error, and the batch job that dies at minute 61.",[13,458,465,466],"sts","aws",{"_path":468,"title":469,"description":470,"tags":471},"\u002Fblog\u002Fbucket-policy-allow-still-denied","When two policies allow and the request still fails","S3 returns AccessDenied even when the bucket and IAM policies both allow. Here is the five-gate evaluation order and where the hidden deny sits.",[13,458,472,459],"security",{"_path":474,"title":475,"description":476,"tags":477},"\u002Fblog\u002Fcrc64nvme-new-integrity-default","CRC64NVME is now the S3 default, your SDK sends CRC32","S3 stores a CRC64NVME checksum on every new object, while the CLI and the SDKs default to different algorithms. Measured on a live endpoint.",[13,478,479],"integrity","api",{"_path":481,"title":482,"description":483,"tags":484},"\u002Fblog\u002Flist-pagination-1000-pages","S3 LIST returns 1,000 entries a page, folders included","One ListObjectsV2 response holds at most 1,000 entries, and a folder rollup spends one of them. Measured on two endpoints, plus the loop that stops too early.",[13,479,485],"performance",{"_path":487,"title":488,"description":489,"tags":490},"\u002Fblog\u002Fmultipart-5mb-floor-10000-parts","Multipart upload: the 5 MiB floor and the 10,000-part ceiling","A single PUT stops at 5 GiB. Splitting a 60 GB file moves the failure rather than removing it: the 5 MiB part floor is checked last, after every byte is sent.",[13,491,492],"uploads","multipart",{"_path":494,"title":495,"description":496,"tags":497},"\u002Fblog\u002Fpresigned-post-enforce-size-content-type","Presigned POST: cap size and type before the upload starts","A presigned PUT signs a URL, not a byte count. A POST policy adds a size range and a content-type condition that S3 enforces while the body arrives.",[13,472,491],{"_path":499,"title":500,"description":501,"tags":502},"\u002Fblog\u002Fpresigned-url-leakage","Presigned URLs leak into logs, referrers and chat","A presigned URL is a working credential stored as text. Where the copy ends up, what it still grants after redaction, and the 15-minute fix.",[13,472,503],"presigned-urls",{"_path":505,"title":506,"description":507,"tags":508},"\u002Fblog\u002Fpresigned-url-seven-day-ceiling","Presigned URLs expire at seven days. Then what?","Seven days is not a setting: it is how long the SigV4 signing key lives. What happens at that wall, and the three patterns that outlive it.",[13,472,503],{"_path":510,"title":511,"description":512,"tags":513},"\u002Fblog\u002Fresume-interrupted-multipart-upload","Resuming a multipart upload you never meant to abandon","An upload ID never expires, so a crashed upload is resumable without the state file — measured: the part list is the real state, and it can lie about the ETag.",[13,491,492],{"_path":515,"title":516,"description":517,"tags":518},"\u002Fblog\u002Fs3-explorer-walkthrough","S3 Explorer walkthrough: zero to browsing in 5 minutes","A step-by-step walkthrough of S3 Explorer against a live S3 endpoint: pick a provider, test, browse buckets, inspect metadata, read request metrics.",[13,519,520,521],"tutorial","tooling","seaweedfs",{"_path":4,"title":8,"description":9,"tags":523},[13,14,15,16],{"_path":525,"title":526,"description":527,"tags":528},"\u002Fblog\u002Fs3-total-cost-of-ownership","The real cost of S3: 8 providers compared, egress included","Storage is 20% of your bill. We modelled 8 S3 providers across 4 workloads — backup, app, media, DR — with storage, egress, requests and replication.",[13,14,16,529],"cost-optimisation",{"_path":531,"title":532,"description":533,"tags":534},"\u002Fblog\u002Fwelcome","Why we write about S3, and how this blog is made","Object storage is everywhere and most advice about it is stale. What this blog covers, how each article is sourced, and what we measure to know it helped.",[13,16],1794568659401]