Amazon S3 vs Backblaze B2

Amazon S3

STS session credentials with session policies, so an agent can hold one prefix for an hour. Egress to the internet is billed per GB after 100 GB a month.

Backblaze B2

$6.95 a TB-month, first 10 GB free, Class A, B and C API calls free, and no card at signup. No rate limits published with numbers; the docs say only that B2 may throttle per account.

Amazon S3

1. Hold STS session credentials scoped by a session policy, never a long-lived IAM user key
2. Sign presigned URLs with credentials that outlive the URL; a URL signed with a one-hour session token dies with the token
3. Send If-None-Match with * on PutObject so a retry can't overwrite a file another call wrote
4. Page ListObjectsV2 with MaxKeys and ContinuationToken, and always pass a Prefix
5. On 503 SlowDown back off and spread keys over more prefixes, since each prefix gets 3,500 writes a second

Backblaze B2

1. Take the region from the key's S3 endpoint (the second label of s3.<region>.backblazeb2.com) and pass it as the SDK region
2. Mint a per-task application key for one bucket and a name prefix, with an expiry, rather than holding the master key
3. Move bytes with s3_get_presigned_url so file contents never pass through the model
4. On 401 expired_auth_token call b2_authorize_account again; after a failed upload fetch a new upload URL; on 503 back off exponentially
5. Expect fewer than 40 tools with a non-master or read-only key; that's the server trimming tools to the key