Amazon S3 vs DigitalOcean Spaces

Amazon S3

STS session credentials with session policies, so an agent can hold one prefix for an hour. Egress to the internet is billed per GB after 100 GB a month.

DigitalOcean Spaces

Per-bucket access keys with read or read-write-delete grants, an 800 operations a second limit per bucket and a 99.9 per cent SLA are all published. The MCP server manages keys and CDN endpoints only, not objects, and the S3 reference documents no error codes. A payment method is required before any bucket is created.

Amazon S3

1. Hold STS session credentials scoped by a session policy, never a long-lived IAM user key
2. Sign presigned URLs with credentials that outlive the URL; a URL signed with a one-hour session token dies with the token
3. Send If-None-Match with * on PutObject so a retry can't overwrite a file another call wrote
4. Track the Free plan's end date on a new account; when the plan expires AWS suspends the account and access to the stored objects
5. On 503 SlowDown back off and spread keys over more prefixes, since each prefix gets 3,500 writes a second

DigitalOcean Spaces

1. Set the endpoint to https://<region>.digitaloceanspaces.com and, in AWS SDKs other than Python's, set region to us-east-1 when creating a bucket
2. Ask for a limited access key with a Read or Read/Write/Delete grant on one bucket. A full access key can create, configure and delete every bucket
3. Do the object work through the S3 API. The MCP server and doctl cannot upload, list, move or delete files
4. Retry with exponential backoff on 503 Slow Down, and keep below 800 operations a second per bucket
5. Fetch presigned links from the origin host, not the CDN. The docs say presigned requests through the CDN are not cached and can double the bandwidth charge
6. Avoid many tiny objects. Each bills as at least 4 KiB on Standard and 128 KiB on Cold Storage, which also has a 30-day minimum