Credential rotation

Use --ovh-rotate-credentials when a bucket already exists and you only want a new S3 access key and secret:

s3ctl --provider ovh --bucket app-data --ovh-rotate-credentials --output json

Or from a config file:

{
  "provider": "ovh",
  "ovh_service_name": "PUBLIC_CLOUD_PROJECT_ID",
  "ovh_client_id": "CLIENT_ID",
  "ovh_client_secret": "CLIENT_SECRET",
  "region": "UK",
  "ovh_rotate_credentials": true,
  "output": "json"
}

What happens

1. s3ctl looks up the container by bucket name and reads its ownerId.

2. It reapplies the container profile and the scoped S3 user policy.

3. It creates a new credential pair for that Public Cloud user.

4. It deletes the user’s previous credentials.

If an old key can’t be deleted after the new one is created, s3ctl still prints the new credentials and adds a warning, so you can remove the stale key by hand.

The secret is shown once

The new secret is only returned by this run. Send the output straight to wherever you keep secrets.

Only bucket-dedicated users

Rotation only goes ahead when the container’s owner looks bucket-dedicated, so it can’t touch a shared, manually created user. Bucket deletion explains the check.

--ovh-rotate-credentials can’t be combined with --delete or --ovh-repair-policies.