raindrop bucket

The raindrop bucket command manages S3-compatible credentials for accessing Raindrop object storage buckets. Create credentials to access buckets from external tools, applications, or S3-compatible clients.

Credentials provide AWS S3-compatible access key ID and secret access key pairs. Use these credentials with any S3-compatible client library or tool to interact with Raindrop buckets.

Basic Usage

Create S3 credentials for a bucket:

raindrop bucket create-credential my-bucket

List all credentials for a bucket:

raindrop bucket list-credentials my-bucket

Command Reference

raindrop bucket create-credential

Create new S3-compatible credentials for a bucket.

Syntax:

raindrop bucket create-credential <bucket> [--output <format>]

Arguments:

• <bucket> - Bucket name (required)

Flags:

Flag	Description	Values	Default
-o, --output	Output format	text, json	text

Examples:

# Create credentials
raindrop bucket create-credential my-bucket

# Create with JSON output
raindrop bucket create-credential my-bucket --output json

Output:

Successfully created S3 credential for bucket 'my-bucket'

Access Key: AKIAIOSFODNN7EXAMPLE
Secret Key: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
Name: default
Created: 2025-10-23T10:30:00.000Z

⚠️  Save these credentials securely - the secret key cannot be retrieved again!

Save Secret Keys

The secret access key is shown only once during creation. Save it securely - you cannot retrieve it again. If lost, delete the credential and create a new one.

---

raindrop bucket delete-credential

Delete S3 credentials for a bucket.

Syntax:

raindrop bucket delete-credential <bucket> <accessKeyId> [--force]

Arguments:

• <bucket> - Bucket name (required)
• <accessKeyId> - AWS access key ID to delete (required)

Flags:

Flag	Description	Default
-f, --force	Skip confirmation prompt	false

Examples:

# Delete with confirmation
raindrop bucket delete-credential my-bucket AKIAIOSFODNN7EXAMPLE

# Delete without confirmation
raindrop bucket delete-credential my-bucket AKIAIOSFODNN7EXAMPLE --force

Behavior:

Deleting credentials immediately revokes access. Any applications or tools using these credentials will no longer be able to access the bucket.

---

raindrop bucket get-credential

Get details for specific S3 credentials.

Syntax:

raindrop bucket get-credential <bucket> <accessKeyId> [--output <format>]

Arguments:

• <bucket> - Bucket name (required)
• <accessKeyId> - AWS access key ID (required)

Flags:

Flag	Description	Values	Default
-o, --output	Output format	text, json	text

Examples:

# Get credential details
raindrop bucket get-credential my-bucket AKIAIOSFODNN7EXAMPLE

# Get as JSON
raindrop bucket get-credential my-bucket AKIAIOSFODNN7EXAMPLE --output json

Output:

Access Key: AKIAIOSFODNN7EXAMPLE
Name: default
Created: 2025-10-23T10:30:00.000Z
Last Used: 2025-10-23T15:45:00.000Z

Secret Keys Not Retrievable

This command shows credential metadata but not the secret access key. Secret keys are only shown once during creation.

---

raindrop bucket list-credentials

List all S3 credentials for a bucket.

Syntax:

raindrop bucket list-credentials <bucket> [--output <format>]

Arguments:

• <bucket> - Bucket name (required)

Flags:

Flag	Description	Values	Default
-o, --output	Output format	text, json, table	table

Examples:

# List credentials in table format
raindrop bucket list-credentials my-bucket

# List as JSON
raindrop bucket list-credentials my-bucket --output json

Output:

┌────────────────────────┬─────────┬──────────────────────┬──────────────────────┐
│ Access Key ID          │ Name    │ Created              │ Last Used            │
├────────────────────────┼─────────┼──────────────────────┼──────────────────────┤
│ AKIAIOSFODNN7EXAMPLE   │ default │ 2025-10-23T10:30:00Z │ 2025-10-23T15:45:00Z │
│ AKIAJ7EXAMPLE2NDKEY    │ backup  │ 2025-10-20T09:15:00Z │ Never                │
└────────────────────────┴─────────┴──────────────────────┴──────────────────────┘

Using S3 Credentials

With AWS CLI

Configure AWS CLI with Raindrop credentials:

# Configure AWS CLI profile
aws configure --profile raindrop

# Enter credentials when prompted:
# AWS Access Key ID: AKIAIOSFODNN7EXAMPLE
# AWS Secret Access Key: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
# Default region name: us-east-1
# Default output format: json

# Use with AWS CLI
aws s3 ls s3://my-bucket --profile raindrop
aws s3 cp file.txt s3://my-bucket/ --profile raindrop

With S3 Client Libraries

Use credentials with S3-compatible libraries:

Python (boto3):

import boto3

s3 = boto3.client(
    's3',
    aws_access_key_id='AKIAIOSFODNN7EXAMPLE',
    aws_secret_access_key='wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY',
    endpoint_url='https://s3.raindrop.liquidmetal.ai'
)

# List objects
response = s3.list_objects_v2(Bucket='my-bucket')

# Upload file
s3.upload_file('local-file.txt', 'my-bucket', 'remote-file.txt')

JavaScript (AWS SDK):

import { S3Client, ListObjectsV2Command, PutObjectCommand } from "@aws-sdk/client-s3";

const s3Client = new S3Client({
  region: "us-east-1",
  credentials: {
    accessKeyId: "AKIAIOSFODNN7EXAMPLE",
    secretAccessKey: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
  },
  endpoint: "https://s3.raindrop.liquidmetal.ai",
});

// List objects
const listCommand = new ListObjectsV2Command({ Bucket: "my-bucket" });
const listResponse = await s3Client.send(listCommand);

// Upload object
const putCommand = new PutObjectCommand({
  Bucket: "my-bucket",
  Key: "remote-file.txt",
  Body: fileContents,
});
await s3Client.send(putCommand);

Environment Variables

Set credentials as environment variables:

export AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE
export AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
export AWS_ENDPOINT_URL=https://s3.raindrop.liquidmetal.ai

# Now use any S3-compatible tool
aws s3 ls s3://my-bucket

Common Workflows

Initial Setup

Create credentials for a new bucket:

# Create credentials
raindrop bucket create-credential my-bucket

# Save output securely (example: password manager, secrets vault)

# Test access with AWS CLI
aws s3 ls s3://my-bucket --profile raindrop

Credential Rotation

Rotate credentials for security:

# List current credentials
raindrop bucket list-credentials my-bucket

# Create new credentials
raindrop bucket create-credential my-bucket

# Update applications with new credentials

# Delete old credentials after verification
raindrop bucket delete-credential my-bucket AKIAIOSFODNN7EXAMPLE --force

Multiple Credentials

Create separate credentials for different purposes:

# Production credentials
raindrop bucket create-credential my-bucket
# Save with name "production"

# Development credentials
raindrop bucket create-credential my-bucket
# Save with name "development"

# CI/CD credentials
raindrop bucket create-credential my-bucket
# Save with name "ci-cd"

# List all credentials
raindrop bucket list-credentials my-bucket

Revoking Access

Immediately revoke access:

# Identify credential to revoke
raindrop bucket list-credentials my-bucket

# Delete credential (no confirmation)
raindrop bucket delete-credential my-bucket AKIAIOSFODNN7EXAMPLE --force

# Verify deletion
raindrop bucket list-credentials my-bucket

Security Best Practices

Credential Management:

• Create separate credentials for each application or environment
• Rotate credentials regularly (every 90 days recommended)
• Delete unused credentials immediately
• Never commit credentials to version control
• Use environment variables or secrets management systems
• Implement least-privilege access patterns

Monitoring:

• Track “Last Used” timestamps to identify inactive credentials
• Audit credential usage regularly
• Set up alerts for credential creation and deletion

Recovery:

• If credentials are compromised, delete them immediately
• Create new credentials and update applications
• Review access logs for suspicious activity

Exit Codes

Code	Description
0	Command completed successfully
1	General error (bucket not found, credential not found, etc.)
2	Invalid arguments