The ISSAI S3 Object Storage service provides high-capacity research data storage over the industry-standard Amazon S3 API. It is operated on a DDN EXAScaler Lustre parallel filesystem (approximately 123 TB) connected to the storage system over a 100 GbE RoCE/RDMA fabric. The service is reachable from the ISSAI and Nazarbayev University campus network and from the public internet, so datasets can be uploaded and downloaded from cluster nodes, university workstations, and external HPC systems using the same endpoint.

Every user receives personal S3 credentials (an access key ID and a secret access key) and a private bucket. All requests are authenticated with these credentials, and no data is accessible without them. The S3 API is supported by a wide range of tools, including the AWS Command Line Interface, rclone, Cyberduck, S3 Browser, and the Python boto3 library, so the service can be used from the command line, from graphical applications, and from scripts and training pipelines.

SPECIFICATIONS

Endpoint	https://s3.issai.nu.edu.kz — Amazon S3 API over HTTPS, path-style addressing
Storage backend	DDN EXAScaler Lustre parallel filesystem, ~123 TB, 4-node high-availability configuration
Network fabric	100 GbE RoCE/RDMA between the storage system and the gateway (~47 Gbit/s measured)
Access	Personal access key ID + secret access key; private bucket <your-login>-data
Region / addressing	us-east-1 (fixed value required by clients)
Availability	Campus network and public internet, 24/7

GETTING ACCESS

• Access is granted per person. Send a request to issai@nu.edu.kz (subject: S3 storage access) with your name and NU/ISSAI affiliation, a one-sentence description of the intended use, and the approximate amount of storage you expect to need.
• You will receive an access key ID and a secret access key, and a private bucket named <your-login>-data that only you can read and write.
• Additional buckets, shared project buckets, and public-read buckets are created by the storage administrators upon request (see SHARING DATA WITH EXTERNAL COLLABORATORS below).
• Treat your secret access key like a password: store it in a credentials file or a secret manager, never commit it to a version control system, and never send it by chat or email. Keys do not expire automatically — report lost or compromised keys immediately so they can be rotated, and report when a person leaves the project so their key can be revoked.

ENDPOINT AND CREDENTIALS

All examples below use the following values. Replace the placeholders with the credentials you received:

Access key ID:      YOUR-ACCESS-KEY
Secret access key:  YOUR-SECRET-KEY
Endpoint:           https://s3.issai.nu.edu.kz
Region:             us-east-1        (fixed value, required by clients)
Addressing:         path-style       (default for most tools with a custom endpoint)

SUPPORTED TOOLS

ISSAI S3 Object Storage works with any S3-compatible client that supports path-style addressing. The following tools are tested and documented on this page:

• AWS CLI: Standard S3 command-line interface.
• rclone: File sync tool with S3 support — recommended for bulk transfers and for mounting a bucket as a local disk.
• Boto3: AWS SDK for Python, for scripts, notebooks, and training pipelines.
• s5cmd: High-performance, parallel S3 tool for large datasets.
• Cyberduck: Graphical file transfer client (Windows/macOS, free).
• S3 Browser: Graphical client for Windows.
• Mountain Duck: Mounts the bucket as a real drive letter or volume.

COMMAND-LINE USAGE (AWS CLI)

Install the AWS CLI version 2: installation guide. On Linux, a no-sudo user-local installation is also possible:

curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o awscliv2.zip
unzip awscliv2.zip
sudo ./aws/install                                                # system-wide
./aws/install --install-dir ~/.aws-cli --bin-dir ~/.local/bin     # without sudo
aws --version

List your buckets and objects:

aws --profile issai s3 ls                             # your buckets
aws --profile issai s3 ls s3://your-login-data/       # objects in your bucket

Upload, download, synchronize, and delete:

aws --profile issai s3 cp results.csv s3://your-login-data/
aws --profile issai s3 cp s3://your-login-data/results.csv ./
aws --profile issai s3 sync dataset/ s3://your-login-data/dataset/
aws --profile issai s3 rm s3://your-login-data/old.csv
aws --profile issai s3 rm --recursive s3://your-login-data/tmp/

Large files are uploaded automatically in parallel parts (multipart uploads), so multi-gigabyte files are supported out of the box. To generate a temporary download link for a single object, use s3 presign:

aws --profile issai s3 presign s3://your-login-data/results.csv --expires-in 3600    # 1 hour
aws --profile issai s3 presign s3://your-login-data/results.csv --expires-in 86400   # 1 day
aws --profile issai s3 presign s3://your-login-data/results.csv --expires-in 604800  # 7 days

RCLONE (BULK TRANSFERS AND MOUNTING)

rclone is recommended for large and bulk transfers: it runs many transfers in parallel and can also mount a bucket as a local disk. Configure it once with rclone config:

rclone config
n) New remote
name> issai
storage> s3
provider> Other            <-- IMPORTANT: pick "Other", NOT "Amazon S3"
access_key_id> YOUR-ACCESS-KEY
secret_access_key> YOUR-SECRET-KEY
endpoint> https://s3.issai.nu.edu.kz
region>                    (leave blank)
q) Quit

The most common configuration mistake is choosing the provider Amazon S3 instead of Other — rclone will then try to reach AWS instead of ISSAI.
Everyday commands:

rclone ls issai:your-login-data
rclone copy dataset issai:your-login-data/dataset -P --transfers 8 --checkers 16
rclone sync issai:your-login-data/dataset ./restore -P
rclone copy issai:your-login-data/dataset otherhost:bucket -P

Mount a bucket as a local disk (with caching):

# Linux / macOS
rclone mount issai:your-login-data ~/s3 --vfs-cache-mode full --daemon
# Windows (drive letter Q:)
rclone mount issai:your-login-data Q: --vfs-cache-mode full

Mounting on Windows requires WinFsp to be installed.

GRAPHICAL CLIENTS

• Cyberduck (Windows/macOS, free): open a new S3 connection, enter the server and your keys; enable path style if the option is shown.
• S3 Browser (Windows): Accounts → Add → set the REST endpoint to s3.issai.nu.edu.kz.
• Mountain Duck (Windows/macOS): mounts the bucket as a real drive letter or volume.
• Connection settings common to all clients: server s3.issai.nu.edu.kz, port 443 (HTTPS), your personal key pair, style path-style, region us-east-1.

PYTHON (BOTO3)

For training pipelines and notebooks, use the boto3 library (pip install boto3). Read credentials from environment variables or a configuration file instead of hard-coding them in scripts:

import boto3
from botocore.config import Config
s3 = boto3.client(
    "s3",
    endpoint_url="https://s3.issai.nu.edu.kz",
    aws_access_key_id="YOUR-ACCESS-KEY",
    aws_secret_access_key="YOUR-SECRET-KEY",
    region_name="us-east-1",
    config=Config(s3={"addressing_style": "path"}),  # keep path-style addressing
)
# list buckets
print([b["Name"] for b in s3.list_buckets()["Buckets"]])
# upload / download
s3.upload_file("model.pt", "your-login-data", "checkpoints/model.pt")
s3.download_file("your-login-data", "checkpoints/model.pt", "model.pt")
# presigned link valid for 24 hours
url = s3.generate_presigned_url(
    "get_object",
    Params={"Bucket": "your-login-data", "Key": "checkpoints/model.pt"},
    ExpiresIn=86400,
)
print(url)

SHARING DATA WITH EXTERNAL COLLABORATORS

• Presigned links are the recommended way to share individual files: anyone with the link can download the object until it expires, without an account. Share them as carefully as a password — they are bearer tokens — and prefer short expiries (up to 7 days).
• Shared project buckets allow several named users to read and write the same bucket with their own credentials. Request creation via issai@nu.edu.kz.
• Public-read buckets make a whole bucket readable by anyone on the internet without authentication. They are intended for publishing datasets and require approval by ISSAI; request via issai@nu.edu.kz.
• Granting another person access to your personal bucket is not supported — use a shared project bucket instead.
• When transferring many small files, pack them into a tar or zip archive first: thousands of tiny files are transferred one by one and are much slower than a single archive.

SECURITY

• Every request is authenticated with your personal access key pair — there is no anonymous access to private buckets.
• HTTPS everywhere: all traffic to the endpoint is encrypted with TLS at the university edge; credentials and data are never sent in the clear.
• Least privilege by design: each user sees only their own bucket; the administration interface is reachable only from the internal network.
• Presigned links are bearer tokens — anyone who has the link can download the object until it expires. Choose short expiries and share carefully.
• Key lifecycle: keys do not expire automatically; report compromised keys immediately for rotation, and report when a person leaves the project so their key can be revoked.
• Data classification: do not store sensitive, confidential, or personal data unless explicitly agreed with ISSAI and appropriate security requirements are in place.

SUPPORT

Questions, access requests, and problem reports: issai@nu.edu.kz, when reporting a problem, include your login, the bucket and object names, the exact command or client you used, and the full error message.