| CCC.ObjStor.CP01 | Storage Buckets | The service always provides buckets as uniquely identifiable containers in which objects are stored and to which access policies and configuration are applied. | 1 |
| CCC.ObjStor.CP02 | Storage Objects | The service always stores each data element as an object that contains both the data and its metadata, addressed by a unique key within a bucket. | 1 |
| CCC.ObjStor.CP05 | Store New Objects | The service always allows a user to store a new object in a bucket under a key that is not yet in use. | 3 |
| CCC.ObjStor.CP06 | Replace Stored Objects | The service always allows a user to replace an object in a bucket by writing a new object to the same key, overwriting the previous content unless versioning retains it. | 3 |
| CCC.ObjStor.CP07 | Delete Stored Objects | The service always allows a user to delete an object from a bucket given the object key. | 4 |
| CCC.ObjStor.CP10 | Object Level Access Control | The service can enforce access permissions on an individual object, independently of the permissions applied to the containing bucket. Whether object-level permissions are enabled by default on a new bucket varies by provider. | 1 |
| CCC.ObjStor.CP12 | Storage Classes | The service always offers multiple storage classes with differing durability, availability and retrieval latency, and an object may be configured to use a class other than the default. | 1 |
| CCC.ObjStor.CP14 | Customer-Provided Encryption Keys | The service can encrypt an object at rest with a key that the user supplies in each request and that the service does not retain, as distinct from a key referenced from a key management service, so the object can only be read by presenting the same key again. | 1 |
| CCC.ObjStor.CP15 | Cross-Origin Resource Sharing | The service may be configured with a cross-origin resource sharing (CORS) policy on a bucket that determines which web origins a browser is permitted to request objects from. | 1 |
| CCC.ObjStor.CP16 | Bucket-Level-Only Access Policy | The service may be configured to disable object-level permissions on a bucket, so that access to every object is governed solely by the bucket-level policy. | 1 |
| CCC.ObjStor.CP17 | Object Immutability | The service may be configured to lock an object or a bucket so that its objects cannot be overwritten or deleted until a retention period expires, and the lock itself may be made irrevocable. | 2 |