Overview
S4 is a drop-in S3-compatible gateway that transparently compresses every object on the way to your S3 bucket. This AMI bundles everything for EC2: Amazon Linux 2023, the container runtime, and the CPU build of S4 (zstd, gzip) preinstalled as a systemd service. No GPU drivers required - this is the CPU companion to the separate GPU AMI listing.
On any general-purpose or compute-optimized instance (t3, t3a, m6i, m7i, c6i, c7i) S4 chooses per object: CPU zstd for text and log data, CPU gzip for legacy interop, passthrough for already-compressed inputs. For integer or columnar payloads at high throughput, use the separate GPU AMI listing.
No application changes: same S3 wire protocol, same SigV4 authentication, same SDK calls. You only change the endpoint URL. Range GET requests stay fast through a sidecar frame index compatible with Parquet and ORC readers. The on-backend format is open, so there is no lock-in: stop the gateway and objects remain readable with the Apache-2.0 s4-codec CLI, the s4-codec Python package, or the s4fs fsspec adapter.
Operate it with built-in day-2 tooling: s4 estimate projects savings before you deploy, s4 migrate retro-compresses existing objects, s4 recompact re-compresses cold data, s4 maintain runs policy-driven maintenance, and s4 savings reports the storage bytes and dollars actually saved. Prometheus metrics and a Grafana dashboard are included.
Setup: launch the AMI on a t3 / m6i / m7i / c6i / c7i instance, attach an IAM instance profile granting access to your bucket, set your S3 endpoint in /etc/s4/s4.env, and start the service. This AMI is billed per instance hour through your AWS bill. The same software is also available free under the Apache-2.0 license.
Highlights
- CPU compression preinstalled: zstd and gzip baked into the AMI. Launch on any general-purpose or compute-optimized instance (t3 / m6i / m7i / c6i / c7i) and S4 starts compressing on PUT and decompressing on GET out of the box.
- 50-80 percent fewer S3 storage bytes for compressible data, with measured per-bucket savings reporting (s4 savings) built in.
- Zero application changes and no lock-in: S3 wire-compatible endpoint, and objects stay readable without the gateway via Apache-2.0 CLI / Python / fsspec tooling.
Details
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
Pricing
Dimension | Cost/hour |
|---|---|
c7i.xlarge Recommended | $0.05 |
c7i.4xlarge | $0.05 |
c7i.24xlarge | $0.05 |
c6i.4xlarge | $0.05 |
c7i.2xlarge | $0.05 |
c6i.12xlarge | $0.05 |
c6i.2xlarge | $0.05 |
c7i.12xlarge | $0.05 |
c6i.24xlarge | $0.05 |
c6i.32xlarge | $0.05 |
Vendor refund policy
S4 is billed per instance hour on metered usage; charges stop when the instance is terminated. Usage already incurred is generally non-refundable. If you were billed in error or a defect prevented normal use, email aws-support@abyo.net within 30 days with your AWS account ID and the billing period. Valid refunds are processed through AWS Marketplace.
How can we make this page better?
Legal
Vendor terms and conditions
Content disclaimer
Delivery details
64-bit (x86) Amazon Machine Image (AMI)
Amazon Machine Image (AMI)
An AMI is a virtual image that provides the information required to launch an instance. Amazon EC2 (Elastic Compute Cloud) instances are virtual servers on which you can run your applications and workloads, offering varying combinations of CPU, memory, storage, and networking resources. You can launch as many instances from as many different AMIs as you need.
Version release notes
S4 v1.4.1 CPU AMI. Marketplace E2E findings closed - all four regressions surfaced running v1.4.0 on a real Marketplace AMI against AWS CLI 2.33 + a live AWS S3 backend are fixed. Bug 1: external S3 clients used to receive 403 NotSignedUp because the upstream s3s SimpleAuth path verified every SigV4 signature against the gateway's single rotating STS access key; v1.4.1 vendors s3s with a NoVerify mode and an AcceptAnyAuth provider so any SigV4-signed client is accepted (the gateway re-signs to the real backend with its own instance-role credentials). Bug 2: aws s3 cp of files at least 8 MiB used to fail with InvalidRequest Checksum Type mismatch (expected crc64nvme, actual crc32) under AWS CLI 2.30+ default CRC64NVME multipart checksum; v1.4.1 strips the client-declared checksum algorithm before CreateMultipartUpload so the gateway's SDK default at UploadPart agrees. Bug 3: ListObjects(V2) used to leak compressed sizes plus backend ETags inconsistent with HEAD or GET (so aws s3 sync and rclone over-transferred every run); v1.4.1 flips client-transparent listings to the default (use --physical-listings to opt out). Bug 4: multipart GET used to fail AWS CLI 2.30+ default --checksum-mode ENABLED with Expected full object checksum (crc64nvme) X did not match combined checksum Y because the backend recorded crc64nvme over the compressed parts; v1.4.1 strips backend ChecksumCRC fields from HEAD or GET responses for s4-framed objects. Same self-contained Amazon Linux 2023 image with the CPU build of S4 (zstd, gzip) preinstalled as a systemd service.
Additional details
Usage instructions
- Launch this AMI on any general-purpose or compute-optimized instance (t3 / t3a / m6i / m7i / c6i / c7i). Attach an IAM instance profile that grants access to your S3 bucket (the gateway uses the instance role for AWS credentials).
- Allow inbound TCP 8014 only from the clients that will use the S3-compatible endpoint; do not expose it to the public internet.
- Set your S3 backend in /etc/s4/s4.env: S4_BACKEND_ENDPOINT=https://s3 .<your-region>.amazonaws.com and AWS_REGION=<your-region>. S4_PORT defaults to 8014.
- Start (or restart) the service: sudo systemctl restart s4 (it is enabled to start on boot).
- Point your S3 clients (boto3, aws-sdk, Spark, Trino, DuckDB) at http://<instance>:8014 . No application code changes are required - v1.4.1 accepts any SigV4-signed client (the gateway re-signs to the real backend with its own instance-role credentials); ETag presented is MD5(original payload); ListObjects(V2) is client-transparent by default so aws s3 sync and rclone no longer over-transfer. CPU codecs (zstd / gzip) are used automatically. For GPU (nvCOMP) compression on integer or columnar payloads, use the separate "GPU S3 Compression Gateway" AMI listing. Logs: journalctl -u s4 -f . Full docs: /home/ec2-user/README-S4.txt and https://github.com/abyo-software/s4#readme
Resources
Vendor resources
Support
Vendor support
Community support is available through GitHub issues at https://github.com/abyo-software/s4/issues . Marketplace subscribers can email aws-support@abyo.net for best-effort response within 2 business days. Documentation, an operations runbook, and a threat model are included in the repository.
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
