Cloud storage

s3://, az:// and gs:// are first-class endpoints: source, destination, or both. That covers AWS S3 and every S3-compatible store (MinIO, Cloudflare R2, Wasabi, Backblaze B2), Azure Blob Storage, and Google Cloud Storage — upload, download, and even cloud→cloud, where same-bucket copies happen server-side and duplicate bytes never leave the provider.

The creds manager stores reusable connections so a transfer is just fast-copy /data aws-prod:uploads. The credentials file is encrypted at rest with AES-256-GCM — encryption is offered by default when the file is first created — and uploads are verified against the stored content hash after transfer.

The creds manager

creds subcommands

Subcommand	Description
`list`	Show saved connections (secrets masked).
`add NAME [-y]`	Add a connection interactively (s3 / azure / gcs / ssh).`-y`/`--force` skips the overwrite prompt.
`edit NAME`	Edit a connection (Enter keeps current, `-` clears a field).
`remove NAME`	Delete a connection.
`test NAME`	Live connection check (cloud API or SSH login).
`encrypt` / `decrypt`	Toggle AES-256-GCM encryption at rest.
`rekey`	Re-bind an encrypted file to the current binary.
`lock` / `unlock`	Set/clear OS immutability (needs root; use `--use-sudo`).

Add and test a cloud connection

fast-copy creds add aws-prod
fast-copy creds test aws-prod

Copying to and from buckets

Use a saved connection as a source/destination

# default bucket of the connection
fast-copy /data aws-prod:uploads/2024
# explicit bucket with named credentials
fast-copy /data s3://aws-prod@my-bucket/incoming
# bucket using ambient credentials
fast-copy /data s3://my-bucket/incoming

Endpoint forms: a bare NAME (the connection's default bucket), NAME:subpath (a folder inside it), or an explicit s3:// / az:// / gs:// URL with an optional NAME@bucket credential selector. Source and destination can use different accounts — or different S3 vendors — in one command.

Encrypted credentials without a prompt

FAST_COPY_CREDS_PASSPHRASE='…' fast-copy creds list

On Linux this env var is readable via /proc/<pid>/environ by same-UID processes — prefer the hidden prompt on shared hosts.

List remote objects

fast-copy ls aws-prod
fast-copy ls gcs-archive:backup
fast-copy ls user@host:/var/log --ssh-key ~/.ssh/id_ed25519

Cloud SDKs are optional installs — run fast-copy deps to see what's missing (see utility commands).