Manage S3 access

Last update: October 13 2026Open in Markdown

Access to S3 resources is regulated by:

• projects — determine access within an isolated resource group;
• roles — determine access for control panel users, service users, and groups within an account and a project.
• access policy — determines access within a bucket.

When an S3 action request is received, the user role is checked first. If the role is:

• does not allow the action — access is denied;

• allows the action — the presence and settings of the bucket policy are checked. If the bucket policy:

  • not created — access will be granted to all users with access within roles, except users with the object_storage_user, s3.user, and s3.bucket.user roles;
  • is created — everything not allowed by the policy rules is denied.

To access via API, automation tools, and FTP, use keys.

Learn more about access management in the Access management in Selectel products instructions.

Access within projects

All resources in S3 are created in a specific project. You can group resources by different projects and configure user permissions depending on which projects they need access to.

Access within roles

Access to S3 is provided by S3 roles and global roles. Learn more about role types in the Role reference instructions.

Role group	Role	Access
S3 roles	s3.admin	Manage all buckets in a project
	s3.user	Manage a specific bucket and view the list of buckets
	s3.bucket.user	Manage a specific bucket
	data_migration.admin	Manage migrations in S3
	data_migration.user	View and run migrations in S3
	data_migration.viewer	View migrations in S3
	object_storage:admin	Manage all buckets in the project
	object_storage_user	Manage a specific bucket
Global roles	member	Manage S3 and other products, account, billing, and projects
	billing	Manage billing in S3 and other products
	iam.admin	Manage access to S3 and other products
	iam.viewer	View access to S3 and other products
	reader	View resources of S3 and all products, account, billing, and projects

S3 roles

s3.admin

The s3.admin role provides access to managing S3 within a project. It has no access to S3 in other projects or to other products in its project.

Access scopes	Project
Assignable to	Service users
Available operations in S3	viewing the list of buckets in their project; viewing bucket contents in their project; managing buckets in their project: creating buckets; managing objects in buckets (uploading, editing settings, deleting); editing bucket settings (managing versioning, enabling Object Lock, changing bucket type, addressing, configuring limits) *; deleting buckets

* Managing access policies and bypassing Object Lock temporary retention are not available in the control panel.

s3.user

The s3.user role provides access to an S3 bucket if an access policy is configured for it that allows this user access to the bucket. The access level is determined by the access policy settings. It has no access to S3 in other projects or to other products in its project.

Access scopes	Project
Assignable to	Service users
Available operations in S3	viewing the list of buckets in their project; operations in the bucket allowed by the access policy

s3.bucket.user

The s3.bucket.user role provides access to an S3 bucket if an access policy is configured for it that allows this user access to the bucket. The access level is determined by the access policy settings. It has no access to S3 in other projects or to other products in its project.

Access scopes	Project
Assignable to	Service users
Available operations in S3	Operations in the bucket allowed by the access policy

data_migration.admin

The data_migration.admin role provides access to managing migrations in S3.

Access scopes	account; project
Assignable to	control panel users; service users; user groups
Available operations in S3	In the Account scope: managing migrations (creating, editing, deleting) across all projects; viewing the list of migrations and details about each migration across all projects; checking the connection to source and destination buckets across all projects; managing migration execution (starting, stopping) across all projects
	In the Project scope: managing migrations (creating, editing, deleting) in their project; viewing the list of migrations and details about each migration in their project; checking the connection to source and destination buckets in their project; managing migration execution (starting, stopping) in their project

data_migration.user

The data_migration.user role provides access to viewing created migrations in S3 and managing their execution.

Access scopes	account; project
Assignable to	control panel users; service users; user groups
Available operations in S3	In the Account scope: viewing the list of migrations and details about each migration across all projects; checking the connection to source and destination buckets across all projects; managing migration execution (starting, stopping) across all projects
	In the Project scope: viewing the list of migrations and details about each migration in their project; checking the connection to source and destination buckets in their project; managing migration execution (starting, stopping) in their project

data_migration.viewer

The data_migration.viewer role provides access to viewing everything managed by data_migration.admin.

Access scopes	account; project
Assignable to	control panel users; service users; user groups
Available operations in S3	In the Account scope: viewing the list of migrations and details about each migration across all projects
	In the Project scope: viewing the list of migrations and details about each migration in their project

object_storage.admin

For your information

The object_storage:admin role will soon be removed and cannot be assigned to new users. Existing users with the object_storage:admin role continue to work.

Legacy version of the s3.admin role. Has identical permissions.

object_storage_user

For your information

The object_storage_user role will soon be removed and cannot be assigned to new users. Existing users with the object_storage_user role continue to work.

Legacy version of the s3.user role. Has identical permissions.

Global roles

member

The member role provides full access to all services. Does not provide access to managing control panel users, service users, user groups, and federations.

Access scopes	account; project
Who can be assigned	users; service users; user groups
Available operations in S3	In the Account access scope: viewing the list of buckets across all projects; managing buckets across all projects: creating buckets; editing bucket settings (managing access policies, versioning, enabling Object Lock, changing bucket type, addressing, configuring limits); managing objects in buckets (uploading, editing settings, deleting); bypassing temporary retention in Governance mode (Object Lock); managing projects, their limits, and quotas; managing billing and viewing consumption; exporting audit logs
	In the Project scope: viewing the list of buckets in their project; managing buckets in their project: creating buckets; editing bucket settings (managing access policies, versioning, enabling Object Lock, changing bucket type, addressing, configuring limits); managing objects in buckets (uploading, editing settings, deleting); bypassing temporary retention in Governance mode (Object Lock)

billing

The billing role provides access to managing billing without access to managing services.

Access scopes	Account
Assignable to	control panel users; service users; user groups
Available operations in S3	managing billing; viewing S3 consumption

iam.admin

The iam.admin role provides access to managing users and does not provide access to managing products or billing. It does not allow managing your own account: changing permissions, managing notifications, or deleting the user. The first user with the iam.admin role is created by the Account Owner.

Access scopes	Account
Assignable to	users; service users; user groups
Available operations in S3	managing control panel users, service users, and user groups; issuing S3 keys to users

iam.viewer

The iam.viewer role provides access to viewing everything managed by iam.admin.

Access scopes	Account
Assignable to	users; service users; user groups
Available operations in S3	Viewing control panel users, service users, and user groups

reader

The reader role provides access to viewing everything managed by member in the same scope.

Access scopes	account; project
Assignable to	users; service users; user groups
Available operations in S3	In the Account scope: viewing buckets across all projects: viewing the list of buckets; viewing bucket settings; viewing objects in buckets; viewing all projects, their limits, and quotas; viewing billing and consumption data
	In the Project scope: viewing the list of buckets in their project; viewing buckets in their project: viewing the list of buckets; viewing bucket settings; viewing objects in buckets

API access keys

Depending on the API type, the user will need:

• Project IAM token (X-Auth-Token). Used for access via the Object Storage API and Swift API. Can be issued to service users and control panel users. To issue an IAM token to a service user, see the Get project IAM token section of the Request authentication API documentation. An IAM token for a control panel user is recommended for testing purposes only; for details, see the Manage IAM tokens section of the Manage access keys guide;
• S3 key (EC2 key). Used to sign S3 API requests and for access via FTP. It consists of a pair of values: Access Key ID and Secret Key. An S3 key can be issued to service users and control panel users. You can add it for yourself or issue it to another user.