Manage S3 access

Last update: October 05 2026Open in Markdown

Access to S3 resources is regulated by:

• projects — determine access within an isolated resource group;
• roles — determine access for control panel users, service users, and groups within an account and a project.
• access policy — determines access within a bucket.

When an S3 action request is received, the user role is checked first. If the role is:

• does not allow the action — access is denied;

• allows the action — the presence and settings of the bucket policy are checked. If the bucket policy:

  • not created — access will be granted to all users with access within roles, except users with the object_storage_user, s3.user, and s3.bucket.user roles;
  • is created — everything not allowed by the policy rules is denied.

To access via API, automation tools, and FTP, use keys.

Learn more about access management in the Access management in Selectel products instructions.

Access within projects

All resources in S3 are created in a specific project. You can group resources by different projects and configure user permissions depending on which projects they need access to.

Access within roles

Access to S3 is provided by S3 roles and global roles. Learn more about role types in the Role reference instructions.

Role group	Role	Access
S3 roles	s3.admin	Manage all buckets in a project
	s3.user	Manage a specific bucket and view the list of buckets
	s3.bucket.user	Manage a specific bucket
	object_storage:admin	Manage all buckets in a project
	object_storage_user	Manage a specific bucket
Global roles	member	Manage S3 and other products, account, billing, projects
	billing	Manage billing in S3 and other products
	iam.admin	Manage access to S3 and other products
	iam.viewer	View access to S3 and other products
	reader	View S3 resources and all products, account, billing, projects

S3 roles

s3.admin

The s3.admin role provides access to manage S3 within a project. It does not have access to S3 in other projects or to other products in its project.

Access scopes	Project
Who can be assigned	Service users
Available operations in S3	view the list of buckets in the project; view the content of buckets in the project; manage buckets in the project: create buckets; manage objects in buckets (upload, change settings, delete); changing bucket settings (managing versioning, enabling Object Lock, changing bucket type, addressing, configuring limits) *; delete buckets

* Managing access policies and bypassing temporary Object Lock retention in the control panel is unavailable.

s3.user

The s3.user role provides access to an S3 bucket if an access policy is configured in it that allows access to the bucket for this user. The level of access is determined by the access policy settings. It does not have access to S3 in other projects or to other products in its project.

Access scopes	Project
Who can be assigned	Service users
Available operations in S3	view the list of buckets in the project; operations in the bucket allowed by the bucket policy

s3.bucket.user

The s3.bucket.user role provides access to an S3 bucket if an access policy is configured in it that allows access to the bucket for this user. The level of access is determined by the access policy settings. It does not have access to S3 in other projects or to other products in its project.

Access scopes	Project
Who can be assigned	Service users
Available operations in S3	Operations in the bucket allowed by the bucket policy

object_storage.admin

For your information

The object_storage:admin role will soon be removed, and it cannot be assigned to new users. Existing users with the object_storage:admin role continue to work.

Legacy version of the s3.admin role. Has identical permissions.

object_storage_user

For your information

The object_storage_user role will soon be removed, and it cannot be assigned to new users. Existing users with the object_storage_user role continue to work.

Legacy version of the s3.user role. Has identical permissions.

Global roles

member

The member role provides full access to all services. It does not provide access to managing control panel users, service users, user groups, and federations.

Access scopes	account; project
Who can be assigned	users; service users; user groups
Available operations in S3	In the Account access scope: view the list of buckets in all projects; manage buckets in all projects: create buckets; change bucket settings (manage bucket policies, versioning, enable Object Lock, change bucket type, addressing, configure limits); manage objects in buckets (upload, change settings, delete); bypass temporary Governance mode block (Object Lock); manage projects, their limits and quotas; manage billing and view consumption
	In the Project access scope: view the list of buckets in the project; manage buckets in the project: create buckets; change bucket settings (manage bucket policies, versioning, enable Object Lock, change bucket type, addressing, configure limits); manage objects in buckets (upload, change settings, delete); bypass temporary Governance mode block (Object Lock)

billing

The billing role provides access to billing management without access to service management.

Access scopes	Account
Who can be assigned	users; service users; user groups
Available operations in S3	billing management; view S3 consumption

iam.admin

The iam.admin role provides access to user management and does not provide access to product and billing management. It does not allow you to manage your own account: change permissions, manage notifications, or delete a user. The first user with the iam.admin role is created by the Account owner.

Access scopes	Account
Who can be assigned	users; service users; user groups
Available operations in S3	managing control panel users, service users, and user groups; issue S3 keys to users

iam.viewer

The iam.viewer role provides access to view everything managed by iam.admin.

Access scopes	Account
Who can be assigned	users; service users; user groups
Available operations in S3	Viewing control panel users, service users, and user groups

reader

The reader role provides access to view everything managed by member in the same scope.

Access scopes	account; project
Who can be assigned	users; service users; user groups
Available operations in S3	In the Account access scope: view buckets in all projects: view the list of buckets; view bucket settings; view objects in buckets; view all projects, their limits and quotas; view billing and consumption data
	In the Project access scope: view the list of buckets in the project; view buckets in the project: view the list of buckets; view bucket settings; view objects in buckets

Keys for API access

Depending on the API type, you will need:

• IAM token for a project (X-Auth-Token). Used for access via Object Storage API and Swift API. Can be issued to service users and control panel users. To issue an IAM token to a service user, use the Get an IAM token for a project subsection in the Request authentication section of the API documentation. We recommend using an IAM token for a control panel user only for testing; learn more in the Manage IAM tokens subsection in the Manage access keys instructions;
• S3 key (EC2 key). Used to sign S3 API requests and for access via FTP. Consists of a value pair: Access Key ID and Secret Key. S3 keys can be issued to service users and control panel users. You can add it to yourself or issue it to another user.