Manage S3 access

Last update: September 01 2026Open in Markdown

Access to S3 resources is regulated by:

• projects — define access within an isolated group of resources;
• roles — define access for control panel users, service users, and groups within an account and a project.
• bucket policy — defines access within a bucket.

When an S3 action request is received, the user role is checked first. If the role:

• does not allow the action — access is denied;

• allows the action — the presence and settings of the bucket policy are checked. If the bucket policy:

  • is not created — access will be allowed to all users with access within roles, except for users with roles object_storage_user, s3.user and s3.bucket.user;
  • is created — everything not allowed by the policy rules is denied.

For access via API, automation tools and via FTP use keys.

Learn more about access management in the Access Management in Selectel Products guide.

Access within projects

All S3 resources are created in a specific project. You can group resources by different projects and configure permissions for users depending on which projects they need access to.

Access within roles

Access to S3 is granted by S3 roles and global roles. Read more about role types in the Roles Reference guide.

Role group	Role	Access
S3 roles	s3.admin	Manage all buckets in a project
	s3.user	Manage a specific bucket and view the list of buckets
	s3.bucket.user	Manage a specific bucket
	object_storage:admin	Manage all buckets in a project
	object_storage_user	Manage a specific bucket
Global roles	member	Manage S3 and other products, account, billing, projects
	billing	Manage billing in S3 and other products
	iam.admin	Manage access to S3 and other products
	iam.viewer	View access to S3 and other products
	reader	View S3 resources and all products, account, billing, projects

S3 roles

s3.admin

The s3.admin role provides access to manage S3 within a project. It does not provide access to S3 in other projects or other products in its own project.

Access scopes	Project
Who can be assigned	Service users
Available operations in S3	view the list of buckets in the project; view the content of buckets in the project; manage buckets in the project: create buckets; manage objects in buckets (upload, change settings, delete); change bucket settings (manage versioning, enable Object Lock, change bucket type, addressing, configure limits) *; delete buckets

* Cannot manage access policies or bypass temporary Object Lock blocks in the Control Panel.

s3.user

The s3.user role grants access to an S3 bucket if a bucket policy is configured in it that grants this user access to the bucket. The level of access is determined by bucket policy settings. Does not have access to S3 in other projects or other products in its own project.

Access scopes	Project
Who can be assigned	Service users
Available operations in S3	view the list of buckets in the project; operations in the bucket allowed by the bucket policy

s3.bucket.user

The s3.bucket.user role grants access to an S3 bucket if a bucket policy is configured in it that grants this user access to the bucket. The level of access is determined by bucket policy settings. Does not have access to S3 in other projects or other products in its own project.

Access scopes	Project
Who can be assigned	Service users
Available operations in S3	Operations in the bucket allowed by the bucket policy

object_storage.admin

For your information

The object_storage:admin role will soon be removed and cannot be assigned to new users. Existing users with the object_storage:admin role will continue to function.

Legacy version of the s3.admin role. Has identical permissions.

object_storage_user

For your information

The object_storage_user role will soon be removed and cannot be assigned to new users. Existing users with the object_storage_user role will continue to function.

Legacy version of the s3.user role. Has identical permissions.

Global roles

member

The member role provides full access to all services. It does not provide access to managing control panel users, service users, user groups, and federations.

Access scopes	account; project
Who can be assigned	users; service users; user groups
Available operations in S3	In the Account access scope: view the list of buckets in all projects; manage buckets in all projects: create buckets; change bucket settings (manage bucket policies, versioning, enable Object Lock, change bucket type, addressing, configure limits); manage objects in buckets (upload, change settings, delete); bypass temporary Governance mode block (Object Lock); manage projects, their limits and quotas; manage billing and view consumption
	In the Project access scope: view the list of buckets in the project; manage buckets in the project: create buckets; change bucket settings (manage bucket policies, versioning, enable Object Lock, change bucket type, addressing, configure limits); manage objects in buckets (upload, change settings, delete); bypass temporary Governance mode block (Object Lock)

billing

The billing role grants access to billing management without access to service management.

Access scopes	Account
Who can be assigned	users; service users; user groups
Available operations in S3	billing management; view S3 consumption

iam.admin

The iam.admin role grants access to manage users and does not grant access to product or billing management. It does not provide the ability to manage your account: change permissions, manage notifications, or delete a user. The first user with the iam.admin role is created by the Account Owner.

Access scopes	Account
Who can be assigned	users; service users; user groups
Available operations in S3	managing control panel users, service users, and user groups; issue S3 keys to users

iam.viewer

The iam.viewer role grants access to view everything managed by iam.admin.

Access scopes	Account
Who can be assigned	users; service users; user groups
Available operations in S3	Viewing control panel users, service users, and user groups

reader

The reader role grants access to view everything managed by member in the same access scope.

Access scopes	account; project
Who can be assigned	users; service users; user groups
Available operations in S3	In the Account access scope: view buckets in all projects: view the list of buckets; view bucket settings; view objects in buckets; view all projects, their limits and quotas; view billing and consumption data
	In the Project access scope: view the list of buckets in the project; view buckets in the project: view the list of buckets; view bucket settings; view objects in buckets

Keys for API access

Depending on the API type, you will need:

• IAM token for a project (X-Auth-Token). Used for access via Object Storage API and Swift API. Can only be issued to service users. To issue an IAM token for a project, use the Get an IAM token for a project subsection of the Request Authentication API documentation;
• S3 key (EC2 key). Used to sign S3 API requests and for FTP access. Consists of a pair of values — Access Key ID and Secret Key. You can add an S3 key for yourself or issue one to another user. Keys can be issued to service users and control panel users. In this case, the user must have a role that allows S3 access.