{"id":"cloud-accounts.what-aws-permissions-does-storage-studio-need","url":"/faq/cloud-accounts/what-aws-permissions-does-storage-studio-need","category":{"id":"cloud-accounts","title":"Cloud accounts"},"subcategory":{"id":"amazon-s3","title":"Amazon S3"},"question":"What AWS permissions should the S3 user for Storage Studio have?","alt_questions":["Least privilege IAM user for Storage Studio","Which IAM policy for Storage Studio S3?","Should I use my root AWS account in Storage Studio?","Minimum S3 permissions for backups","Create an AWS user for Storage Studio"],"short_answer":"Give a dedicated user read, write and delete access to objects in your one bucket — nothing more, and never your main AWS login. Storage Studio doesn't need to create buckets or list every bucket.","answer_markdown":"Only what it needs: read, write and delete objects in the one bucket you'll use — nothing more. Create a separate user for this in the AWS console rather than using your main AWS login.\n\nStorage Studio doesn't need permission to create buckets or to list every bucket in your account; it works with the bucket you name in the account. When you create the user's access key, Amazon shows the secret only once, so copy both the key and the secret into a password manager straight away.\n\nKeeping access this narrow means that if a key ever leaks, it can only touch that one bucket.","answer_html":"

Only what it needs: read, write and delete objects in the one bucket you'll use — nothing more. Create a separate user for this in the AWS console rather than using your main AWS login.

\n

Storage Studio doesn't need permission to create buckets or to list every bucket in your account; it works with the bucket you name in the account. When you create the user's access key, Amazon shows the secret only once, so copy both the key and the secret into a password manager straight away.

\n

Keeping access this narrow means that if a key ever leaks, it can only touch that one bucket.

","answer_text":"Only what it needs: read, write and delete objects in the one bucket you'll use — nothing more. Create a separate user for this in the AWS console rather than using your main AWS login.\n\nStorage Studio doesn't need permission to create buckets or to list every bucket in your account; it works with the bucket you name in the account. When you create the user's access key, Amazon shows the secret only once, so copy both the key and the secret into a password manager straight away.\n\nKeeping access this narrow means that if a key ever leaks, it can only touch that one bucket.","tags":["amazon s3","aws iam","least privilege","security"],"related":[{"id":"cloud-accounts.how-do-i-connect-amazon-s3","question":"How do I connect an Amazon S3 bucket to Storage Studio?","url":"/faq/cloud-accounts/how-do-i-connect-amazon-s3"},{"id":"cloud-accounts.access-denied-when-listing-buckets","question":"Why do I get \"Access Denied\" when listing S3 buckets?","url":"/faq/cloud-accounts/access-denied-when-listing-buckets"},{"id":"cloud-accounts.how-do-i-replace-a-leaked-s3-secret-key","question":"My S3 secret key may have leaked. What should I do?","url":"/faq/cloud-accounts/how-do-i-replace-a-leaked-s3-secret-key"}],"applies_to":"all","last_reviewed":"2026-10-01","title":"What AWS permissions should the S3 user for Storage Studio have? — Storage Studio FAQ","description":"Give a dedicated user read, write and delete access to objects in your one bucket — nothing more, and never your main AWS login. Storage Studio doesn't need to create buckets or list every bucket.","crumbs":[{"name":"Home","path":"/"},{"name":"FAQ","path":"/faq/"},{"name":"Cloud accounts","path":"/faq/cloud-accounts/"},{"name":"What AWS permissions should the S3 user for Storage Studio have?","path":"/faq/cloud-accounts/what-aws-permissions-does-storage-studio-need"}],"jsonld":{"@context":"https://schema.org","@type":"FAQPage","url":"https://storagestudio.us/faq/cloud-accounts/what-aws-permissions-does-storage-studio-need","inLanguage":"en","dateModified":"2026-10-01","mainEntity":[{"@type":"Question","name":"What AWS permissions should the S3 user for Storage Studio have?","alternateName":["Least privilege IAM user for Storage Studio","Which IAM policy for Storage Studio S3?","Should I use my root AWS account in Storage Studio?","Minimum S3 permissions for backups","Create an AWS user for Storage Studio"],"acceptedAnswer":{"@type":"Answer","text":"Only what it needs: read, write and delete objects in the one bucket you'll use — nothing more. Create a separate user for this in the AWS console rather than using your main AWS login.\n\nStorage Studio doesn't need permission to create buckets or to list every bucket in your account; it works with the bucket you name in the account. When you create the user's access key, Amazon shows the secret only once, so copy both the key and the secret into a password manager straight away.\n\nKeeping access this narrow means that if a key ever leaks, it can only touch that one bucket.","url":"https://storagestudio.us/faq/cloud-accounts/what-aws-permissions-does-storage-studio-need"}}]},"fragment":"
\n
\n\n\n\n\n
\n
\n

Cloud accounts · Amazon S3

\n

What AWS permissions should the S3 user for Storage Studio have?

\n

Short answer: Give a dedicated user read, write and delete access to objects in your one bucket — nothing more, and never your main AWS login. Storage Studio doesn't need to create buckets or list every bucket.

\n

Only what it needs: read, write and delete objects in the one bucket you'll use — nothing more. Create a separate user for this in the AWS console rather than using your main AWS login.

\n

Storage Studio doesn't need permission to create buckets or to list every bucket in your account; it works with the bucket you name in the account. When you create the user's access key, Amazon shows the secret only once, so copy both the key and the secret into a password manager straight away.

\n

Keeping access this narrow means that if a key ever leaks, it can only touch that one bucket.

\n\n

Last reviewed

\n\n

Related questions

\n

Also available as Markdown and JSON.

\n
"}