---
title: "Managing User S3 Permissions"
slug: "managing-user-s3-permissions"
updated: 2026-10-28T01:54:03Z
published: 2026-10-28T01:54:03Z
canonical: "docs.vastdata.com/managing-user-s3-permissions"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vastdata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Managing User S3 Permissions

To grant client users S3 access:

- Provide each client user with an S3 key pair for authenticating to the VAST Cluster S3 service. Key pairs can be created, removed, enabled and disabled via the VMS. The key pair allows access to a single tenant on the cluster.

Alternatively, you can [enable](/docs-5-4/docs/en/enabling-active-directoryldap-users-to-create-s3-access-key-pairs) Active Directory/LDAP users to create and manage their own S3 access key pairs.
- Attach [identity policies](/docs-5-4/docs/managing-identity-policies) to users to best control their S3 permissions. This includes all permissions, including permission to create and delete buckets which cannot be controlled via ACLs.
- Another way of granting special permissions to individual users is through specific permission settings per user. These can give permission to create buckets, permission to delete buckets and S3 superuser permissions to override ACLs in a bucket.

> [!NOTE]
> Note
> 
> These permission settings are overridden by any conflicting statements in any [identity policies](/docs-5-4/docs/managing-identity-policies) that are attached to the user or to a group to which the user belongs.

To grant these permissions through the VAST Web UI , see [Managing S3 User Access from the VAST Web UI](/docs-5-4/docs/en/managing-s3-user-access-from-the-vast-web-ui). Managing S3 User Access from the VAST Web UI

To grant these permission through the VAST CLI, see [Managing S3 Access from the VAST CLI](/docs-5-4/docs/en/managing-s3-access-from-the-vast-cli).Managing S3 Access from the VAST CLI