---
title: "Managing S3 User Permissions"
slug: "managing-s3-user-permissions"
tags: ["5.5"]
updated: 2026-10-27T23:00:54Z
published: 2026-10-27T23:00:54Z
canonical: "docs.vastdata.com/managing-s3-user-permissions"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vastdata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Managing S3 User Permissions

## Managing User S3 Permissions

To grant client users S3 access:

- Provide each client user with an S3 key pair for authenticating to the VAST Cluster S3 service. Key pairs can be created, removed, enabled and disabled via the VMS. The key pair allows access to a single tenant on the cluster.

Alternatively, you can [enable](/docs-5-5/docs/managing-s3-user-permissions#enabling-active-directoryldap-users-to-create-s3-access-key-pairs) Active Directory/LDAP users to create and manage their own S3 access key pairs.
- Attach [identity policies](/docs-5-5/docs/managing-identity-policies) to users to best control their S3 permissions. This includes all permissions, including permission to create and delete buckets which cannot be controlled via ACLs.
- Another way of granting special permissions to individual users is through specific permission settings per user. These can give permission to create buckets, permission to delete buckets and S3 superuser permissions to override ACLs in a bucket.

> [!NOTE]
> Note
> 
> These permission settings are overridden by any conflicting statements in any [identity policies](/docs-5-5/docs/managing-identity-policies) that are attached to the user or to a group to which the user belongs.

To grant these permissions through the VAST Web UI , see [Managing S3 User Access from the VAST Web UI](/docs-5-5/docs/managing-s3-user-permissions#managing-s3-user-access-from-the-vast-web-ui).

To grant these permission through the VAST CLI, see [Managing S3 Access from the VAST CLI](/docs-5-5/docs/managing-s3-user-permissions#managing-s3-access-from-the-vast-cli).

## Managing S3 User Access from the VAST Web UI

- [Granting Access and Permissions](/docs-5-5/docs/managing-s3-user-permissions#granting-access-and-permissions)
- [Enabling and Disabling a Key Pair](/docs-5-5/docs/managing-s3-user-permissions#enabling-and-disabling-a-key-pair)
- [Removing a Key Pair](/docs-5-5/docs/managing-s3-user-permissions#removing-a-key-pair)

### Granting Access and Permissions

1. In the Users tab of the User Management page, display the user for which you want to generate a key pair:

  - You can [query VMS](/docs-5-5/docs/querying-users-or-groups) for an existing user. This can be either any user whose attributes were already retrieved from external authorization providers through NFS or SMB RPCs. It can also be an existing local user.
  - You can [create a new user](/docs-5-5/docs/vast-providers#managing-local-users) on the VAST provider.
2. Right-click the user and select Edit.
3. In the Update User dialog, do one of the following:

  - Create a new key pair. To do this, click Create new key .
  - Provide a key pair:

    1. Click Provide access and secret keys.
    2. In the Access Key field, enter a string with maximum length 21 characters.
    3. In the Secret Key field, enter a string with maximum length 41 characters.
    4. Click Create new key.

The access key you created or provided is displayed with its status (enabled by default).

The secret key is displayed below it with a Copy key button.
4. Click Copy key to copy the secret key to your clipboard.

> [!WARNING]
> Important
> 
> The secret key for this pair will not be shown again, so keep the key carefully to pass it onto the user.
5. Attach identity policies to control the user's S3 permissions:

  1. From the Identity Policies dropdown, select an identity policy that you want to attach to the user.

The policy name is entered into the Identity Policies field.

> [!NOTE]
> Note
> 
> If the policy that you select covers permission to create and/or delete buckets, the policy will override the Allow Create Bucket and Allow Delete Bucket permission settings per user.
  2. If you want to attach another policy to the user, open the dropdown again and select another policy. The first policy that you already attached appears checked in the dropdown list.

The second policy is also added to the Identity Policies field.
  3. Repeat as needed to attach additional policies to the user. To remove policies, open the dropdown and deselect each policy that you want to remove.
6. Alternatively to the previous step, grant the user any of the special S3 permissions:

  - Allow Create Bucket. Allows the user to create S3 buckets.
  - Allow Delete Bucket. Allows the user to delete S3 buckets.
  - S3 Superuser. Allows the user full read and write access to data and metadata, overriding ACLs.

> [!NOTE]
> **Note**
> 
> This is a legacy feature. VAST S3 Superuser permission is only available if it was set for a user prior to upgrade to version 5.2.
7. Click Update to update the user definition.

You can now provide the user with the access key and the secret key.

### Enabling and Disabling a Key Pair

> [!NOTE]
> Note
> 
> Access key pairs that are replicated to the cluster from an async replication peer are disabled by default.

1. Display the user on the Users tab of the User Management page (see [Querying Users or Groups](/docs-5-5/docs/querying-users-or-groups)).
2. Open the Actions menu for the user and select Edit.

In the Update User dialog, the status of each of the user's key pairs is shown (enabled or disabled).
3. To enable a key pair, click ![enable_key_button.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/img-f2e9c358cacc3b6424f65d5547849cee(11).png?sv=2026-02-06&spr=https&st=2026-11-08T08%3A56%3A12Z&se=2026-11-08T09%3A56%3A12Z&sr=c&sp=r&sig=sVYC6iV46VPRzXzWET8C6JOqwZS9ioirT4t9ayABi24%3D). To disable a key pair, click ![disable_button.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/img-43a704e52741561f44e2455482cf2a98(11).png?sv=2026-02-06&spr=https&st=2026-11-08T08%3A56%3A12Z&se=2026-11-08T09%3A56%3A12Z&sr=c&sp=r&sig=sVYC6iV46VPRzXzWET8C6JOqwZS9ioirT4t9ayABi24%3D).

### Removing a Key Pair

1. Display the user on the Users tab of the User Management page (see [Querying Users or Groups](/docs-5-5/docs/querying-users-or-groups)).
2. Open the Actions menu for the user and select Edit.

In the Update User dialog, the access key of the key pair is listed.
3. Click the delete button (![delete_button.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/img-95be548bba35d5040b9daf0175dab88f(11).png?sv=2026-02-06&spr=https&st=2026-11-08T08%3A56%3A12Z&se=2026-11-08T09%3A56%3A12Z&sr=c&sp=r&sig=sVYC6iV46VPRzXzWET8C6JOqwZS9ioirT4t9ayABi24%3D)) for the access key.
4. Click Yes to confirm the removal.

The key pair is removed.

## Managing S3 Access from the VAST CLI

- [Generating an S3 Access Key Pair](/docs-5-5/docs/managing-s3-user-permissions#generating-an-s3-access-key-pair)
- [Granting S3 Permissions](/docs-5-5/docs/managing-s3-user-permissions#granting-s3-permissions)
- [Enabling and Disabling a Key Pair](/docs-5-5/docs/managing-s3-user-permissions#enabling-and-disabling-a-key-pair1)
- [Removing a Key Pair](/docs-5-5/docs/managing-s3-user-permissions#removing-a-key-pair)

### Generating an S3 Access Key Pair

To generate an S3 access key pair for a user, use the [user generate-key](/docs-5-5/docs/user-generate-key) command.

### Granting S3 Permissions

To attach or remove S3 identity policies for a user on any provider, use [user query](/docs-5-5/docs/user-query).

To grant or remove from users specific permission to create buckets, permission to delete buckets, and permission to override ACLs (S3 superuser permission) use one of the following commands:

- For a user that resides on an external provider, use [user query](/docs-5-5/docs/user-query).
- For a user on the VAST provider, use [user modify](/docs-5-5/docs/user-modify).

> [!NOTE]
> Note
> 
> These create bucket, delete bucket and S3 super user permissions are overridden by any conflicting permission statements in attached S3 identity policies.

### Enabling and Disabling a Key Pair

To enable or disable an S3 access key pair, use [user modify-key](/docs-5-5/docs/user-modify-key).

### Removing a Key Pair

To remove a user's S3 access key pair, use [user remove-key](/docs-5-5/docs/user-remove-key).

## Enabling Active Directory/LDAP Users to Create S3 Access Key Pairs

The VMS REST API provides an endpoint that creates and deletes S3 access key pairs for the requesting user. This endpoint is accessible to users on an Active Directory/LDAP server that is connected to the cluster. Users can also retrieve the access key of a given access key pair and the status of the key pair.

### How to Enable the Required Access for Active Directory/LDAP Users

- Ensure that the relevant users belong to an Active Directory or other LDAP-based directory server that is connected to the VAST Cluster.

This enables valid login to the S3 keys API endpoint for client users on the Active Directory/LDAP server.

A user may now authenticate to the VMS REST API using their Active Directory/LDAP credentials and send POST, GET and DELETE requests to the *<vms_vip>/api/s3keys/* endpoint to create, and delete their own s3 access key pair(s) and view the enabled/disabled status of such a key pair.
- You can optionally provide the same users with broader VMS access by mapping Active Directory/LDAP group(s) to VMS RBAC roles (see [VMS manager role](/docs-5-5/docs/managing-administrative-roles) ).

### How to Create and Manage an S3 Access Key Pair as an Active Directory/LDAP User

- [Creating an S3 Access Key Pair](/docs-5-5/docs/managing-s3-user-permissions#creating-an-s3-access-key-pair)
- [Retrieving the S3 Access Key Pair's Properties](/docs-5-5/docs/managing-s3-user-permissions#retrieving-the-s3-access-key-pairs-properties)
- [Deleting an S3 Access Key Pair](/docs-5-5/docs/managing-s3-user-permissions#deleting-an-s3-access-key-pair)

#### Creating an S3 Access Key Pair

To create an access key pair, send a `POST` request to the `https://&lt;VMS_VIP&gt;/api/s3keys/` endpoint. In this example, the user sends their Active Directory or LDAP username and password for basic authentication:

> [!NOTE]
> Note
> 
> This feature supports Active Directory users on the joined domain only.

```plaintext
vastdata@v112lg1:/home/vastdata $ curl -u "vms_ad_user:vastdata" -X POST https://10.71.200.112/api/s3keys/ -k
```

A new pair is created. The access key and secret key are returned in the response:

```plaintext
{"access_key":"4XACULB2SLCZ80ZQPVMX","secret_key":"KgZYAI4E66+CWhYiUM5dvyICBjXzfwg/HWoxL9Et"}
```

> [!NOTE]
> Note
> 
> The operation requires basic authentication. You can either authenticate each request as done in the examples, or you can use secure authentication by JSON Web Tokens (JWTs) over HTTPS. For information about how to authenticate with JWTs, see *Authenticating to the VMS REST API* in the VMS REST API documentation, which is available on your cluster's management network at *https://<VMS_VIP>/docs/index.html*.

#### Retrieving the S3 Access Key Pair's Properties

Sending a GET request to the `https://&lt;VMS_VIP&gt;/api/s3keys` endpoint returns details of previously created key pairs:

```plaintext
6vastdata@v112lg1:/home/vastdata $ curl -u "vms_ad_user:vastdata" -X GET https://10.71.200.112/api/s3keys/ -k
```

The response includes the access key, and the status of the key (whether enabled or not):

```plaintext
{"4XACULB2SLCZ80ZQPVMX":{"enabled":true,"identifier":"sid"}}
```

> [!NOTE]
> Note
> 
> It also includes an identifier, which indicates whether the key was associated with the user's SID or UID, if both are present on the Active Directory/LDAP server. This can be relevant in case of later administrative changes where a UID can be associated with a different user, in which case the S3 access remains linked to the original identifier.

#### Deleting an S3 Access Key Pair

To delete an S3 access key pair, send a DELETE request to the same endpoint, providing the access key only as the `access_key` property in the body parameter. For example:

```plaintext
vastdata@v112lg1:/home/vastdata $ curl -u "vms_ad_user:vastdata" -X DELETE https://10.71.200.112/api/s3keys/ -d '{"access_key":"4XACULB2SLCZ80ZQPVMX"}' 
-k -H "accept: application/json" -H "Content-Type: application/json"
```