Bucket access without hand-built IAM drift

Provision S3 buckets with scoped credentials in one run.

s3ctl turns bucket creation, policy defaults, OVHcloud credential rotation, and batch provisioning into repeatable CLI workflows that are easy to ship into automation.

Install Documentation

$ s3ctl --bucket app-data \
  --create-scoped-credentials --dry-run
Bucket: app-data
  create planned: yes
  versioning:     enabled
  IAM user:       app-data
  policy:         bucket-readwrite

$ s3ctl --config ./examples/aws/s3ctl.json \
  --output json | jq '.resource_count'
2

$ s3ctl --provider ovh --bucket app-data \
  --ovh-rotate-credentials
Rotated scoped credentials for app-data

Release details

Latest stable build information.

Loading... Version

--- Commit

--- Published

APT signing key ---

Release highlights

Loading release highlights...

What it does

Provision, scope, and operate without the drift.

Provision Buckets and defaults

Create S3-compatible buckets, enable versioning, and apply reusable policy templates.

Scope One user per bucket

Generate least-privilege credentials for app teams without sharing master keys.

Operate OVHcloud workflows

Rotate credentials, repair policies, and delete empty containers with guardrails.

Install paths

Get started with your preferred install method.

Recommended

macOS and Linux. Tracks stable releases through the Netspeedy tap.

brew tap netspeedy/s3ctl
brew install s3ctl

Single-command install that selects the right release archive and handles macOS quarantine cleanup.

curl -fsSL https://netspeedy.github.io/s3ctl/install.sh | bash

Debian and Ubuntu hosts. Receives signed package updates from the release hub.

APT repository metadata will appear here after publication.

Use the published multi-arch GHCR image for container-native automation.

docker run --rm ghcr.io/netspeedy/s3ctl:latest

Channel Use case Package source