Scoped credentials

With --create-scoped-credentials, s3ctl gives each bucket its own identity instead of sharing a master key. On the s3 provider it goes through the IAM API and, for every bucket:

1. Creates an IAM user, tagged ManagedBy=s3ctl and Bucket=<bucket>.

2. Attaches an inline policy named s3ctl-bucket-access, built from the credential template.

3. Creates an access key for that user and prints it.

If attaching the policy or creating the key fails, s3ctl deletes the user it just made, so a failed run doesn’t leave half-provisioned identities behind.

The secret is shown once

The secret access key is only returned on the run that creates it. Store it before you close the terminal, or read it from --output json straight into your secret store.

What the key can do

--credential-policy-template picks the policy. The default is bucket-readwrite.

Template	Access to one bucket
bucket-readonly	Find the bucket’s location, list it and read objects.
bucket-readwrite	All of that, plus writes, deletes and multipart uploads.
bucket-admin	Every S3 action on the bucket and its objects.

s3ctl --bucket app-data --create-scoped-credentials \
  --credential-policy-template bucket-readonly --dry-run

Policy templates shows the exact policy each one attaches.

User names

By default the user is named after the bucket. Characters IAM doesn’t allow in a user name become -. To change that:

• --iam-user-prefix puts a shared prefix on every generated name
• --iam-path creates the users under an IAM path
• --iam-user-name sets the name outright, for a run with a single bucket

In a batch file, the iam_user_name column does the same per row.

Other IAM endpoints

AWS IAM is the default target. For an IAM-compatible service elsewhere, set --iam-endpoint, or iam_endpoint in the config. IAM permissions lists what the principal running s3ctl needs.

On OVHcloud

OVHcloud doesn’t use IAM users for this. With --provider ovh, s3ctl creates a Public Cloud user and an S3 credential pair per bucket, attaches it with a container profile and imports an S3 user policy scoped to the bucket. The OVHcloud overview explains how that policy behaves.