Manage IAM Users and IAM Roles

IAM Users let you give each application its own Access Key with exactly the S3 permissions it needs, defined in a JSON policy similar to AWS IAM. Use an IAM User when a SubUser role is too broad for the job.

note

IAM Users and IAM Roles are available only for buckets on the HCM-04 cluster. On other clusters, use SubUsers to share limited access.

Compare IAM User, Admin Access Key, and SubUser

FPT Object Storage has three places that generate S3 credentials. They are not interchangeable, so check which one a key comes from before you share it.

	Admin Access Key	IAM User Access Key	SubUser Access Key
Cluster	All clusters	HCM-04 only	All clusters except HCM-04
Permission scope	Full access to the account	Exactly what the IAM policy allows	A role (Read, Write, Read - Write, or Full) for all buckets, narrowed per bucket with Bucket Policy
Key limit	5 per region	2 per IAM User	2 per SubUser

If your project is not on HCM-04 and you only need to share limited access, a SubUser is simpler to set up.

View IAM Users

1. Go to Object Storage, select the Project, and open the IAM User tab.
2. Use the switcher at the top to move between the IAM Users and IAM Roles views. The tab opens on IAM Users.
3. To find an IAM User, enter its name in the search box.

note

The IAM User tab appears only after Object Storage on HCM-04 is enabled for the Project.

Create an IAM User

1. On the IAM Users view, click Create IAM User.
2. Enter the IAM User Name. The name must:
   • be 1–64 characters long,
   • contain only letters, digits, and + = , . @ _ -,
   • be unique within the account. Names are not case-sensitive.
3. Click Create.

A new IAM User has no permissions and no Access Key. Attach a policy and generate a key before you use it.

Attach a policy to an IAM User

Each IAM User has exactly one JSON policy. Saving a policy replaces the previous one completely and takes effect immediately for every key of that user.

1. Open the detail page of the IAM User and select the IAM Policy tab.

2. Click Create IAM Policy. The editor opens with a sample template.

3. Edit the policy. The following example grants read and write access to one bucket:

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Sid": "AllowReadWriteOneBucket",
         "Effect": "Allow",
         "Action": ["s3:GetObject", "s3:PutObject", "s3:ListBucket"],
         "Resource": [
           "arn:aws:s3:::YOUR_BUCKET_NAME",
           "arn:aws:s3:::YOUR_BUCKET_NAME/*"
         ]
       }
     ]
   }

4. Click Save, then confirm the change.

warning

Some permissions cannot be granted, whatever the policy declares:

• Buckets outside your account are always denied.
• Identity management actions (iam:*) are blocked, even through a wildcard * action.
• s3:PutBucketPolicy, s3:PutBucketAcl, and s3:PutObjectAcl are always blocked.

If an action you need does not work, it may not be supported on the cluster yet. Contact FPT Cloud support before you troubleshoot further.

To remove all permissions from an IAM User, open the IAM Policy tab and click Delete Policy. The user remains, but all of its keys lose S3 access immediately.

Generate an Access Key for an IAM User

Each IAM User can have up to 2 Access Keys at a time.

1. Open the detail page of the IAM User and select the Access Key tab.
2. Click Generate Key. The system generates an Access Key and a Secret Key.
3. Copy both values and store them in a safe place.
4. Click I've saved the secret key.

warning

The Secret Key is shown only once. If you close the panel before you copy it, delete the key and generate a new one.

The key works immediately with the HCM-04 endpoint. Requests are denied until the IAM User has a policy.

Delete an Access Key of an IAM User

1. In the Access Key tab of the IAM User, open the row menu of the key and select Delete.
2. Type delete and click Delete.

danger

Deletion is immediate and cannot be undone. If an application still needs access, generate its new key and update the application before you delete the old key.

Delete an IAM User

1. In the IAM Users list, open the row menu and select Delete. You can also use Delete IAM User in the Danger Zone section of the detail page.
2. Type delete and click Delete. The system revokes all keys of the user and removes its policy, then deletes the user.

Buckets and data are not affected, because they belong to the account rather than to an identity.

warning

The system does not check your bucket policies before it deletes an IAM User. Statements that list the user as a Principal stop matching. If you later create an IAM User with the same name, those old statements may apply to the new user. Clean up your bucket policies before you reuse a name.

Manage IAM Roles

An IAM Role holds a shared set of permissions and a list of IAM Users trusted to use it, so you do not need to copy the same policy to every user.

warning

In this version, the Portal has no way to assume a role or get temporary credentials from it. A role works only as a Principal reference: you can copy its ARN into a bucket policy, but it does not give any IAM User working S3 access by itself.

1. On the IAM User tab, switch to the IAM Roles view and click Create Role.
2. Enter the Role Name, which follows the same rules as an IAM User name. Optionally, select the IAM Users allowed to use the role.
3. Click Create.
4. Open the detail page of the role, select the Role Policy tab, and attach a JSON policy. The format and limits are the same as for IAM User policies.

To change the trusted users, open the Detail tab of the role, go to the IAM Users card, and click Edit IAM Users. Saving replaces the whole list.

To delete a role, use Delete IAM Role in the Danger Zone section of its detail page and type delete to confirm. The role policy and trust relationships are removed, but the IAM Users are not deleted. As with IAM Users, clean up any bucket policy that lists the role ARN as a Principal yourself.