Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a webapp that requires uploading/deleting/reading files inside a S3 bucket.

What I did was I created a brand new Amazon WebServices (aka AWS) account. Let's call this AWS account team@webapp.com

I created a S3 bucket webapp-cdn when logged in as team@webapp.com

I know I need a key and secret so that my webapp can have read-write access to the bucket.

The team@webapp.com AWS account has a security credentials page which shows me this IAM system.

I created a User called webapp_system inside the IAM and a Group called s3_all_access. I put the webapp_system User inside the Group s3_all_access and granted ALL access to ALL buckets for members of this Group.

There is no way to select only specific buckets for access when I created the Group.

Now the User has its own key and secret. I can also generate a root credentials for the account team@webapp.com consisting of key and secret.

My question is which access keys should I use? I am confused by this IAM which I have never used before. At the same time, I appreciate having more granular User Authorization controls.

I have the following buckets setup in the same S3 account.

  • webapp-cdn : this is for LIVE server
  • webapp-stage: this is for Staging server
  • webapp-devt: this is for testing during development

I have tried exploring Role in IAM. It appears to be unsuitable.

I am not sure what is best. Ideally I prefer to have 1 unique pair of access key for each bucket. This is to reduce chances of developers leaking keys to the bucket responsible for the LIVE server.

I have read the FAQ but it confused me further than enlightened me.

Please advise.

Thank you.

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.