Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a webapp that requires uploading/deleting/reading files inside a S3 bucket.

What I did was I created a brand new Amazon WebServices (aka AWS) account. Let's call this AWS account

I created a S3 bucket webapp-cdn when logged in as

I know I need a key and secret so that my webapp can have read-write access to the bucket.

The AWS account has a security credentials page which shows me this IAM system.

I created a User called webapp_system inside the IAM and a Group called s3_all_access. I put the webapp_system User inside the Group s3_all_access and granted ALL access to ALL buckets for members of this Group.

There is no way to select only specific buckets for access when I created the Group.

Now the User has its own key and secret. I can also generate a root credentials for the account consisting of key and secret.

My question is which access keys should I use? I am confused by this IAM which I have never used before. At the same time, I appreciate having more granular User Authorization controls.

I have the following buckets setup in the same S3 account.

  • webapp-cdn : this is for LIVE server
  • webapp-stage: this is for Staging server
  • webapp-devt: this is for testing during development

I have tried exploring Role in IAM. It appears to be unsuitable.

I am not sure what is best. Ideally I prefer to have 1 unique pair of access key for each bucket. This is to reduce chances of developers leaking keys to the bucket responsible for the LIVE server.

I have read the FAQ but it confused me further than enlightened me.

Please advise.

Thank you.

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.