Object Access Keys
Object Access Keys
An access key is the S3 credential pair (access key + secret key) that clients use to authenticate against an object store —— the S3 equivalent of a username and password. Access keys exist independently of any one object store: you create a key once, then grant it access to one or more object stores (see Creating an object store and Editing an object store).
Each access key has a role:
- Admin
—— full administrative access, including (if the object store allows it) creating IAM users. - Regular
—— read/write access limited to the buckets the key has been permitted to use.
Creating an access key
Using the web interface
- Open Application Volumes > Objects > Access Keys and choose Create.
- Under Name, enter the access key.
- Enter the secret key (at least 8 characters) and choose the role.
- Confirm to create the access key.
Using the CLI
applications objects access_keys create --accessKey=<name> --secretKey=<secretKey> --role=<objectPermissions>
| Option | Description |
|---|---|
--accessKey=<name> |
The name of the access key. |
--secretKey=<secretKey> |
The secret key for the access key (at least 8 characters). |
--role=<objectPermissions> |
The key's permissions: Admin or Regular. |
Examples
Create an admin access key:
applications objects access_keys create --accessKey backup-admin --secretKey "a-strong-secret-key" --role Admin
Create a regular access key limited to whichever buckets it's later permitted to use:
applications objects access_keys create --accessKey backup-app --secretKey "another-strong-secret" --role Regular
Listing access keys
Secret keys are hidden by default; showing them requires the Admin role.
Using the web interface
Open Application Volumes > Objects > Access Keys. Use the toolbar to reveal secret keys if you have the Admin role.
Using the CLI
applications objects access_keys list [--accessKey=<name> --showSecretKeys]
| Option | Description |
|---|---|
--accessKey=<name> |
Filter results by access key. |
--showSecretKeys |
Show secret keys (requires the Admin role). |
Examples
List every access key:
applications objects access_keys list
List a specific access key along with its secret:
applications objects access_keys list --accessKey backup-admin --showSecretKeys
Editing an access key
You can rename an access key, change its secret, or change its role. Leave any field empty to keep its current value. If the access key is currently used by an object store, you'll be asked to confirm the change.
Using the web interface
- Open Application Volumes > Objects > Access Keys, select the key, and choose Edit.
- Under Editable Values, update the new access key name, secret key, and/or role as needed.
- Confirm the change.
Using the CLI
applications objects access_keys edit --accessKey=<name> [--newAccessKey=<name> --secretKey=<secretKey> --role=<objectPermissions>] [--force]
| Option | Description |
|---|---|
--accessKey=<name> |
The access key to edit. |
--newAccessKey=<name> |
The new name for the access key. Leave empty to keep the current name. |
--secretKey=<secretKey> |
The new secret key (at least 8 characters). Leave empty to keep the current secret key. |
--role=<objectPermissions> |
The new permissions: Admin or Regular. Leave empty to keep the current permissions. |
--force |
Skip the confirmation prompt when this access key is used by an object store. |
Examples
Rotate the secret key for an existing access key:
applications objects access_keys edit --accessKey backup-admin --secretKey "a-new-strong-secret"
Rename an access key and demote it to Regular:
applications objects access_keys edit --accessKey backup-app --newAccessKey backup-app-legacy --role Regular
Deleting an access key
An access key can't be deleted while it's still assigned to any object store —— remove it from every object store first (see Editing an object store).
Using the web interface
- Open Application Volumes > Objects > Access Keys, select the key, and choose Delete.
- Confirm the deletion.
Using the CLI
applications objects access_keys delete <name>
| Option | Description |
|---|---|
<name> |
The access key to delete. |
Example
applications objects access_keys delete backup-app-legacy
See also: Object Stores