CreateAccessKeyRequest

namestring

Name of the access key. 1-128 characters; only alphanumeric and +=,.@_- characters are allowed.

user_idstringrequired

ID of the user for whom the access key is being created

user_roleOrgMembership

Role of the user in the organization. Controls what the user can do through the Partner API management endpoints.

• Admin: Full org access. Can list and manage all access keys in the org, update org settings, and manage users. ListAccessKeys returns all keys in the org.
• Member: Standard access. Can only manage their own access keys. ListAccessKeys returns only keys owned by this user.

If omitted, defaults to Member behavior.

Possible values: [Admin, Member]

buckets_roles object[]

Bucket roles to assign to the new key. Omit to create a key with no bucket roles.

Array [

bucket_namestringrequired

Name of the bucket

rolestringrequired

The role defines the permissions for the associated bucket:

• ReadOnly: Read operations such as GetObject, HeadObject and ListObjects, plus creating bucket snapshots and forks.

• ReadWrite: Everything in ReadOnly, plus object writes: PutObject, DeleteObject, CopyObject, object tagging and multipart uploads. Cannot change bucket configuration.

• Editor: Everything in ReadWrite, plus full bucket administration: CORS, lifecycle, tagging, ownership controls, inventory, bucket ACLs (including making the bucket public), custom domains, delete protection, shadow bucket, origin, object notifications, storage tier, and DeleteBucket. Cannot manage bucket shares or create bucket IAM policies.

• Admin: Full access to all buckets in the org, bypasses all permission checks. When used with bucket_name: "*", the access key is treated as a full org admin. The value of bucket_name should always be * when using this role.

  Example:

  { "bucket_name": "*", "role": "Admin" }

Possible values: [ReadOnly, ReadWrite, Editor, Admin]

]

attach_policiesstring[]

Names of existing IAM policies to attach to this access key. All policies must already exist — if any policy name is invalid, the request fails and no key is created.

create_policies object[]

New IAM policies to create and attach to this access key. Each policy is created first, then attached atomically. If a policy with the same name already exists the request fails — use attach_policies to reuse an existing policy. If policy document validation fails, no key is created.

Array [

namestringrequired

Name of the policy. Must be unique within the organization. 1-128 characters; only alphanumeric characters and +=,.@_- are allowed.

document objectrequired

AWS IAM-compatible policy document. See IAM Policies documentation for details.

Versionstringrequired

Policy language version.

Possible values: [2012-10-17]

Statement object[]required

Array [

Sidstring

Optional identifier for the statement

Effectstringrequired

Whether this statement allows or denies the specified actions

Possible values: [Allow, Deny]

Actionstring[]required

S3 actions to allow or deny. Common actions: s3:GetObject, s3:PutObject, s3:DeleteObject, s3:ListBucket, s3:*. See supported actions.

Resourcestring[]required

S3 resource ARNs. Use arn:aws:s3:::bucket for bucket-level and arn:aws:s3:::bucket/prefix/* for prefix-scoped access.

Conditionobject

Optional conditions (IP, time-based). See condition examples.

]

descriptionstring

A description for the policy. Max 1000 characters.

]

access_key_scopeAccessKeyScope

Controls whether the key receives the implicit default-allowed operations (such as create bucket or list buckets) on top of what its policies and bucket roles grant.

• standard (default): grants the default-allowed operations.
• no_default_allow: denies them, so the key can do only what its policies and bucket roles explicitly allow.

Possible values: [standard, no_default_allow]

CreateAccessKeyRequest

{
  "name": "string",
  "user_id": "string",
  "user_role": "Admin",
  "buckets_roles": [
    {
      "bucket_name": "string",
      "role": "ReadOnly"
    }
  ],
  "attach_policies": [
    "string"
  ],
  "create_policies": [
    {
      "name": "string",
      "document": {
        "Version": "2012-10-17",
        "Statement": [
          {
            "Sid": "string",
            "Effect": "Allow",
            "Action": [
              "string"
            ],
            "Resource": [
              "string"
            ],
            "Condition": {}
          }
        ]
      },
      "description": "string"
    }
  ],
  "access_key_scope": "standard"
}