# S3 Buckets access
**URL:** https://renku.discourse.group/t/s3-buckets-access/1179
**Category:** General
**Created:** [5 September 2025 09:58 UTC](https://renku.discourse.group/t/s3-buckets-access/1179 "2025-09-05T09:58:26Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@lusamino](https://renku.discourse.group/u/lusamino)
#### Post date: [5 September 2025 09:58 UTC](https://renku.discourse.group/t/s3-buckets-access/1179/1 "2025-09-05T09:58:26Z")
Dear Renkuers,
I am really confused with the configuration of s3 buckets in Renku v2 projects. This is what I would like to have:
- I am the one who owns the buckets, and have added it using my own `Access_key_id` and `Secret_access_key`
- The project is Private.
- But I want everyone added to the project to have read&write rights to the bucket when using is from a Renku session.
Currently, my project is configured as:
- Visibility: Private
- Data connector: visibility private
- Access mode: allow read-write
I am pretty sure this was working before. But now, when another user is accessing it, at the time of creating the Session, it asks for the `access_key_id` and `secret_access_key`.
Do I have to grant access to the bucket to all users also in AWS such that they can create their own access keys? How can I do this more easily?
Thank you very very much 🤗
---
### Author:  [@rrrrrok](https://renku.discourse.group/u/rrrrrok)
#### Post date: [5 September 2025 10:00 UTC](https://renku.discourse.group/t/s3-buckets-access/1179/2 "2025-09-05T10:00:38Z")
Hi @lusamino - yes, the credentials are saved per user and not distributed with the data connector. So you need to hand your collaborators the access key / secret access key. If possible, I would recommend that you create a separate one for them so you can easily revoke it if needed.
---
### Author:  [@lusamino](https://renku.discourse.group/u/lusamino)
#### Post date: [5 September 2025 10:02 UTC](https://renku.discourse.group/t/s3-buckets-access/1179/3 "2025-09-05T10:02:08Z")
Great!!! All clear then! Just out of curiosity, was it always like this? Thank you!!!
---
### Author:  [@rrrrrok](https://renku.discourse.group/u/rrrrrok)
#### Post date: [5 September 2025 10:03 UTC](https://renku.discourse.group/t/s3-buckets-access/1179/4 "2025-09-05T10:03:47Z")
yes, it has been like this from the start 😃
---
### Author:  [@cramakri](https://renku.discourse.group/u/cramakri)
#### Post date: [5 September 2025 10:06 UTC](https://renku.discourse.group/t/s3-buckets-access/1179/5 "2025-09-05T10:06:45Z")
What I have done on AWS is to create an IAM user and give it read-write access to the S3 bucket. It’s probably sufficient to have just one IAM user that is used by all collaborators, but you could create more than one if that seems necessary.
---
### Author:  [@lusamino](https://renku.discourse.group/u/lusamino)
#### Post date: [5 September 2025 11:36 UTC](https://renku.discourse.group/t/s3-buckets-access/1179/6 "2025-09-05T11:36:26Z")
Wonderful! Yes, this sounds as the best option. I will just share the keys from this IAM user with all collabs, and that it is.
Thank you!
---
### Author:  [@cramakri](https://renku.discourse.group/u/cramakri)
#### Post date: [5 September 2025 13:12 UTC](https://renku.discourse.group/t/s3-buckets-access/1179/7 "2025-09-05T13:12:49Z")
To fill in a few details. I do the following:
**Create an IAM user group**
For the data connector, I create a user group using the naming pattern `[data-connector-name]-writers`, e.g., _my-awesome-data-writers_. (In this case, it sounds like you don’t, but in general, you may also have a group for readers.)
This group has the following policy:
```auto
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowS3ReadWrite",
"Effect": "Allow",
"Action": [
"s3:Get*",
"s3:PutObject",
"s3:Describe*",
"s3:List*",
"s3:DeleteObject",
"s3:AbortMultipartUpload"
],
"Resource": [
"arn:aws:s3:::[bucket-name]",
"arn:aws:s3:::[bucket-name]/*"
]
}
]
}
```
(Replace `[bucket name]` with the name of your bucket.)
**Create user(s)**
Then create a user, associating it with the user group above when you make it. You can repeat this step if you want multiple users.