Discuss with expertTry it for free
© 2026 Direct Cursus Technology L.L.C.

Creating an access key

Written by
Updated at October 30, 2026
View in Markdown

To use Object Storage via the S3 API you need an access key. Access keys are created in Identity and Access Management using a service account. You can use a static key or release a temporary key based on the static key, with limited permissions and validity.

Getting started

  1. Make sure you have a project.
  2. Make sure there is a bucket in your project.

  1. Create a service account in your project:

    kubectl create serviceaccount <service_account_name> -n <project_name>

  2. Assign to the service account the storage.editor role for access to buckets:

    apiVersion: iam.stackland.yandex.cloud/v1alpha1
kind: AccessBinding
metadata:
  name: <service_account_name>-storage-access
  namespace: <project_name>
spec:
  roleID: storage.editor
  subject:
    kind: ServiceAccount
    name: <service_account_name>
    namespace: <project_name>

    Save the manifest to a file named access-binding.yaml and apply it:

    kubectl apply -f access-binding.yaml

  3. Create a static access key for the service account:

    apiVersion: iam.stackland.yandex.cloud/v1alpha1
kind: AccessKey
metadata:
  name: <service_account_name>-s3-key
  namespace: <project_name>
spec:
  serviceAccountRef: <service_account_name>

    Save the manifest to a file named access-key.yaml and apply it:

    kubectl apply -f access-key.yaml

  4. Check the key status:

    kubectl get accesskey <service_account_name>-s3-key -n <project_name>

    Wait for the READY column to show True. You will see the new secret name in the SECRET column and the status.secretName field.

  5. Get the ID and the secret key part from the secret:

    S3_SECRET_NAME=$(kubectl get accesskey <service_account_name>-s3-key -n <project_name> -o jsonpath='{.status.secretName}')
export AWS_ACCESS_KEY_ID=$(kubectl get secret -n <project_name> "$S3_SECRET_NAME" -o jsonpath='{.data.access-key-id}' | base64 -d)
export AWS_SECRET_ACCESS_KEY=$(kubectl get secret -n <project_name> "$S3_SECRET_NAME" -o jsonpath='{.data.access-key-secret}' | base64 -d)
export AWS_DEFAULT_REGION=ru-central1
unset AWS_SESSION_TOKEN

  6. Check your connection to Object Storage:

    export CLUSTER_DOMAIN=$(kubectl get platformenvironments main -o jsonpath='{.status.clusterDomain}')
aws --endpoint-url=https://storage.sys.$CLUSTER_DOMAIN s3 ls

  1. If you have not opened a project yet, select one.

  2. In the left-hand menu, select Service accounts.

  3. Click Create service account.

  4. Enter a name for the service account and click Create.

  5. Select the new service account.

  6. Go to the Access keys tab.

  7. Click Create key.

  8. Save the Access Key ID and Secret Access Key.

    Warning

    The secret key is only displayed once. Save it to a secure location.

  9. Assign the storage.editor role to the service account:

    1. Go to the Access permissions section of your project.
    2. Click Assign role.
    3. Select the storage.editor role.
    4. Select the new service account as the subject.
    5. Click Assign.

Creating a temporary access key

STS is enabled automatically together with Object Storage. Use the AWS CLI and the https://sts.sys.<cluster domain> endpoint to get the key.

  1. Create a service account, assign it the required permissions for the bucket, and get a static key using the guide above. Configure the AWS CLI to use this key. Service account permissions must cover operations you want to allow for the application.

  2. Save the temporary access policy to the policy.json file. For example, grant read access restricted to objects with the reports/ prefix in the app-data bucket:

    {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::app-data/reports/*"
    }
  ]
}

    Replace the bucket name and prefix with your own. Configure access to only one bucket per STS policy. For more information about the policy format, see this STS guide.

  3. Request a temporary key for one hour:

    aws --endpoint-url=https://sts.sys.<cluster_domain> --region ru-central1 sts assume-role \
  --role-arn stackland-storage-session \
  --role-session-name reports-reader \
  --policy file://policy.json \
  --duration-seconds 3600

    In --role-arn, provide a random description of 20 characters or longer, and in --role-session-name, specify the session name. To set them, use Latin letters, digits, _ and -. The --duration-seconds parameter sets the lifetime in seconds, up to a maximum of 43200 (12 hours).

  4. From the Credentials section in the response, provide the AccessKeyId, SecretAccessKey, and SessionToken to the application. For the AWS CLI, set them in a separate terminal session:

    export AWS_ACCESS_KEY_ID='<AccessKeyId>'
export AWS_SECRET_ACCESS_KEY='<SecretAccessKey>'
export AWS_SESSION_TOKEN='<SessionToken>'

    When working with a temporary key, a session token is required. The Expiration field shows the key expiration time.

  5. Check that you can read an existing object from the allowed prefix:

    aws --endpoint-url=https://storage.sys.<cluster_domain> --region ru-central1 s3 cp \
  s3://app-data/reports/<object_name> ./

    Replace this path with the path to your object. To get the next temporary key, use the original static key again.

Available roles

  • storage.viewer: Allows you to read objects and get a bucket list.
  • storage.editor: Allows you to read, create, edit, and delete objects.
  • storage.admin: Full access to Object Storage, including bucket settings management.

What's next

Previous
Creating a bucket
Next
Deleting a bucket