Getting started with the AWS CLI in Yandex Object Storage

1. Go to the management console and log in to Yandex Cloud or sign up if not signed up yet.

2. On the Yandex Cloud Billing page, make sure you have a billing account linked and it has the ACTIVE or TRIAL_ACTIVE status. If you do not have a billing account, create one.

3. On the Access bindings page, make sure you have the following minimum roles:

   • To create a service account and get access keys for it: iam.serviceAccounts.admin for a folder. If you want to use an existing service account, the iam.serviceAccounts.admin role for that service account will be enough.
   • To assign a role to a service account: storage.admin for a bucket or folder.

   If you have a primitive admin role for a folder, you do not need to assign any additional roles.

1. Create a service account:

   1. Go to the management console.

   2. On the left side of the screen, click the line with the name of the folder where you want to create a service account.

   3. In the list of services, select Identity and Access Management.

   4. Click Create service account.

   5. Enter a name for the service account.

      The name format requirements are as follows:

      • The name must be from 3 to 63 characters long.
      • It may contain lowercase Latin letters, numbers, and hyphens.
      • The first character must be a letter and the last character cannot be a hyphen.

      Make sure the service account name is unique within your cloud.

   6. Click Create.

   You can also use an existing service account.

   For more information, see Creating a service account.

2. Assign a role, e.g., storage.editor, for a folder to a service account:

   1. In the management console, select the cloud or folder.
   2. Go to the Access bindings tab.
   3. Click Configure access.
   4. In the window that opens, select Service accounts.
   5. Select the service account from the list or use the search to locate it.
   6. Click Add role and select the role from the list or use the search bar to locate it.
   7. Click Save.

   For more information, see Assigning roles to a service account.

   Note

   A service account is only allowed to view a list of buckets in the folder it was created in.

   A service account can perform actions with objects in buckets that are created in folders different from the service account folder. To enable this, assign the service account roles for the appropriate folder or its bucket.

3. Create a static access key

   1. In the management console, navigate to the folder the service account belongs to.

   2. In the list of services, select Identity and Access Management.

   3. In the left-hand panel, select Service accounts.

   4. In the list that opens, select the service account.

   5. Click Create new key in the top panel.

   6. Select Create static access key.

   7. Specify the key description and click Create.

   8. Save the ID and secret key.

      Alert

      After you close the dialog, the private key value will become unavailable.

   For more information, see Creating static access keys.

In the terminal, run the command below stating the bucket name:

aws s3 mb s3://<bucket_name>

For more information, see Creating a bucket.

To upload an object, run the command below stating the path to the local file you need to upload, bucket name, and the key you will use to store the object in the bucket:

aws s3 cp <local_file_path>/ s3://<bucket_name>/<object_key>

For more information, see Uploading an object.

In the terminal, run the command below stating the bucket name, object key, and link lifetime in seconds:

aws s3 presign s3://<bucket_name>/<object_key> --expires-in <lifetime>

You can share the received link or use it in your service to access the file.

For more information, see Getting a download link.