Identity & Access

Purpose

Issue and control S3 credentials: IAM users for people/scripts, groups, access
policies, and service accounts — plus a view of recent access denials.

When you use it

A backup job, build system, or partner needs its own key pair.
You want to scope what a credential can do (read-only, one bucket, etc.).
Someone reports “Access Denied” and you need to see why.

Controls

Tabs with counts: Users · Groups · Policies · Service Accounts. A single
context-aware Create button sits on the toolbar; its label follows the active tab
(Create User / Create Group / Create Policy / Create Service Account).

Users tab

Create User → modal: Username, Cost Center (optional; left blank it
inherits the account cost center). Credentials are generated automatically; no password.
Credentials Created modal — shown once: access key id + secret with copy
buttons, Download CSV, I’ve saved these credentials, and (for a user reveal)
Attach a policy. The secret is never shown again.
Users table: username, status (Enabled/Disabled), policy chips (× to detach, + to
attach), access key, and row actions: an enable/disable toggle and delete.

Groups tab

Create Group → modal: Group Name.
Groups table: group name, status (Enabled/Disabled), member count (click to open
the members manager), a single group-policy chip (× to remove; + to set one only
when none is attached — a group holds at most one policy), and row actions:
enable/disable toggle and delete.
Members modal — add an existing user to the group or remove members.
Set Group Policy modal — pick the one policy the group grants; members inherit it
in addition to their own attached policies.

Policies tab

Four built-ins: FullAccess (administrative, incl. bucket management),
ReadOnly (GET/HEAD/LIST), ReadWrite (full read+write), WriteOnly
(PUT/DELETE only — deliberately incompatible with tools that stat before writing,
such as rclone and most GUI clients; for direct-PUT clients). Each card expands to
show its live action list (View actions); the WriteOnly card carries the
stat-before-write caveat.
Custom Policies table below: policy name, created date, View JSON and
delete actions.
Create Policy builds a scoped policy from a guided form (no hand-written JSON):
a role template (read-only / read-write), a scope (account-wide, or per named
bucket via a bucket picker), and an auto-suggested, editable policy name.

Service Accounts tab

Network Credentials — the credential that controls paid network access for
this Relayer installation (separate from S3 permissions). Table shows label,
installation id, last activity, created, status, and a revoke action.
S3 Service Accounts — scoped S3 credentials. Table shows access key, owner
(IAM user), cost center, created, and row actions: view details, rotate,
delete. Create Service Account → modal: owner, cost center (optional),
a starting template or custom policy JSON, and a live effective-rights
preview. The new secret is revealed once (same shared reveal modal as user create).

Recent Access Denials — panel of recent denied requests (User, Action, Reason,
Resource); see Gotchas.

Common tasks

Grant a partner read-only access: Create User → save the credentials →
Attach a policy → ReadOnly. Hand over key + secret; rotate on a schedule.
Revoke access fast: Users table → Disable (reversible) or Delete (permanent).
See why something was denied: check this page’s denials panel, then the
Audit Log with Result filtered to Deny.

Gotchas

The secret key is shown exactly once, at creation. If it wasn’t saved, create a
new credential and retire the old one — there is no reveal-later.
Every file uploaded with IAM credentials is encrypted at the gateway (XChaCha20)
before sharding; --sse is not required for protection. --sse AES256 is
honored as a real S3 contract; SSE-C and aws:kms are rejected as not
implemented.
Attach dialogs stay inert until you pick a policy — the Attach / Set Policy
buttons are disabled with no selection.
Cost center is optional in the current code: the Create User / Create Service
Account requests omit the field when it is blank and the server inherits the owner’s
cost center. (The live-beta build in the walkthrough returned a 400 “cost_center is
required” — that is stale; see Known issues.)
Current beta: see Known issues — IAM-user requests can fail
closed with Access Denied on every operation on boxes whose account/owner linkage
isn’t resolved.