S3 Viewer
Open app

How to invite a teammate to your S3 bucket

TL;DR

AWS IAM is powerful for service-to-service auth and fine-grained policy — but it's heavy for human collaboration on a single bucket. The simpler pattern: add the server once with one least-privilege key, then invite teammates by email and give each of them a role. S3 Viewer wraps that workflow — Owner, Admin, Editor or Viewer, with per-bucket overrides — and removing someone takes one click and no key rotation.

Steps

Step-by-step.

  1. 01

    Add a server

    Click Add server in the sidebar. A server is one set of credentials pointed at one S3-compatible endpoint; it holds the buckets it can reach and the members you invite.
  2. 02

    Connect the bucket once

    Paste an access key and secret. Use a least-privilege IAM user scoped to the buckets you want exposed — typically with s3:ListBucket, s3:GetObject, s3:PutObject, and s3:DeleteObject. Your whole team uses this one credential through their own logins.
  3. 03

    Invite by email

    Open the server's bucket list, click Share to open the members dialog, type your teammate's email and pick a role: Viewer (browse and download), Editor (also upload, rename, delete, and create buckets where supported) or Admin (also manage members, rename the server and remove buckets). Owner is not in the picker — it belongs to whoever created the server, and only an Owner can delete it. A bucket can give someone a different role than they have on the server, so the same person can be an Editor on one bucket and a Viewer on another.
  4. 04

    Send

    You can send up to five addresses at a time, and an invite is good for seven days. Each recipient gets one email; they sign in with an email and password (or with GitHub), accept, and the server appears in their sidebar — no AWS, no IAM, no CLI.
  5. 05

    Off-boarding: remove the member

    Remove them in the members dialog. They lose access to that server on their next request and you don't need to rotate any AWS keys — they never had any.

Under the hood

What's actually happening.

AWS IAM is built for service-to-service authorization and fine-grained programmatic policy. For a small team that just needs to browse and share files in a bucket, per-person IAM is heavier than it needs to be: a JSON policy per role, a key per person, rotation cycles, and off-boarding to remember. S3 Viewer takes a different approach for that human-collaboration case: the bucket is connected once with a server-level credential, and teammates authenticate to S3 Viewer instead of AWS. Their access is enforced on our server — every request is checked against their role before it is signed, and roles are ordered Viewer < Editor < Admin < Owner, each one adding to the last. When you remove them, no keys need rotating because they never held any. The same model works for Cloudflare R2 and any other S3-compatible provider.

FAQ

Common questions.

Can multiple users access the same S3 bucket without each having an IAM user?

Yes. Add the bucket's server to S3 Viewer once with a single least-privilege IAM key, then invite teammates by email — up to five addresses at a time, each invite valid for seven days. They authenticate against S3 Viewer, so you don't need per-person IAM users and you don't have to rotate access keys when someone leaves.

Why use a shared server instead of per-person IAM?

AWS IAM is the right tool for many scenarios — service-to-service auth, fine-grained programmatic access, federated identity into the AWS console. For a small team that just needs to browse and share files in a bucket, IAM is heavier than it needs to be: a JSON policy per role, an access key per person, key rotation, off-boarding to remember. Email invites bundle that workflow into a session model — sign in, browse the buckets you were given, get removed at off-boarding.

How do I remove a teammate from a bucket?

Remove them in the members dialog. They lose access to that server on their next request — no AWS keys to rotate, no policies to edit, no other teammates affected.

Can a teammate have different access on different buckets?

Yes. A member has a role on the server, and a bucket can override it. The same person can be a Viewer on one bucket and an Editor on another.

How does this work with IAM Identity Center?

IAM Identity Center is the right tool for federating identity into AWS itself, including the AWS console — and it's a great choice for many enterprise scenarios. S3 Viewer is a complementary layer on top of S3 (and other S3-compatible providers) for the specific case of human collaboration on object storage. You can use both: Identity Center for federated AWS access, S3 Viewer for the browsing-and-sharing workflow.

Does this work with Cloudflare R2 buckets too?

Yes. Add an R2 server the same way and invite teammates to it. They never need a Cloudflare account — S3 Viewer handles authentication.

Use S3 Viewer for this

Skip the CLI. Try it in the browser.

S3 Viewer turns the steps above into a single click. Open source, self-hostable, free.

Open appStar on GitHub