Skip to content
S3 Viewer

How to share one folder in an S3 bucket (not the whole bucket)

By Aleem Rehmtulla, May Inc.

TL;DR

An S3 folder is a key prefix ending in a slash, and neither the AWS S3 console nor the Cloudflare R2 dashboard can share one with a person: AWS can only restrict an IAM identity to a prefix, and R2 tokens stop at the bucket. To give a colleague or client one folder without creating IAM users, connect the bucket to S3 Viewer once, invite them by email, and on the Access step switch the bucket from Whole bucket to Specific folders and add the folder, such as landing/. They see only that folder, nothing else in the bucket is listed or openable, and you change or remove the access later under Settings, Members without rotating any keys.

Steps

Step-by-step.

  1. 01

    Connect the bucket's server once

    Click Add server in the sidebar and paste one least-privilege credential for the S3 or R2 endpoint, typically with s3:ListBucket, s3:GetObject, s3:PutObject and s3:DeleteObject on the buckets you want to expose. This is the only key anyone creates; the people you invite sign in to S3 Viewer, not to AWS or Cloudflare.
  2. 02

    Open Settings, Members and add the people

    Click Invite people, type up to five email addresses, and tick the server (or servers) they should see. One send can cover several people and several servers; each person gets one email, and the invite is valid for seven days.
  3. 03

    On the Access step, switch the bucket to Specific folders

    Pick a role, Viewer (browse and download) or Editor (also upload, rename and delete). Then, next to the bucket, change Whole bucket to Specific folders and add the prefixes they should reach, such as landing/ or reports/2026/. A folder is a key prefix ending in /. It does not have to exist yet, a parent folder covers everything under it, and you can list up to 20 folders per bucket. Only Viewers and Editors can be limited this way; an Admin always gets the whole bucket.
    landing/
reports/2026/
  4. 04

    Review and send

    The last step shows each person, each server, the role and the folders before anything is sent. If you are an Admin rather than the Owner, you can only share folders you can open yourself. The recipient accepts the invite, signs in, and the bucket appears in their sidebar showing only the folders that lead to what they were given.
  5. 05

    Change or remove the access later

    Under Settings, Members you can add or drop folders, widen the limit back to the whole bucket, change the role, or remove the person. The change applies on their next request. No key is rotated, because they never held one.
  6. 06

    If you must do it in AWS instead

    Use this when the limit has to hold for a program, a service, or anyone who will use their own access keys. Create an IAM user or role for them and attach a policy with two statements: object actions on the prefix wildcard, and s3:ListBucket on the bucket itself with a Condition on s3:prefix. The listing condition is the part most first attempts miss. You then hand over access keys, and off-boarding means deleting the user and rotating anything they touched. On Cloudflare R2, a standard API token can be scoped to a bucket but not to a folder; prefix limits exist only on temporary credentials minted through the API.
    {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ObjectsInsideFolder",
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:PutObject"],
      "Resource": "arn:aws:s3:::my-bucket/reports/*"
    },
    {
      "Sid": "ListOnlyThatFolder",
      "Effect": "Allow",
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::my-bucket",
      "Condition": {
        "StringLike": { "s3:prefix": ["reports/*"] }
      }
    }
  ]
}

Under the hood

What's actually happening.

S3 stores a flat list of keys. What looks like a folder is every key that starts with the same prefix, and a listing with Delimiter=/ collapses those shared prefixes into folder rows. Because there is no directory object, there is nothing to attach a share to. AWS answers this with IAM: a policy can allow s3:GetObject on bucket/reports/* and s3:ListBucket with an s3:prefix condition, but only for an IAM user, role or federated identity, so every person needs an identity, a key and an off-boarding step. Presigned URLs share one object for a limited time, not a folder. Cloudflare R2 scopes standard tokens to buckets, and its prefix-restricted temporary credentials are minted through the API for programs rather than handed out from the dashboard. Both are the right tools for services. The gap is a colleague, a client or a contractor who needs one folder and a browser.

S3 Viewer fills that gap in front of the bucket. The bucket is connected once with a server-level credential, and each invited person has a role plus, for Viewers and Editors, an optional list of up to 20 folders per bucket. Every request is checked on S3 Viewer's server before it is signed: a listing is only run under an allowed prefix, the parent folders that lead there are shown so the person can navigate, and an object outside the allowed folders cannot be read, written, listed, copied or moved, on either end of a copy. A folder is recorded as a prefix, so it does not need to exist first, and a parent covers every child under it.

The limit lives in S3 Viewer, not in your provider. The stored credential still reaches the whole bucket, and members never see it, which is why changing or removing someone under Settings, Members takes effect on their next request with no key rotation. It also means the limit covers the browser, not programs with their own keys; when it has to hold there too, pair it with the IAM policy above. The same model works for Cloudflare R2 and any other S3-compatible provider.

FAQ

Common questions.

Can I share just one folder of an S3 bucket?

Not from the AWS console or the Cloudflare R2 dashboard: neither has a way to share a folder with a person, and there is no invite-by-email anywhere in S3 or R2. In AWS you can restrict an IAM user or role to a prefix with a policy, which means one identity and one set of keys per person. With S3 Viewer you connect the bucket once, invite the person by email, and on the Access step switch the bucket from Whole bucket to Specific folders and add the folder. They see only that folder.

Does S3 have real folders?

No. An S3 bucket is a flat list of object keys, and a folder is a key prefix that ends in a slash, such as landing/ in landing/hero.png. Consoles and S3 Viewer show those shared prefixes as folders by listing with a delimiter, but there is no directory object with its own permissions. That is why folder-level access has to be enforced by a policy on the key pattern or by an application in front of the bucket.

Can I give someone access to a folder without an IAM user?

Yes, as long as that someone is a person using a browser. S3 Viewer signs every request on its server with the one credential you connected, and checks the person's role and folder limit before signing. The person never holds a key, so there is no IAM user to create or delete. If the limit also has to hold for scripts or an application using its own keys, keep an IAM prefix policy for that identity too.

Can Cloudflare R2 tokens be limited to a folder?

A standard R2 account API token can be scoped to specific buckets with Object Read & Write or Object Read only, but not to a prefix, and Admin permissions are account-wide. R2 does support temporary credentials restricted with prefixPaths or objectPaths, which are short-lived S3-style keys minted through the API for a program to use, with a one-hour TTL by default. There is nothing in the dashboard that hands a folder to a colleague. S3 Viewer's folder limit works the same on R2 as on S3.

What happens if the folder does not exist yet?

The limit still saves. A folder is only a prefix, so S3 Viewer does not need an object there to record it, and the access applies as soon as files land under that prefix. Until then the person sees an empty folder. This is useful for a client upload area you want ready before the first file arrives.

Can an Admin be limited to a folder?

No. Admins manage members and buckets, so they always get whole buckets, and the Specific folders choice is only offered for Viewers and Editors. An Admin who invites someone can only share folders they can open themselves, which keeps a folder-limited Admin on a different server from widening anyone else's access.

Does the person see the rest of the bucket?

No. They see the folders that lead to what they were given, for example the bucket and then landing/, and nothing else is listed or openable. Objects outside their folders cannot be opened, listed, copied or moved, including as the destination of a copy. The check happens on S3 Viewer's server before any request is signed, so the browser never receives the rest of the listing.

How do I remove their access later?

Open Settings, Members, find the person and either edit their folders or remove them from the server. The change applies on their next request, other members are unaffected, and no AWS or Cloudflare keys need rotating because they never had any. A download link they already opened keeps working for up to 15 minutes.

Use S3 Viewer for this

Skip the CLI. Try it in the browser.

S3 Viewer turns the steps above into a single click. Open source, self-hostable, free.

Open appStar on GitHub