Team access without per-person IAM users.
AWS IAM is built for service-to-service auth and fine-grained policy control — powerful, but heavy for human collaboration on a single bucket. S3 Viewer is a team workspace for AWS S3 and Cloudflare R2 that sits on top: connect a bucket once with one least-privilege key, invite teammates by email, assign per-bucket roles, and revoke without rotating anything.
- Email invites instead of IAM users — no permanent artifacts to rotate
- Four per-bucket roles: Owner, Admin, Editor, Viewer
- Off-boarding is one click — sessions end on next request
A workspace built for human collaboration on object storage.
One credential per bucket
Connect a bucket once with a least-privilege IAM key. The whole team uses it through their own logins — no shared root keys, no per-person IAM users, no policy JSON to maintain.
Four roles, per bucket
Owner, Admin, Editor, Viewer — clear and minimal. Same person, different roles on different buckets. The whole permission model fits in your head.
Invite by email
Type an address, pick a role, send. They sign in with email OTP or GitHub and the bucket appears in their sidebar.
Server-side enforcement
The workspace signs every S3 request on a member's behalf using your encrypted credentials. Their browser never sees an access key, and policy checks happen before requests reach AWS.
Clean off-boarding
Click revoke. Session ends on next request. No IAM key rotation, no policy edits, no broken applications.
Self-host on your VPC
MIT-licensed open source. Run the same workspace UI inside your own infrastructure — full data residency, full control, no third party in the request path.
Three steps to your bucket.
No agents to install, no infrastructure to manage. Paste credentials and you're browsing.
- 01
Create a workspace
One per team or project. Workspaces hold connected buckets and members; everything is scoped inside.
- 02
Connect the bucket once
Paste a single set of access keys — ideally a least-privilege IAM user scoped to the buckets you want exposed. Your whole team uses it through their own logins.
- 03
Invite by email, assign a role per bucket
Pick from four roles: Owner, Admin, Editor, Viewer. Roles are per bucket — a teammate can be an Editor on one and a Viewer on another. Off-boarding is one click and zero key rotation.
Common questions.
Direct answers we wish we'd had when picking a viewer.
How do I give my team access to an S3 bucket without creating IAM users for each of them?
What roles are available?
Can I limit a teammate to one bucket out of many?
What happens when someone leaves the team?
How does this compare to IAM Identity Center or per-user IAM?
Does this work with Cloudflare R2 buckets too?
Can teams be self-hosted?
Step-by-step how-tos.
Invite a teammate
Skip per-person IAM users for human collaboration. Email invite, per-bucket role, one-click revoke.
Granular permissions
The IAM s3:prefix Condition that everyone misses, plus when workspace roles are simpler than IAM.
Share an S3 file
Presigned URL or workspace invite — when each is the right call, and why presigned links can't be revoked.
Other use cases
Multi-cloud
AWS S3, Cloudflare R2, MinIO, B2, and Wasabi — same sidebar, same search, cross-cloud copy when you need it.
Sharing without AWS
Email-invite clients and execs to a clean browser view of one bucket — revocable in one click, no IAM.
Better S3 browser
One-click rename, Tab-autocomplete bucket-wide search, and Cmd-K — focused on the daily browsing layer.