Team access without per-person IAM users.
AWS IAM is built for service-to-service auth and fine-grained policy control — powerful, but heavy for human collaboration on a single bucket. S3 Viewer sits on top of AWS S3 and Cloudflare R2 instead: add the server once with one least-privilege key, invite teammates by email, give each of them a role, and remove them without rotating anything.
- Email invites instead of IAM users — no permanent artifacts to rotate
- Four cumulative roles: Owner, Admin, Editor, Viewer
- Off-boarding is one click — access ends on the next request
Why teams pick S3 Viewer
Server access built for human collaboration on object storage.
One credential per server
Add a server once with a least-privilege IAM key. The whole team uses it through their own logins — no shared root keys, no per-person IAM users, no policy JSON to maintain.
Four roles, overridable per bucket
Viewer, Editor, Admin, Owner — each adds to the one before it. A bucket can give the same person a different role. The whole permission model fits in your head.
Invite by email
Click Share, type an address, pick a role, send. They sign in with an email and password, or with GitHub, accept, and the server appears in their sidebar.
Server-side enforcement
Every request is checked against the member's role before S3 Viewer signs it with the server's stored credentials. Their browser never sees an access key, and the check happens before anything reaches AWS.
Clean off-boarding
Remove the member. They lose access to that server on the next request. No IAM key rotation, no policy edits, no broken applications.
Self-host on your VPC
MIT-licensed open source. Run the same UI inside your own infrastructure — full data residency, full control, and no third party in the request path.
How it works
Three steps to your bucket.
No agents to install, no infrastructure to manage. Paste credentials and you're browsing.
- 01
Add a server
One set of credentials pointed at one S3-compatible endpoint. The server holds the buckets those credentials reach and the members you invite; everything is scoped inside it.
- 02
Connect the bucket once
Paste a single set of access keys — ideally a least-privilege IAM user scoped to the buckets you want exposed — plus the region and endpoint. Your whole team uses it through their own logins.
- 03
Click Share, invite by email, pick a role
Four roles, each one adding to the last: Viewer, Editor, Admin, Owner. Object rename and deletion work the same way on every connected provider. A bucket can override a member's server role, so a teammate can be an Editor on one bucket and a Viewer on another. Off-boarding is one click and zero key rotation.
FAQ
Common questions.
Direct answers we wish we'd had when picking a viewer.
How do I give my team access to an S3 bucket without creating IAM users for each of them?
What roles are available?
Can I limit a teammate to one bucket out of many?
What happens when someone leaves the team?
How does this compare to IAM Identity Center or per-user IAM?
Does this work with Cloudflare R2 buckets too?
Can teams be self-hosted?
Related guides
Step-by-step how-tos.
Invite a teammate
Skip per-person IAM users for human collaboration. Email invite, per-bucket role, one-click revoke.
Granular permissions
The IAM s3:prefix Condition that everyone misses, plus when workspace roles are simpler than IAM.
Share an S3 file
Copy link for a 15-minute presigned URL, or an email invite for ongoing access — when each is the right call.
Keep exploring
Other use cases
Multi-cloud
AWS S3, Cloudflare R2, MinIO, B2, and Wasabi — same sidebar, same file browser, one server at a time.
Sharing without AWS
Email-invite clients and execs to a clean browser view of one bucket — revocable in one click, no IAM.
Better S3 browser
Browse and preview across providers, with guarded rename and multi-select deletion on AWS S3.