Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.coreweave.com/llms.txt

Use this file to discover all available pages before exploring further.

The examples below show common bucket access policy patterns. For details on how to apply a policy to a bucket, see Manage bucket policies.

​
Allow organization-wide read access

The policy below allows organization-wide read access for the specified bucket. Fill in the following parameters in the policy:
  • [ORG-ID] with your organization’s ID.
  • [BUCKET-NAME] with the name of the bucket you want to grant read access to.
Allow organization-wide read access for the specified bucket
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowGetObject",
      "Principal": {
          "AWS": "*"
      },
      "Effect": "Allow",
      "Action": [
          "s3:GetObject",
          "s3:ListBucket"
          ],
      "Resource": [
        "arn:aws:s3:::[BUCKET-NAME]",
        "arn:aws:s3:::[BUCKET-NAME]/*"
        ],
      "Condition": {
          "StringEquals": {
              "cw:PrincipalOrgID": ["[ORG-ID]"]
          }
      }
    }
  ]
}

​
Allow access from another organization

You can also use bucket access policies to allow users from other organizations to access your bucket:
Allow users from other organizations to access your bucket
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowGetObject",
      "Principal": {
          "AWS": "*"
      },
      "Effect": "Allow",
      "Action": [
          "s3:GetObject",
          "s3:ListBucket"
          ],
      "Resource": [
        "arn:aws:s3:::[BUCKET-NAME]",
        "arn:aws:s3:::[BUCKET-NAME]/*"
        ],
      "Condition": {
          "StringEquals": {
              "cw:PrincipalOrgID": ["[ORG-ID]", "[OTHER-ORG-ID]"]
          }
      }
    }
  ]
}

​
Deny a specific user the ability to delete objects

This policy denies a specific user the ability to delete objects. Replace [ORG-ID] with your organization’s ID and [USER-ID] with the user’s ID.
Deny a specific user the ability to delete objects
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "statement",
      "Effect": "Deny",
      "Principal": {
        "CW": "arn:aws:iam::[ORG-ID]:coreweave/[USER-ID]"
      },
      "Action": [
        "s3:DeleteObject",
        "s3:DeleteObjectVersion",
        "s3:PutLifecycleConfiguration"
      ],
      "Resource": [
        "arn:aws:s3:::[BUCKET-NAME]",
        "arn:aws:s3:::[BUCKET-NAME]/*"
      ]
    }
  ]
}

​
Additional resources

Last modified on April 30, 2026