Manage bucket policies - CoreWeave Docs

This page shows bucket owners and administrators how to create and update bucket access policies for CoreWeave AI Object Storage buckets. Use these policies to control which principals can perform which actions on a specific bucket and its objects. An Object Storage bucket access policy is a JSON object that defines access to operations and the objects for the bucket it’s assigned to. Each bucket access policy applies to an individual bucket and controls access to the resources inside the bucket. Before you set a bucket access policy, you must set at least one organization access policy for your organization to access the bucket. Bucket access policies are evaluated after organization access policies. You can set bucket access policies programmatically with the S3-compatible API using standard S3 tools like aws s3api or s3cmd, or with the CoreWeave Terraform provider.

Prerequisites

You are a member of the CoreWeave organization that owns the bucket (the “bucket owner”).
Your organization access policy allows s3:PutBucketPolicy on the target bucket (or s3:* on all buckets).
You have an AI Object Storage Access Key.
You have an S3-compatible client (aws s3api, s3cmd, or Boto3) configured for AI Object Storage, or you’re using the CoreWeave Terraform provider.

Only principals from the bucket’s owning organization can set or update its bucket access policy. Cross-organization users can’t modify bucket policies, even if they have other permissions on the bucket.

Find your Org ID

You need your Org ID to scope your bucket access policies safely to your organization. Your Org ID is a short hexadecimal string (for example, ab1cd2). Find it on the Settings page of your Cloud Console account.

Policy evaluation

CoreWeave allows or denies access to a bucket by evaluating both the organization and bucket access policies as follows:

Example policies

For sample bucket policies, see Bucket access policy examples.

Set a policy with CLI tools

The s3:PutBucketPolicy API call sets a policy for a bucket. The following tabs describe how to set a bucket access policy with different tools. After you run one of these commands successfully, the new policy applies to the specified bucket, and CoreWeave evaluates access according to it on subsequent requests.

AWS CLI
s3cmd
Boto3

Fill in the following parameters:

[BUCKET-NAME] with the name of the bucket you want to set the policy for.
[FILE-PATH] with the path to the file containing the policy.

Example command

aws s3api put-bucket-policy --bucket [BUCKET-NAME] --policy [FILE-PATH]

Fill in the following parameters:

[BUCKET-NAME] with the name of the bucket you want to set the policy for.
[FILE-PATH] with the path to the file containing the policy.

Example command

s3cmd setpolicy [FILE-PATH] s3://[BUCKET-NAME]

Set environment variables for your CoreWeave credentials:
export ACCESS_KEY_ID="[ACCESS-KEY-ID]" export SECRET_ACCESS_KEY="[SECRET-ACCESS-KEY]"
Alternatively, configure your CoreWeave credentials to work with the AWS CLI. We recommend using a separate profile for CoreWeave AI Object Storage to avoid conflicts with your other AWS profiles and S3-compatible services. If you don’t set up this configuration, you might encounter errors when using AI Object Storage. If you have no other AWS profiles, you can use the default profile instead of the cw profile created in the following steps. In that case, omit --profile cw from the commands.
For production workloads, CoreWeave recommends Workload Identity Federation for automated, short-lived credentials instead of static access keys.
Configure CoreWeave credentials with static access keys
1. Create a cw profile:
  Create a new profile
  aws configure --profile cw
2. When prompted, provide the following values:
  - AWS Access Key ID: The Access Key ID of your CoreWeave AI Object Storage Access Key.
  - AWS Secret Access Key: The Secret Key of your CoreWeave AI Object Storage Access Key.
  - Default region name (Optional): To set a default region, see CoreWeave Availability Zones.
  - Default output format: Use json for JSON output.
3. Set the default endpoint URL to the appropriate endpoint for your use case:
  - The primary endpoint, https://cwobject.com, for use outside a CoreWeave cluster.
  - The LOTA endpoint, http://cwlota.com, for use inside a CoreWeave cluster. The LOTA endpoint routes to the LOTA path for best performance.
  Set the primary endpoint for local development
  aws configure set endpoint_url https://cwobject.com --profile cw
4. Set the S3 addressing_style to virtual:
  Set virtual addressing style
  aws configure set s3.addressing_style virtual --profile cw
To use this profile, pass --profile cw to your AWS CLI commands, or set AWS_PROFILE=cw in your environment.If you set endpoint_url and s3.addressing_style directly in your code (for example, in a Boto3 Config object), you can skip steps 3 and 4. The profile only needs the access key, secret key, and region.
Configure CoreWeave credentials with Workload Identity Federation (OIDC)
If you’ve configured Workload Identity Federation with OIDC, the AWS SDK automatically discovers temporary credentials. Set the following environment variables instead of configuring static access keys.Replace [ORG-ID] with your CoreWeave organization ID, [PATH-TO-JWT-TOKEN-FILE] with the path to your JWT token file, and [AVAILABILITY-ZONE] with your CoreWeave Availability Zone.
Configure WIF OIDC credentials
export AWS_CONTAINER_CREDENTIALS_FULL_URI=https://api.coreweave.com/v1/cwobject/temporary-credentials/oidc/[ORG-ID] export AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE=[PATH-TO-JWT-TOKEN-FILE] aws configure set s3.addressing_style virtual export AWS_REGION="[AVAILABILITY-ZONE]" export AWS_ENDPOINT_URL_S3="https://cwobject.com"
With WIF configured, your S3-compatible tools and Boto3 code automatically obtain and refresh temporary credentials without passing access keys explicitly.Requires awscli >= 2.33.2 or boto3 >= 1.42.5. See Use Workload Identity Federation with OIDC for the full setup guide.

Replace [BUCKET-NAME] with the name of the bucket, [ORG-ID] with your organization’s ID, [USER-ID] with the console user’s ID, and [SAML-GROUP-ID] with the SAML group ID.

Set a bucket policy

import os
import json
import boto3
from botocore.client import Config

boto_config = Config(
    region_name='[AVAILABILITY-ZONE]',
    s3={'addressing_style': 'virtual'}
)

s3 = boto3.client(
    's3',
    endpoint_url='https://cwobject.com',
    aws_access_key_id=os.environ['ACCESS_KEY_ID'],
    aws_secret_access_key=os.environ['SECRET_ACCESS_KEY'],
    config=boto_config
)

bucket_name = '[BUCKET-NAME]'
org_id = '[ORG-ID]'

policy = {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowPutObject",
            "Effect": "Allow",
            "Principal": {
                "CW": ["arn:aws:iam::[ORG-ID]:coreweave/[USER-ID]"],
                "AWS": ["arn:aws:iam::[ORG-ID]:saml/[SAML-GROUP-ID]"]
            },
            "Action": ["s3:PutObject", "s3:PutObjectAcl"],
            "Resource": [f"arn:aws:s3:::{bucket_name}/*"],
            "Condition": {
                "StringEquals": {
                    "cw:PrincipalOrgID": [org_id]
                }
            }
        }
    ]
}

response = s3.put_bucket_policy(
    Bucket=bucket_name,
    Policy=json.dumps(policy)
)

print(response)

Set a policy with Terraform

To use the CoreWeave Terraform provider to set a bucket access policy, use the coreweave_object_storage_bucket_policy resource. You can set the policy in one of the following ways:

Pass an encoded JSON string directly to the policy attribute.
Use the coreweave_object_storage_bucket_policy_document data source to create the policy.

There is one example below for each approach. Both examples grant a specific console user and a SAML group all S3 actions on the bucket and its objects. Fill in [ORG-ID], [USER-ID], and [SAML-GROUP-ID] with your own values.

Pass JSON to policy attribute
Use the policy document data source

## Example using jsonencode to pass a raw JSON string to the policy attribute

locals {
  bucket_policy = {
    Version = "2012-10-17"
    Statement = [
      {
        Sid    = "AllowUserAndGroup"
        Effect = "Allow"
        Principal = {
          "CW"  = ["arn:aws:iam::[ORG-ID]:coreweave/[USER-ID]"]
          "AWS" = ["arn:aws:iam::[ORG-ID]:saml/[SAML-GROUP-ID]"]
        }
        Action   = ["s3:*"]
        Resource = [
          "arn:aws:s3:::${coreweave_object_storage_bucket.raw.name}",
          "arn:aws:s3:::${coreweave_object_storage_bucket.raw.name}/*",
        ]
        Condition = {
        "StringEquals" = {
          "cw:PrincipalOrgID" = ["${var.org_id}"]
          }
        }
      },
    ]
  }
}

resource "coreweave_object_storage_bucket" "raw" {
  name = "bucket-policy-raw-example"
  zone = "US-EAST-04A"
}

resource "coreweave_object_storage_bucket_policy" "raw" {
  bucket = coreweave_object_storage_bucket.raw.name
  policy = jsonencode(local.bucket_policy)
}

## Example using the coreweave_object_storage_bucket_policy_document data source

resource "coreweave_object_storage_bucket" "doc" {
  name = "bucket-policy-doc-example"
  zone = "US-EAST-04A"
}

data "coreweave_object_storage_bucket_policy_document" "doc" {
  version = "2012-10-17"

  statement {
    sid      = "AllowUserAndGroup"
    effect   = "Allow"
    action   = ["s3:*"]
    resource = [
      "arn:aws:s3:::${coreweave_object_storage_bucket.doc.name}",
      "arn:aws:s3:::${coreweave_object_storage_bucket.doc.name}/*",
    ]
    principal = {
      "CW"  = ["arn:aws:iam::[ORG-ID]:coreweave/[USER-ID]"]
      "AWS" = ["arn:aws:iam::[ORG-ID]:saml/[SAML-GROUP-ID]"]
    }
    condition = {
      "StringEquals" = {
        "cw:PrincipalOrgID" = var.org_id
      }
    }
  }
}

resource "coreweave_object_storage_bucket_policy" "doc" {
  bucket = coreweave_object_storage_bucket.doc.name
  policy = data.coreweave_object_storage_bucket_policy_document.doc.json
}

This resource is also available in OpenTofu. See Use Terraform to manage CoreWeave AI Object Storage infrastructure as code for more information.

Roles for bucket access policies

You can use roles in bucket access policies to specify a set of permissions for a user or group of users. This lets you grant permissions to identities defined outside of CoreWeave (for example, through SAML) as well as to CoreWeave Cloud Console users. Define roles in the Principal field of the policy. The following table describes the fields that define roles in a bucket access policy.

Value	Description
`org-id`	A static identifier for your organization at CoreWeave. If you use `Conditions` instead of the `Principal` field, you can substitute a variable like `cw:ResourceOrgId` for the actual value.
`principal-provider`	Specifies where the principal came from. For example, the `principal-provider` for a SAML integration is `saml`. Similarly, it’s `coreweave` for a user inside CoreWeave’s cloud. You can also use this field to specify a `role` targeting principals who have credentials for specific roles.
`principal-name`	Identifies the actual actor from the specified provider. For example, if the `principal-provider` is `saml`, then that name is the value of the `PrincipalName` attribute in the SAML assertion. For Cloud Console users, this value is the user’s `UID`, which appears in that user’s Settings in Cloud Console.

Additional resources

For more information, see:

​Prerequisites

​Find your Org ID

​Policy evaluation

​Example policies

​Set a policy with CLI tools

​Set a policy with Terraform

​Roles for bucket access policies

​Additional resources

Prerequisites

Find your Org ID

Policy evaluation

Example policies

Set a policy with CLI tools

Set a policy with Terraform

Roles for bucket access policies

Additional resources