Skip to main content
CoreWeave AI Object Storage organization access policies enforce permissions across your entire organization, automatically covering every resource, bucket, and user in your account. This page is for administrators and security engineers who need to set global access rules for AI Object Storage. When you centralize access rules, you ensure that global security standards and compliance requirements apply consistently. They sit at the top of the policy hierarchy and take effect before any bucket-level rules. Written in JSON with the same syntax as bucket access policies, they apply to both the S3-compatible API and the AI Object Storage API. Because organization access policies override bucket access policies, they apply to every request in your AI Object Storage environment. Set your organization access policies after you create access tokens and keys, and before bucket operations.

​
Key considerations

AI Object Storage organization access policies have specific aspects and considerations to understand:
Policy aspectDescription
Admin accessPrincipals with the Object Storage Admin IAM role (assigned through CoreWeave IAM access policies) have unrestricted access to all cwobject: API actions (control plane), but that role does not grant S3-compatible API access. S3-compatible access must still be granted through Object Storage organization and bucket access policies.
Group usageOrganization access policies don’t allow CoreWeave IAM groups (created in the Cloud Console). Use individual user UIDs (from Cloud Console) or SAML users and groups instead.
s3:PutBucketPolicyThe s3:PutBucketPolicy action is a global operation that only evaluates organization policies (it ignores bucket-level policies) and requires org policies to explicitly allow s3:PutBucketPolicy or s3:* with "resources": ["*"] or specific bucket names. This behavior prevents users from accidentally locking themselves out of a bucket with a misconfigured bucket access policy.
Global operationsAll cwobject: API actions and the s3:ListAllMyBuckets operation are global operations that must specify "resources": ["*"] in organization access policies.
Policy evaluation orderCoreWeave evaluates policies in two steps and evaluates organization policies first (before any bucket-level policies).
Policy management recommendationPrefer to manage access through organization policies for broad, centralized control. Use bucket policies only for bucket-specific features such as bucket lifecycle configuration.
Learn how to set an organization access policy or view examples of organization access policies.
Last modified on May 29, 2026