Permissions required to perform AI Object Storage actions in the Cloud Console
This table lists the permissions required to perform CoreWeave AI Object Storage actions in the Cloud Console. The Object Storage Admin role grants the cwobject: control plane permissions, but it doesn’t grant the s3: permissions required for bucket and object operations. Use this reference to grant the required permissions through an organization access policy.To grant these permissions to users, you need the Object Storage Admin role. Then, you can create an organization access policy to grant the permissions to the users. When these permissions are granted to a user, they will be able to perform the corresponding actions in the Cloud Console. For more information about organization access policies, see About organization access policies.
Feature in Console
AI Object Storage Permission Requirement
List (view) buckets
cwobject:ListBucketInfo
Create buckets
s3:CreateBucket cwobject:CreateAccessKey
Delete buckets
s3:DeleteBucket(policy can include ability to delete individual buckets or all buckets)
All cwobject: permissions are global operations and must specify "resources": ["*"] in the policy statement.
Cloud Console groups aren’t allowed in organization access policies. Use UIDs (from the Cloud Console) or SAML users and groups instead.
Required bucket policy permissions
To browse a bucket in the Cloud Console, the bucket’s bucket access policy must grant the read-only permissions listed in the table. If a bucket policy doesn’t grant these permissions to a principal, that principal can’t browse the bucket in the Cloud Console even when their organization access policy does.
