Permissions required to perform AI Object Storage actions in the Cloud Console
This table lists the permissions required to perform CoreWeave AI Object Storage actions in the Cloud Console. The Object Storage Admin role grants the cwobject: control plane permissions, but it doesn’t grant the s3: permissions required for bucket and object operations. Use this reference to grant the required permissions through an organization access policy.To grant these permissions to users, you need the Object Storage Admin role. Then, you can create an organization access policy to grant the permissions to the users. When these permissions are granted to a user, they will be able to perform the corresponding actions in the Cloud Console. For more information about organization access policies, see About organization access policies.
Feature in Console
AI Object Storage Permission Requirement
List (view) buckets
cwobject:ListBucketInfo
Create buckets
s3:CreateBucket cwobject:CreateAccessKey
Delete buckets
s3:DeleteBucket(policy can include ability to delete individual buckets or all buckets)
To browse a bucket in the Cloud Console, the bucket’s bucket access policy must grant the read-only permissions listed in the table. If a bucket policy doesn’t grant these permissions to a principal, that principal can’t browse the bucket in the Cloud Console even when their organization access policy does.
