Object Storage Admin role governs cwobject: control plane actions, such as managing Access Keys and organization access policies. It does not grant S3-compatible bucket or object access. To give a user read or write access to objects, create an Object Storage organization access policy that grants specific s3: actions (for example, s3:GetObject, s3:ListBucket) on the resources they need, and add the user as the principal. For bucket-specific rules, add a bucket access policy.
If the user also needs credentials, grant cwobject:CreateAccessKey on "resources": ["*"] in an organization access policy. The user can then exchange their API access token for temporary credentials. The resulting Access Keys remain limited by the applicable organization and bucket access policies.
Do not attach the Object Storage Admin IAM role to a user you intend to keep read-only or scoped. Organization access policies accept individual user UIDs or SAML users and groups, not CoreWeave IAM groups.
For full details, see Object Storage policies and Organization access policies. For example policies, see Policy examples.
Administrator Authentication & Access