Skip to navigation
InfrastructureObject StorageBuckets

Bucket Policies

Bucket access in IBEE Object Storage is controlled through two mechanisms:

  • Public Access — a bucket-level toggle that exposes objects unauthenticated via a Public Access URL.
  • API Credentials — programmatic access scoped to a permission level and a set of buckets.

For browser-based cross-origin access, see CORS. For Object Lock retention, see Objects → Locking.

Public access

Enabling Public Access allows objects in the bucket to be served unauthenticated via a Public Access URL.

1

Open General settings

Open your bucket → click Settings → click the General tab.

2

Enable Public Access

Toggle Public Access from Disabled to Enabled. A confirmation toast appears: “Bucket access changed to public”.

3

Enable the Public Access URL

The Public Access URL section becomes active but no URL is assigned automatically — it shows “No Public Access URL is assigned to this bucket.”

Click Enable in the top-right of the Public Access URL card to assign a URL to the bucket.

Copy the URL. Objects are then accessible at:

https://<public-access-url>/<object-key>

The Public Access URL is rate-limited and not recommended for production. For production traffic, connect a custom domain to the bucket. To turn the URL off, click Disable on the Public Access URL card.

Enabling Public Access makes all objects in the bucket readable without authentication. Only enable this for buckets intended for public content.

If Public Access is disabled, the Public Access URL section shows: “Please enable public access in General to use the Public Access URL.”

To serve from your own hostname instead of the assigned Public Access URL, see Custom Domains — the bucket must be public to register a custom domain.

API Credential access

For programmatic access via the AWS CLI, rclone, or any S3-compatible tool, use an S3 credential, created under Organization → API Tokens → S3 Credentials. Each credential belongs to one workspace and provides:

  • Access Key ID + Secret Access Key — for S3-compatible tools
  • S3 Endpoint — https://{workspaceId}.blob.ibeestorage.com

Permission levels

Each credential is created with one Object Storage permission level:

PermissionWhat it allows
Admin Read & WriteCreate, list, delete buckets, edit bucket configuration, read, write, and list objects.
Admin Read onlyList buckets, view configuration, read and list objects.
Object Read & WriteRead, write, and list objects in specific buckets.
Object Read onlyRead and list objects in specific buckets.

Bucket scoping

Admin credentials always apply to every bucket in the credential’s workspace. Object Read & Write and Object Read only credentials can apply to:

  • All buckets in the selected workspace — the simplest option for application-wide access.
  • Specific buckets only — pick one or more buckets the credential can access.

This is the bucket-level access boundary: a credential scoped to bucket A cannot read or write to bucket B.

Create an API credential →

Best practices

  • Default to private. Only enable Public Access on buckets that genuinely serve public content (websites, media, downloads).
  • Use one credential per application or environment with the narrowest permission level and bucket scope that works.
  • Rotate credentials by creating a new credential, switching applications to use it, then revoking the old one. The Secret Access Key is shown only once — store it securely.
  • Separate buckets for prod / staging / dev rather than relying on prefix-based separation alone.