CreateAccessKeyRequest

name string
Name of the access key

user_id stringrequired
ID of the user for whom the access key is being created

user_role OrgMembership
Role of the user in the organization. Controls what the user can do through the Partner API management endpoints.

• Admin: Full org access. Can list and manage all access keys in the org, update org settings, and manage users. ListAccessKeys returns all keys in the org.
• Member: Standard access. Can only manage their own access keys. ListAccessKeys returns only keys owned by this user.

If omitted, defaults to Member behavior.

Possible values: [Admin, Member]

buckets_roles object[]
Array [
bucket_name stringrequired
Name of the bucket
role stringrequired
The role defines the permissions for the associated bucket:

• ReadOnly: Read-only access to the bucket. Permits read operations like GetObject, HeadObject, ListObjects.
• Editor: Read and write access to the bucket. Includes everything in ReadOnly, plus PutObject, DeleteObject, and bucket configuration operations.
• Admin: Full access to all buckets in the org, bypasses all permission checks. When used with bucket_name: "*", the access key is treated as a full org admin. The value of bucket_name should always be * when using this role.

Example:
{ "bucket_name": "*", "role": "Admin" }
Possible values: [ReadOnly, Editor, Admin]
]

attach_policies string[]
Names of existing IAM policies to attach to this access key. All policies must already exist — if any policy name is invalid, the request fails and no key is created.

create_policies object[]
New IAM policies to create and attach to this access key. Each policy is created first, then attached atomically. If a policy with the same name already exists the request fails — use attach_policies to reuse an existing policy. If policy document validation fails, no key is created.

Array [
name stringrequired
Name of the policy. Must be unique within the organization. Only alphanumeric characters and +=,.@_- are allowed.
Possible values: <= 128 characters
document objectrequired
AWS IAM-compatible policy document. See IAM Policies documentation for details.
Version stringrequired
Policy language version.
Possible values: [2012-10-17]
Statement object[] required
Array [
Sid string
Optional identifier for the statement
Effect stringrequired
Whether this statement allows or denies the specified actions
Possible values: [Allow, Deny]
Action string[] required
S3 actions to allow or deny. Common actions: s3:GetObject, s3:PutObject, s3:DeleteObject, s3:ListBucket, s3:*. See supported actions.
Resource string[] required
S3 resource ARNs. Use arn:aws:s3:::bucket for bucket-level and arn:aws:s3:::bucket/prefix/* for prefix-scoped access.
Condition object
Optional conditions (IP, time-based). See condition examples.
]
description string
A description for the policy
Possible values: <= 1000 characters
]

access_key_scope AccessKeyScope
Controls whether the key receives the implicit default-allowed operations (such as create bucket or list buckets) on top of what its policies and bucket roles grant.

• standard (default): grants the default-allowed operations.
• no_default_allow: denies them, so the key can do only what its policies and bucket roles explicitly allow.

Possible values: [standard, no_default_allow]

CreateAccessKeyRequest

{
  "name": "string",
  "user_id": "string",
  "user_role": "Admin",
  "buckets_roles": [
    {
      "bucket_name": "string",
      "role": "ReadOnly"
    }
  ],
  "attach_policies": [
    "string"
  ],
  "create_policies": [
    {
      "name": "string",
      "document": {
        "Version": "2012-10-17",
        "Statement": [
          {
            "Sid": "string",
            "Effect": "Allow",
            "Action": [
              "string"
            ],
            "Resource": [
              "string"
            ],
            "Condition": {}
          }
        ]
      },
      "description": "string"
    }
  ],
  "access_key_scope": "standard"
}