# CreateAccessKeyRequest

**name** string  
Name of the access key

**user_id** stringrequired  
ID of the user for whom the access key is being created

**user_role** OrgMembership  
Role of the user in the organization. Controls what the user can do through the Partner API management endpoints.

- `Admin`: Full org access. Can list and manage all access keys in the org, update org settings, and manage users. ListAccessKeys returns all keys in the org.
- `Member`: Standard access. Can only manage their own access keys. ListAccessKeys returns only keys owned by this user.

If omitted, defaults to `Member` behavior.

**Possible values:** 
[`Admin`, `Member`]

**buckets_roles** object[]  
Array [  
  **bucket_name** stringrequired  
  Name of the bucket  
  **role** stringrequired  
  The role defines the permissions for the associated bucket:  
  - `ReadOnly`: Read-only access to the bucket. Permits read operations like GetObject, HeadObject, ListObjects.  
  - `Editor`: Read and write access to the bucket. Includes everything in ReadOnly, plus PutObject, DeleteObject, and bucket configuration operations.  
  - `Admin`: Full access to all buckets in the org, bypasses all permission checks. When used with `bucket_name: "*"`, the access key is treated as a full org admin. The value of `bucket_name` should always be `*` when using this role.

Example:  
`{  
    "bucket_name": "*",  
    "role": "Admin"  
}`  
**Possible values:** 
[`ReadOnly`, `Editor`, `Admin`]  
]

**attach_policies** string[]  
Names of existing IAM policies to attach to this access key. All policies must already exist — if any policy name is invalid, the request fails and no key is created.

**create_policies** object[]  
New IAM policies to create and attach to this access key. Each policy is created first, then attached atomically. If a policy with the same name already exists the request fails — use attach_policies to reuse an existing policy. If policy document validation fails, no key is created.

Array [  
  **name** stringrequired  
  Name of the policy. Must be unique within the organization. Only alphanumeric characters and `+=,.@_-` are allowed.  
  **Possible values:** `<= 128 characters`  
  **document** objectrequired  
  AWS IAM-compatible policy document. See [IAM Policies documentation](/content/docs/iam/policies/index.html) for details.  
  **Version** stringrequired  
  Policy language version.  
  **Possible values:** [`2012-10-17`]  
  **Statement** object[] required  
  Array [  
    **Sid** string  
    Optional identifier for the statement  
    **Effect** stringrequired  
    Whether this statement allows or denies the specified actions  
    **Possible values:** [`Allow`, `Deny`]  
    **Action** string[] required  
    S3 actions to allow or deny. Common actions: `s3:GetObject`, `s3:PutObject`, `s3:DeleteObject`, `s3:ListBucket`, `s3:*`. See [supported actions](/content/docs/iam/policies/supported-actions/index.html).  
    **Resource** string[] required  
    S3 resource ARNs. Use `arn:aws:s3:::bucket` for bucket-level and `arn:aws:s3:::bucket/prefix/*` for prefix-scoped access.  
    **Condition** object  
    Optional conditions (IP, time-based). See [condition examples](/content/docs/iam/policies/examples/ip-restrictions/index.html).  
  ]  
  **description** string  
  A description for the policy  
  **Possible values:** `<= 1000 characters`  
]

**access_key_scope** AccessKeyScope  
Controls whether the key receives the implicit default-allowed operations (such as create bucket or list buckets) on top of what its policies and bucket roles grant.

- `standard` (default): grants the default-allowed operations.
- `no_default_allow`: denies them, so the key can do only what its policies and bucket roles explicitly allow.

**Possible values:** [`standard`, `no_default_allow`]

CreateAccessKeyRequest

```json
{
  "name": "string",
  "user_id": "string",
  "user_role": "Admin",
  "buckets_roles": [
    {
      "bucket_name": "string",
      "role": "ReadOnly"
    }
  ],
  "attach_policies": [
    "string"
  ],
  "create_policies": [
    {
      "name": "string",
      "document": {
        "Version": "2012-10-17",
        "Statement": [
          {
            "Sid": "string",
            "Effect": "Allow",
            "Action": [
              "string"
            ],
            "Resource": [
              "string"
            ],
            "Condition": {}
          }
        ]
      },
      "description": "string"
    }
  ],
  "access_key_scope": "standard"
}
```