Access types and permissions
Keys only or keys plus dashboard, and what each bucket permission allows.
Two separate choices decide what a sub-user can do:
- The access type decides how it connects — with keys only, or with keys and a dashboard login. You choose it when you create the sub-user.
- The permissions decide what it can do in each bucket. You set them when you assign a bucket. The access type alone gives no access to any bucket.
Access types
To give a programmatic sub-user dashboard access later, use Upgrade to Console on its page. See Give dashboard access later.
Permission levels
When you assign a bucket from the sub-user’s page, you pick one of four levels:
- A level can apply to the whole bucket or to one folder. For a folder, Full Access does not include the bucket-wide View versioning status and View bucket tags.
- Uploading a file with the same name as an existing file replaces it. Upload Only and View & Upload can therefore overwrite files. Turn on versioning if you need to keep old copies.
- Some actions can never be given to a sub-user, whatever the level. See What a sub-user can and cannot do.
- In lists, a rule shows its Notes text if you entered one, otherwise the name of its permission set. A View Only rule appears as View & Download.
Pick single actions
If none of the four levels fits, create a policy on the Policies page and tick the exact actions you want, for example Download files only. See Sub-user policies and requests.