About sub-users | Zata Docs

A sub-user is an extra login under your Zata account, for a team member, a customer or an app. It gets its own access keys, and it can only use the buckets and actions you give it. You never have to share your own keys, and you can suspend or delete a sub-user at any time. You manage sub-users under Subusers in the Zata console.

How it works

Create the sub-user and choose its access type and regions. Zata gives it one key pair per region.
Assign buckets. A new sub-user can reach nothing until you do this. Choose a permission level such as View Only or Full Access, for the whole bucket or one folder.
The sub-user connects with its keys in any S3 tool. A sub-user with dashboard access can also sign in to its own dashboard.

What a sub-user can and cannot do

A sub-user can only do what you allowed on each bucket. On top of that, some things are always for the account owner only:

A sub-user cannot…	Notes
Create or delete buckets	Creating a bucket returns `AccessDenied`.
See a list of its buckets with S3 tools	Listing all buckets returns an empty list, even when it has access. Open the bucket by its name instead.
Make a bucket or file public, or change ACLs	Not grantable to sub-users.
Change versioning, bucket tags or file tags	Change versioning, Manage bucket tags and Add/edit file tags cannot be given to sub-users.
Read or change bucket policies	Only you manage policies. A sub-user can request more permissions.
Create, deactivate or delete keys	It can rotate its own key from its dashboard.
Add regions, invite others or see billing	Owner only.

In S3 tools, type the bucket name in the path or bucket field instead of browsing the bucket list. In rclone, also set no_check_bucket = true. For an example, see S3 Browser with a sub-user key.

Limits

Limit	Default
Sub-users per account	5
Access keys per sub-user	1 per region
Invitation emails per sub-user	3

When you reach the sub-user limit, delete a sub-user you no longer need, or contact support to ask for more.

If your own account is suspended (for example for billing), all your sub-users are suspended too. See Suspend and reactivate.

In this section

Create a sub-user

Choose the access type, username and regions.

Access types and permissions

Keys only or keys plus dashboard, and what each permission level allows.

Assign a bucket

Give a sub-user access to a bucket or folder.

Policies and requests

Pick single actions and handle requests for more access.

Invitations

How dashboard sub-users set their password and sign in.

What sub-users see

The sub-user’s own dashboard.