# Ensure Object Storage Users Have Least-Privilege Access

- Source: https://support.icompaas.com/support/solutions/articles/a_1791826029516267-ensure-object-storage-users-have-least-privilege-access
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [OVH Cloud](https://support.icompaas.com/support/solutions/c_1791819364512367) › [checks](https://support.icompaas.com/support/solutions/folders/f_1791819376721251)
- Last updated: 2026-10-12
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure Object Storage users are given only the access they need, for example read-only access to one bucket, rather than administrator access to all buckets. Custom user policies can be used to limit actions and buckets.

**Rationale**

Object Storage users have S3 credentials that are often stored in applications and scripts. A user with administrator rights can read, change, or delete every bucket, so a leaked credential could expose or destroy all stored data. Limiting each user to the buckets and actions it needs reduces this risk.

**Impact**

-   Limits damage from leaked S3 credentials
    
-   Each application gets only the access it needs
    
-   Applications may need new users with narrower rights
    

**Default Value**

When a user is created, a role must be chosen, and administrator access can be granted.

**Pre-Requisites**

-   Permission to manage Object Storage and users in the Public Cloud project
    

**Test Plan**

1.  Log in to the OVHcloud Control Panel at [https://www.ovh.com/manager/](https://www.ovh.com/manager/).
    
2.  In the left-hand menu, select Public Cloud and choose your project.
    
3.  In the left-hand menu, select Object Storage.
    
4.  Open the Object Storage Users tab and review each user's role or policy.
    
5.  Flag users with administrator access, or access to buckets they do not need.
    
6.  If any are found, follow the implementation steps.
    

**Implementation Steps**

1.  Log in to the OVHcloud Control Panel at [https://www.ovh.com/manager/](https://www.ovh.com/manager/).
    
2.  In the left-hand menu, select Public Cloud and choose your project.
    
3.  In the left-hand menu, select Object Storage.
    
4.  Open the Object Storage Users tab and, for the user, select the option to import or edit its policy.
    
5.  Apply a policy that allows only the needed actions on the needed buckets, for example s3:GetObject and s3:ListBucket on one bucket.
    
6.  Confirm that the application still works.
    

**Backout Plan**

1.  Log in to the OVHcloud Control Panel at [https://www.ovh.com/manager/](https://www.ovh.com/manager/).
    
2.  In the left-hand menu, select Public Cloud and choose your project.
    
3.  In the left-hand menu, select Object Storage.
    
4.  Re-apply the previous role or policy to the user.
    

**Reference**

-   [https://docs.ovhcloud.com/en/guides/storage-and-backup/object-storage/s3-identity-and-access-management](https://docs.ovhcloud.com/en/guides/storage-and-backup/object-storage/s3-identity-and-access-management)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.