Giving one engineer access to a bucket is a policy. Giving a team access is a system. The moment designers, account managers and finance staff need the same files, the questions change from “can they read it” to “who opened it, who shared it, and can anyone delete it by accident”.
This checklist is how we think about the problem at BucketDesk. It applies to any tool you put between people and a bucket.
1. Nobody holds an AWS access key
Shared access keys are the root of most S3 incidents. They do not expire, they end up in desktop clients and scripts, and they cannot tell you which person used them. A team workspace should connect through an IAM role and work with temporary credentials, so there is no secret to leak and nothing to rotate.
2. The connection is scoped and revocable by you
The role should name the buckets, and ideally the prefixes, the workspace may touch, and it should require an external ID so that no other customer of the same vendor can be confused for you. Deploying it with CloudFormation means your security team can read the exact permissions before they exist, and remove them by deleting one stack.
3. People sign in as themselves
The AWS role answers what the workspace can do. It does not answer who did it. Each person needs their own sign-in and a role inside the workspace. A sensible split is a viewer who can browse and preview, an operator who can also share, extract, upload and restore, and an owner who can also delete and manage members.
4. External sharing expires and leaves a trail
Sending a file to a client should not mean making an object public or mailing a presigned URL that works for whoever holds it. A safer share has a required expiry, can be revoked, asks the recipient to verify their email address, and records every open. It also helps to choose between a live link that follows the object and a snapshot frozen at the moment of sharing.
5. Expensive and destructive actions are guarded
- Archive extraction shows the destination, object count, expansion ratio, key collisions and estimated cost before it writes anything.
- Delete requires a specific role and a confirmation.
- Cold storage restore shows the retrieval tier and its cost, because AWS bills it to your account.
6. Activity is recorded and logs stay clean
Every share, upload, restore, extraction, preview and membership change should be recorded against a person and be exportable. Just as important is what is kept out of ordinary logs: credentials, verification codes, signed URLs and file contents.
How BucketDesk applies this
BucketDesk connects through a scoped IAM role deployed by CloudFormation and assumes it for temporary credentials, so no AWS access keys or secrets are shared or stored. Connections and Activity are part of every plan, including the free Starter plan. Viewer, Operator and Owner roles and audit export begin at Pro. SSO and SCIM are handled as custom requests rather than sold as a plan today.
A secure team workspace for S3 removes shared keys, scopes its own access, identifies every person, makes external sharing expire, puts a review in front of costly or destructive actions, and keeps a record you can export.