Security · AWS access

What BucketDesk can do in your AWS account. And how to take it back.

You connect a bucket by creating an IAM role in your own account from BucketDesk’s CloudFormation template. The role reaches one bucket and one folder, reads by default, and gains each extra power only when you switch it on. Delete the stack and BucketDesk’s access ends. The Storage overview and S3 Savings tools install their own stacks, covered below. Three permissions reach wider than one folder; here’s why.

See the exact permissions Security overview

How the connection works

Your account holds the role. BucketDesk borrows it.

Delete the stack in your account and the role, and BucketDesk’s access, are gone.

A role in your account: You create it by submitting a CloudFormation stack, after reviewing every resource and permission on the AWS console screen. You own it, and CloudTrail records every call made with it.
Your own external ID: Each connection gets a random 64-character external ID. The role trusts one BucketDesk role, and only when the request carries that ID.
15-minute credentials: BucketDesk works with temporary AWS credentials that expire after 15 minutes, and labels each session with the BucketDesk user acting, so CloudTrail shows who did what.
Checked twice: BucketDesk’s code confines every request to the bucket and folder you approved, and the IAM policy enforces the same boundary in AWS.

Exact actions by plan

Every IAM action the template can grant.

One template serves every plan. Each capability is a true or false parameter that defaults to false, and your plan decides which ones BucketDesk accepts for a connection.

Capability and IAM actions	Scope	Minimum	Standard	Ultra
Browse, search and readEvery connection starts here. Previews, downloads and sharing all read through these permissions.`s3:ListBucket, s3:ListBucketVersions, s3:GetObject, s3:GetObjectVersion, s3:GetObjectAttributes, s3:GetBucketVersioning`	Your folder (versioning check: the bucket)	Included	Included	Included
Encrypted bucketsAdded when you name a customer-managed KMS key. Usable only through S3 in your region.`kms:Decrypt, kms:DescribeKey, kms:GenerateDataKey`	The one key you name	Opt-in	Opt-in	Opt-in
Archive extractionRuns on AWS Batch inside your account, with its own network, worker roles, 30-day log group and a scratch bucket that empties itself after 7 days. New worker versions must come from the same image repository, pinned by digest.`s3:PutObject, s3:PutObjectTagging, s3:DeleteObject, batch:SubmitJob, batch:RegisterJobDefinition, batch:CancelJob`	Your folder and the extraction queue	Not included	Opt-in	Opt-in
UploadsFiles go from the browser straight into your bucket in parts.`s3:PutObject, s3:AbortMultipartUpload, s3:ListMultipartUploadParts, s3:ListBucketMultipartUploads`	Your folder	Not included	Not included	Opt-in
Delete, with a recycle binDeleted files wait 30 days in a recycle bin inside your bucket. On Standard as an add-on.`s3:DeleteObject, s3:DeleteObjectVersion, s3:PutObject, s3:AbortMultipartUpload`	Your folder	Not included	Opt-in	Opt-in
Restore from archive tiersBrings Glacier and Deep Archive files back so they can be opened. AWS bills the retrieval.`s3:RestoreObject`	Your folder	Not included	Not included	Opt-in
Document chatA separate role that calls Amazon Bedrock in your account. It holds Bedrock permissions only; reading the file stays with the storage role.`bedrock:InvokeModel, bedrock:InvokeModelWithResponseStream, aws-marketplace:Subscribe`	Five named models	Not included	Not included	Opt-in

The wider permissions

Three permissions reach wider than one folder.

AWS can’t narrow these three, so here they are in full, with why each is there and how you keep it off.

Batch job controls

batch:CancelJob, batch:TerminateJob, batch:DescribeJobs

What: Account-wide, when archive extraction is on.
Why: AWS Batch offers no queue-level scope for these three actions. BucketDesk cancels by the job ID it saved when it submitted the job.
Your control: Extraction starts off. Turn it on in an account without other Batch work.

Retention rules

s3:PutLifecycleConfiguration

What: The whole bucket’s lifecycle rules.
Why: IAM has no condition for a rule’s contents. BucketDesk writes only bucketdesk-retention-* rules and keeps every other rule.
Your control: BucketDesk never pre-fills this switch. Only you can turn it on, on the CloudFormation screen.

Account-wide tool reads

s3:ListAllMyBuckets, cloudwatch:GetMetricData

What: Storage overview and S3 Savings see every bucket name and storage metric. S3 Savings also reads your S3 bill and CloudTrail log files.
Why: Account totals need every bucket.
Your control: Separate stacks, installed only by a workspace admin. S3 Savings changes only buckets matching the pattern you set.

BucketDesk Tools

Tools install their own stack.

The Storage overview and S3 Savings each deploy a separate CloudFormation stack with its own role, trusted the same way: one BucketDesk role, your external ID, short sessions. Each stack reports a hash of its permissions, so BucketDesk can confirm the deployed role matches what your workspace approved.

Storage overview

Account-wide storage totals, growth and storage classes on the Storage page. Workspace admins install it per AWS account, on any plan.

Creates: One role, a private report bucket whose reports expire after 30 days, and one S3 Storage Lens configuration named after the install.
Main read actions: s3:ListAllMyBuckets, s3:GetBucketLocation, cloudwatch:GetMetricData, cloudwatch:ListMetrics, s3:GetObject (its own report bucket)
Change actions: s3:PutStorageLensConfiguration, s3:DeleteStorageLensConfiguration, s3:PutStorageLensConfigurationTagging, s3:DeleteObject (its own report bucket)
Reach: Bucket names and storage metrics across the account. Its only object access is its own report bucket. The Storage Lens permissions name its own configuration.
What BucketDesk receives: Bucket names, sizes, object counts and storage-class totals. Advanced Storage Lens metrics are a separate switch, billed by AWS at $0.20 per million objects a month.
To remove: Uninstall on the Storage page, which empties the report bucket, then delete the stack.

S3 Savings

Finds S3 storage savings and applies the ones you approve. Workspace admins install it on any plan, and choose which buckets it reaches.

Creates: One role, a private work bucket for access logs, a CloudTrail trail that records reads only for buckets you apply changes to, and four small Lambda helpers that sample buckets inside your account.
Main read actions: s3:ListBucket, s3:ListBucketVersions, s3:GetLifecycleConfiguration, s3:GetBucketPolicy, cloudwatch:GetMetricData, ce:GetCostAndUsage, lambda:InvokeFunction (its four helpers)
Change actions: s3:PutLifecycleConfiguration, s3:PutIntelligentTieringConfiguration, s3:PutBucketLogging, s3:AbortMultipartUpload, cloudtrail:PutEventSelectors (its own trail)
Reach: Bucket settings and changes are limited to the bucket name pattern you set at install, every bucket by default. Bucket names, metrics and your S3 bill are read account-wide. Change permissions are used only when you click Apply, and every change is reported per bucket. The helpers can read CloudTrail log files in your account to count reads.
What BucketDesk receives: Counts and totals, including totals by file extension. The helpers hash file names inside your account before counting reads, and return the numbers.
To remove: Remove BucketDesk’s rules from any bucket on the S3 Savings page, then delete the stack. The work bucket is kept for you to delete.

Where the boundary sits

What the role reaches, and where it stops.

The full list of services
The connection roles hold permissions for S3, for KMS through S3, for AWS Batch when extraction is on, and for Bedrock when document chat is on. That is the whole list. Tools install their own roles, listed above.
Your folder, by ARN
Each S3 permission names your bucket and folder in its resource ARN or prefix condition, so AWS enforces the boundary on every call.
You change the role
Turning a capability on or off opens a CloudFormation update that you review and submit. The stack changes only when you submit it.
Write access starts off
Every capability switch defaults to off, including on Ultra. A plan makes a switch available; you decide whether to use it.

Which bytes reach BucketDesk

Where your files travel.

Downloads, images, video and audio
BucketDesk signs a short-lived S3 link and your browser fetches the file directly from your bucket.
Uploads
Your browser sends the file to your bucket in parts, each over its own signed link.
Text, PDF, HEIC photos and thumbnails
Streamed through BucketDesk’s servers in memory for the length of the request, then discarded.
Word, Excel and PowerPoint
BucketDesk’s own document server fetches the file with a short-lived link and holds it while the document is open. Edits are saved back to your bucket.
Document chat
The file passes through BucketDesk’s servers to Amazon Bedrock in your own AWS account. Chats you keep are stored encrypted for 30 days after their last use.
Archive extraction
Runs on AWS Batch in your account, reading and writing your bucket there. BucketDesk receives a summary of each job.

What BucketDesk keeps

What stays with BucketDesk, and for how long.

File contents stay in your bucket. BucketDesk keeps these records about them. File paths, chats and role details are encrypted by the application on top of database encryption.

Record	Contains	Kept for
Connection settings	Account ID, region, bucket and folder. Role ARNs and the external ID are erased the moment you disconnect.	30 days after you disconnect
Activity log	Who viewed, shared, moved or deleted which file path	13 months
Kept chats	Questions, answers and cited passages	30 days after last use
Chats you don’t keep	Questions and answers	Until you close the chat
Shares	File paths and recipient email	90 days after expiry
Jobs and notifications	File paths for uploads, restores, moves and deletes; file names in alerts	90 days after they end
Archive extraction	A summary of each job	With the job
Server logs	Request paths, status codes and timings, without query strings	Replaced as newer logs fill 100 MB per service

When you disconnect, role details are erased at once; that connection’s shares, chats and job records are deleted 30 days later, and its activity log entries stay for 13 months.

Take access back in one step.

Delete the BucketDesk- stack in the CloudFormation console. The roles and their permissions go with it, and BucketDesk’s next request is refused. If extraction was on, the scratch bucket stays behind for you to delete; its contents expire within 7 days. To remove one capability, switch it off in BucketDesk and submit the stack update it opens.

Start free trial IAM roles and external IDs explained