s3.accesskey.create¶
Create an S3 access key.
An access key is the SigV4 credential pair a client signs S3 requests with. It belongs to a local or directory services account, and the S3 service runs that key’s requests as the account. It can never authenticate to the TrueNAS API. The access key id and the secret are generated unless supplied. The secret stays readable to administrators holding SHARING_S3_WRITE.
No Additional Items
Tuple Validation
Parameter 1: data
data
Type: objectConfiguration for the new access key.
No Additional PropertiesName
Type: stringHuman-readable name for the access key.
Must be at least 1 characters long
Must be at most 200 characters long
Username
Account the access key belongs to.
Must be at least 1 characters long
Access Key
Default: nullAccess key id for the new key. Generated when omitted.
Must match regular expression:
^[A-Z0-9]{16,128}$
Secret
Default: nullSecret access key for the new key. Generated when omitted.
Must match regular expression:
^[\x21-\x7E]+$
Must be at least 16 characters long
Must be at most 128 characters long
Enabled
Type: boolean Default: trueWhether the access key may be used.
Expires At
Default: nullExpiration timestamp for the access key or null for no expiration.
Manage Buckets
Type: boolean Default: falseWhether this access key may create, delete, or modify buckets through the S3 protocol. Setting it requires the account that owns the key to hold the SHARING_S3_WRITE role.
S3AccesskeyEntry
Type: objectThe created access key, including its secret.
No Additional PropertiesId
Type: integerUnique identifier for the access key.
Name
Type: stringHuman-readable name for the access key.
Must be at least 1 characters long
Must be at most 200 characters long
Username
Account the access key belongs to, or null if that account no longer exists.
Must be at least 1 characters long
User Identifier
Stored account linkage. A numeric user ID for local accounts or a SID for directory services accounts.
Local
Type: booleanWhether the access key belongs to a local user account rather than a directory services one.
Access Key
Type: stringThe S3 access key id clients sign requests with.
Must match regular expression:^[A-Z0-9]{16,128}$
Secret
The S3 secret access key. Readable only by administrators holding SHARING_S3_WRITE; redacted for everyone else. null when the secret was lost to a configuration restore without the secret seed.
Enabled
Type: booleanWhether the access key may be used. A disabled key is refused by the S3 service.
Expires At
Default: nullExpiration timestamp for the access key or null for no expiration.
Created At
Type: stringFormat: date-timeTimestamp when the access key was created.
Last Used At
Default: nullTimestamp of when the S3 service last accepted a request signed with this key. The value is null if the key has never been used. Access Key timestamps are updated from the S3 service at periodic intervals. This field is read-only.
Manage Buckets
Type: boolean Default: falseWhether this access key may create, delete, or modify buckets through the S3 protocol. Setting it requires the account that owns the key to hold the SHARING_S3_WRITE role.
Status
Type: enum (of string)Effective state of the access key. Only ENABLED keys are usable. DISABLED was set by an administrator, EXPIRED passed its expiration, USER_MISSING belongs to a directory account that no longer resolves (a deleted local account takes its keys with it), and SECRET_LOST lost its secret to a configuration restore without the secret seed and must be rotated.
Must be one of:
- "ENABLED"
- "DISABLED"
- "EXPIRED"
- "USER_MISSING"
- "SECRET_LOST"
Required roles: SHARING_S3_WRITE