s3.accesskey.create¶
Create an S3 access key.
An access key is the SigV4 credential pair a client signs S3 requests with. It belongs to a local or directory services account, and the S3 service runs that key’s requests as the account. It can never authenticate to the TrueNAS API. The access key id and the secret are generated unless supplied. The secret stays readable to administrators holding SHARING_S3_WRITE.
No Additional Items
Tuple Validation
Parameter 1: data
data
Type: objectConfiguration for the new access key.
No Additional PropertiesName
Type: stringHuman-readable name for the access key.
Must be at least 1 characters long
Must be at most 200 characters long
Username
Account the access key belongs to.
Must be at least 1 characters long
Access Key
Default: nullAccess key id for the new key. Generated when omitted.
Must match regular expression:
^[A-Z0-9]{16,128}$
Secret
Default: ""Secret access key for the new key. Generated when omitted.
Must match regular expression:
^[\x21-\x7E]+$
Must be at least 16 characters long
Must be at most 128 characters long
Enabled
Type: boolean Default: trueWhether the access key may be used.
Expires At
Default: nullExpiration timestamp for the access key or null for no expiration.
Manage Buckets
Type: boolean Default: falseWhether this access key may create and delete buckets through the S3 protocol. Setting it requires the account that owns the key to hold the SHARING_S3_WRITE role, checked when a call turns it on. It scopes the key, not the account: an account may hold several access keys, and leaving this off on one of them affects neither its other keys nor its own access to sharing.s3.create.
S3AccesskeyEntry
Type: objectThe created access key, including its secret.
No Additional PropertiesId
Type: integerUnique identifier for the access key.
Name
Type: stringHuman-readable name for the access key.
Must be at least 1 characters long
Must be at most 200 characters long
Username
Account the access key belongs to, or null if that account no longer exists.
Must be at least 1 characters long
User Identifier
Stored account linkage. A numeric user ID for local accounts or a SID for directory services accounts.
Local
Type: booleanWhether the access key belongs to a local user account rather than a directory services one.
Access Key
Type: stringThe S3 access key id clients sign requests with.
Must match regular expression:^[A-Z0-9]{16,128}$
Secret
The S3 secret access key. Readable only by administrators holding SHARING_S3_WRITE; redacted for everyone else. null when the secret was lost to a configuration restore without the secret seed.
Enabled
Type: booleanWhether the access key may be used. A disabled key is refused by the S3 service.
Expires At
Default: nullExpiration timestamp for the access key or null for no expiration.
Created At
Type: stringFormat: date-timeTimestamp when the access key was created.
Last Used At
Default: nullTime the S3 service last accepted a request signed with this key, or null if the key has never been used. The S3 service reports this at intervals, so a recent request can be absent for a short time. This field is read-only.
Manage Buckets
Type: boolean Default: falseWhether this access key may create and delete buckets through the S3 protocol. Setting it requires the account that owns the key to hold the SHARING_S3_WRITE role, checked when a call turns it on. It scopes the key, not the account: an account may hold several access keys, and leaving this off on one of them affects neither its other keys nor its own access to sharing.s3.create.
Status
Type: enum (of string)Effective state of the access key. Only ENABLED keys are usable. DISABLED was set by an administrator, EXPIRED passed its expiration, USER_MISSING belongs to a directory account that no longer resolves (a deleted local account takes its keys with it), and SECRET_LOST lost its secret to a configuration restore without the secret seed and must be rotated.
Must be one of:
- "ENABLED"
- "DISABLED"
- "EXPIRED"
- "USER_MISSING"
- "SECRET_LOST"
Required roles: SHARING_S3_WRITE