9 hours ago
Hello,
We're using Railway Storage Buckets and would like to run a one-time diagnostic job with strictly read-only S3 access.
Does Railway support creating separate S3 credentials that:
- Allow only ListBucket and GetObject operations?
- Restrict access to a specific object prefix?
- Explicitly prevent PutObject, DeleteObject, and access to unrelated objects?
If this is not supported, is there an officially recommended way to run such a read-only diagnostic without granting write access to the bucket?
We're looking for a solution that does not require exposing credentials outside Railway or modifying an existing production web service.
Thank you!
1 Replies
Status changed to Awaiting Railway Response Railway • about 4 hours ago
4 hours ago
We don't support that today. Each bucket has a single set of S3 credentials, and those credentials have full read and write access to the bucket, so there is no way to create a second key limited to ListBucket and GetObject, scoped to a prefix, or blocked from PutObject and DeleteObject.
The only credential management available is viewing the existing key or resetting it, which invalidates the old key and issues a new one with the same full access (CLI reference). We don't have a recommended read-only method for buckets, so any job using these credentials will have write access to the whole bucket.
Status changed to Awaiting User Response Railway • about 4 hours ago