Skip to documentation
quickS3.com Open app
Browse documentation
Start here

Admin quickstart

Create a role that grants one folder, invite a teammate into it, and check what they can reach. The order matters, so build the role first.

Admin Owner

In quickS3, nobody can open a bucket until a role says they can. This guide sets up one teammate from scratch: you build the role first, then invite them into it. Doing it in that order means you decide exactly what they get before they ever sign in, and the next person who needs the same access gets the same role.

You need to be an Owner or an Admin, and at least one storage connection has to exist. If there isn’t one yet, an Owner starts with Connect your first bucket.

1. Create the role

  1. Open Roles and select Create role.
  2. Pick a starting point. For a teammate who should work in one folder, choose Uploader. It creates a single rule you can narrow down.
  3. Give the role a name that says what it’s for, like “Finance reports”, and select Create role.
Create a role dialog with four starting points: Read-only, Uploader, Full access, and Start empty, each with a one-line description.
Read-only and Full access add a rule for every bucket that exists right now. Uploader adds one rule you then point at the right place.

The role editor opens with the template’s rules filled in but not saved yet. Check each rule before you save:

  • Connection and Bucket: where the rule applies.
  • Prefix: the folder inside the bucket, for example reports/. Leave it empty to cover the whole bucket.
  • Read lets them browse, preview, download, and share files. Write lets them upload, and also overwrite, delete, and create folders.
Role editor with one Allow rule on the S3 Files Shared connection, bucket public, prefix reports/, with Read and Write both ticked, and the Save role and Discard changes buttons.
One rule: read and write, but only inside reports/ in the public bucket.
  1. Select Save role.

2. Invite your teammate

  1. Open People and select Invite.
  2. Enter their email address.
  3. Tick the role you just made. Tick Admin as well only if they should help run the organisation (it gives no file access on its own).
  4. Select Send invite.
Invite a teammate dialog with alex@example.com in the Email field, Admin unticked, Finance reports ticked, and the Send invite button.
Tick the role you built. Leave Admin unticked unless they’ll help manage people and roles.

They get an email with a link. Until they accept, they show in the People list as Invited, and you can select Cancel invite to withdraw it. An invitation expires after seven days; if that happens, invite them again.

3. Check what they can reach

Once they accept, their row turns Active, and the Access column sums up their roles, for example “Read & write · 1 rule across 1 bucket”. If it says No access, they have no role with an Allow rule yet: select their roles and tick one, then Save.

To confirm it works from their side, ask them to open Overview. They should see only the bucket in your rule. When they open it, the top level shows just the reports/ folder, and everything outside it stays hidden. Anything they do is recorded in the audit log.

Things that catch people out

Write includes delete

There’s no upload-only permission. A role called “Uploader” with Write on a whole bucket lets that person delete anything in it. Narrow Write to a prefix when you can.

Admin isn’t file access

Admins manage people and roles, but they can’t open a bucket unless one of their roles grants it. Only Owners can reach everything.

Deny always wins

If any of someone’s roles has a Deny rule, an Allow in another role won’t undo it. Remove or narrow the Deny instead. Allow and deny rules explains how rules combine.