Managing Team Access and Sub-Users on AIOZ Storage

Inviting a teammate onto an AIOZ Storage account happens through a three-step wizard in the dashboard's Members tab, not an email invite link or an IAM console. This is the step-by-step version of creating an AIOZ storage team member: the exact fields the General tab asks for, how bucket permissions get assigned in the Assign tab, and why the Confirm tab's credential-download step matters more than it looks. It also covers deleting a member, and where a member account stops making sense and an access grant starts.

TL;DR:

• AIOZ Storage members are created through a 3-step wizard: General, Assign, Confirm.
• Each member gets its own login name and password, plus per-bucket List/Write/Read/Delete/All permissions.
• Copy or download the credentials on the Confirm tab. AIOZ's tutorial does not document a way to retrieve them again afterward.

What Is a Sub-User, Quickly

A member (AIOZ's docs also call this a sub-user) is a persistent account tied to your main AIOZ Storage account, with its own login name, password, and a set of bucket permissions you assign. It is not a temporary credential, it exists until someone deletes it. If you need scoped, time-boxed access instead, that is a different tool, an access grant, covered at the end of this article and in full in AIOZ Storage Access Control: Macaroons and Access Grants. This article is about the member workflow specifically: what you click, in what order, to actually add someone.

Step 1: The General Tab, Name and Password

From the dashboard, open the Members tab and click Add Member. The wizard's first screen, the General tab, asks for two things:

• A member name, at least 8 characters, unique to your account.
• A password, at least 8 characters, with at least one uppercase letter and one digit.

You confirm the password on the same screen, then click Next to move to the Assign tab. There is no email field here and no invite link sent anywhere. You set the login credentials yourself and hand them to the teammate directly, which is the first reason the Confirm tab later matters.

Step 2: The Assign Tab, Bucket Permissions and the Passphrase Requirement

The Assign tab is where you decide what this member can actually touch. Click Assign Bucket, pick a bucket from the modal that opens, and set the permission level: All, Read, Write, List, or Delete, the same five-option set used for access grants. Then you are asked for that bucket's passphrase before you can click Add Bucket.

That passphrase requirement is not a formality, it follows directly from how AIOZ Storage encryption works. A bucket's contents are only decryptable with its passphrase, and AIOZ itself never stores that passphrase (see How AIOZ Storage Encryption Actually Works for the full key chain). Granting a member access to a bucket, not just a permission label, but real ability to read or write its contents, means the passphrase has to be supplied at assignment time. You can repeat this step to assign the same member to multiple buckets with different permission levels on each before continuing.

Click Next once every bucket assignment is set.

Step 3: The Confirm Tab, Why You Only Get One Chance to Copy Credentials

The Confirm tab shows the member's login credentials, Account ID, member name, and password, with Copy All and Download All buttons. AIOZ's tutorial documentation does not describe a way to view these credentials again from the dashboard after this point, so treat this screen as your only reliable chance to save them. Copy them into a password manager or download the file before moving on.

Below the credentials, a checkbox reads: "I have copied/downloaded the member's login credentials (Account ID, Member name, and Password)." Check it, then click Create Member to finish. The member can now log in with the name and password you set, scoped to exactly the buckets and permissions you assigned in Step 2.

Deleting a Member

To remove a member, go back to the Members screen, find them in the list, and click the three-dot menu next to their name. Select Delete. A confirmation dialog shows the member's name for you to verify before you click Delete again to finish.

Read the warning before confirming: "This action cannot be undone. All data associated with the deleted member...will be permanently removed." This is not a suspension. It is a permanent deletion of the member account and, per AIOZ's own wording, the data associated with it, so confirm you actually mean to remove them before clicking through.

Members vs Access Grants: Which One to Use

Both tools share access, but they solve different problems, and mixing them up leads to either too much standing access or too much re-issuing overhead.

Use a member when someone is joining your team on an ongoing basis and needs their own login: an employee, a long-term contractor, someone who will be back next week and the week after. Use an access grant instead when the access is temporary or narrow by design: a script, a one-off integration, a contractor whose engagement has a known end date. Access grants expire on a schedule you set (24 hours up to 1 year) and never need a separate deletion step. Members persist until you delete them, and AIOZ Storage caps this at 100 sub-users per account, per its published usage limits.

This is the same tradeoff NIST's principle of least privilege describes generally, and the same one AWS's own IAM best practices push teams toward on the S3 side: grant only the access a task actually needs, for only as long as it needs it. A member with All permissions on every bucket is convenient to set up and wrong for most teammates. Assigning Read on the one bucket someone's job actually touches, or reaching for a short-lived access grant instead of a standing member account, is the practical version of that principle on AIOZ Storage specifically.

One more distinction worth knowing before you build a workflow around either: access grant revocation is currently all-or-nothing for anything derived from a primary grant, a real limitation covered in the access control hub. Member deletion has no such tree structure. Deleting one member affects only that member.

Frequently Asked Questions

How do I invite a new team member to AIOZ Storage?
There is no email invite. From the dashboard's Members tab, click Add Member, then set a name and password for them yourself in the General tab, assign bucket permissions in the Assign tab, and copy or download their credentials in the Confirm tab to hand over directly.

What are the password requirements for an AIOZ Storage member account?
At least 8 characters, with at least one uppercase letter and one digit. The member name also needs to be at least 8 characters and unique to the account.

What permission levels can I assign a member per bucket?
Five options: All, Read, Write, List, or Delete, the same set used for access grants. You assign a level per bucket, and a member can be assigned to more than one bucket with different levels on each.

Why does adding a member to a bucket require the bucket's passphrase?
Because AIOZ Storage never stores bucket passphrases itself. Granting a member real read or write access to an encrypted bucket requires supplying the passphrase at assignment time, not just setting a permission label.

Can I view a member's credentials again after creating them?
AIOZ's tutorial documentation does not describe a way to do this from the dashboard. Copy or download the credentials on the Confirm tab before finishing the wizard.

Can I recover a deleted AIOZ Storage member account?
No. AIOZ's own confirmation dialog states the action cannot be undone and that data associated with the member is permanently removed.

How many sub-users can one AIOZ Storage account have?
100 sub-users per account, per AIOZ's published usage limits, the same page that sets the 100-bucket and 100-request-per-second limits.

Do AIOZ Storage members expire the way access grants do?
No. A member persists until someone deletes it. Access grants are the tool for access that should expire automatically, on a schedule from 24 hours up to 1 year.

Related Reading

• AIOZ Storage Access Control: Macaroons and Access Grants - the full concept behind members and access grants, including how macaroon-based revocation works.
• How AIOZ Storage Encryption Actually Works - why a bucket passphrase is required to assign a member, and the key derivation chain behind it.
• AIOZ Storage Explained: S3-Compatible Decentralized Storage - AIOZ Storage's account limits, pricing, and overall model.
• AIOZ Storage Glossary: Bucket, Passphrase, Macaroon - quick definitions for sub-user, member, and access grant.
• File Management API with FastAPI, Boto3, and AIOZ Storage - wiring an access grant, the credential type this article contrasts members against, into a working API.

References

• AIOZ Storage Documentation: Manage Members Tutorial
• AIOZ Storage Documentation: Sub-User System
• AIOZ Storage Documentation: Usage Limits
• NIST CSRC Glossary: Least Privilege
• AWS IAM: Security Best Practices