TntDrive asks for an access key. The key you give it decides whether a leak is a small problem or a total account disaster. Build the key the right way: one IAM user, one bucket, nothing else.
✍️ Technical Anshu☁️ Amazon S3🪟 Windows 10 / 11
🎥 Watch the full setup in the video — TntDrive install, account add and drive mapping, step by step
Every S3 drive guide reaches the same screen — Access Key ID, Secret Access Key — and most people fill it with whatever key they can generate fastest. That choice matters more than the whole rest of the setup. This guide creates a scoped key: a key that works perfectly for your drive and is nearly useless to anyone who steals it.
AWS Console — IAM policy for one bucket only (template)
A policy template — replace your-bucket-name with your real bucket name. This key can do nothing outside that one bucket.
1
Why the Root Key Is the One Mistake to Never Make
Your AWS root login is the master key to everything — every bucket, every service, and your payment method. When a drive tool asks for an access key, the lazy option is to generate one from the root account. Do not. If that key leaks — a stolen laptop, a careless screenshot, a synced config file — the finder does not just get your files, they get your entire AWS account.
The fix costs five minutes once: a separate IAM user whose key opens one bucket and nothing else.
2
Create the Drive-Only IAM User
Sign in to the AWS Console and open IAM → Users → Create user
Name it for its job and machine, for example s3-drive-office-pc — one user per PC, so you always know whose key is whose
Do not give this user console access; it only needs programmatic access keys
On the permissions step, choose to attach a policy later and finish creating the user
3
Attach the One-Bucket Policy
Open the new user → Permissions → Add permissions → Create inline policy
Switch to the JSON tab and paste the policy shown above, replacing your-bucket-name with your exact bucket name in both places
Save it with a clear name like OneBucketDriveAccess
What this policy means in plain words: the key can list and work with files inside that one bucket only. It cannot see your other buckets, cannot create users, cannot touch billing. Honest trade-off: a key without the list-all-buckets permission will not show a bucket picker in TntDrive — you simply type the bucket name by hand, exactly like the video's manual step. That small inconvenience is the sound of the key being properly locked down.
4
Create the Key and Note the One-Time Rule
Open the user → Security credentials → Create access key → choose the option for a third-party service or local code
You will see an Access Key ID and a Secret Access Key. The secret is shown only this one time — copy it straight into TntDrive, or store it in a password manager first
Never save the secret in a plain text file on the desktop, and never send it over chat or email
5
Keep the Key Healthy Over Time
One key per PC. If three machines mount the bucket, make three users or three keys — revoking one must never break the others
Rotate yearly: create a second key, swap it in TntDrive, test, then deactivate the old key
Watch the last-used date in IAM. A key that shows activity you do not recognise is a key to deactivate immediately and investigate
🔴 A screenshot of your key is a copy of your key. The example screens in this guide use clearly fake values like EXAMPLE-KEY-ID-0000. When you share your own setup screenshots anywhere, cover the secret key completely — or better, never screenshot that screen at all.
🎥 See the Complete Setup in the Video
Every click shown live — installing TntDrive, adding the S3 account and mapping the drive in Windows.
Technically yes, and it is the worst option available. A root-level key can reach every AWS service and your billing. A scoped IAM key limits any leak to one bucket. The five minutes you spend making the IAM user is the cheapest insurance in this entire setup.
Two PCs need the same bucket. Can they share one key?
They can, but they should not. Give each PC its own user and key. When one laptop is sold, lost or handed to someone else, you deactivate only that key and everyone else keeps working untouched.
I lost the secret key. Can AWS show it again?
No. AWS shows a secret key only once, at the moment you create it. If you lost it, create a second access key for the user, update TntDrive with the new pair, test the drive, and then deactivate the lost key.
This guide is based on the Technical Anshu video on mounting an S3 bucket as a Windows drive • Stuck on a step? Ask in the video comments 🙏