[Yandex Cloud documentation](../../index.md) > [Yandex Object Storage](../index.md) > [Tools](index.md) > File browsers > CyberDuck

# CyberDuck

[CyberDuck](https://cyberduck.io/) is a GUI client that allows you to work with cloud storages, including those compatible with the Amazon S3 API. CyberDuck is available for macOS and Windows and as a [console client](https://duck.sh/) for Linux.

## Getting started {#before-you-begin}

1. [Create a bucket](../operations/buckets/create.md).
1. [Create](../../iam/operations/sa/create.md) a service account.
1. [Assign](../../iam/operations/sa/assign-role-for-sa.md) the required role to the service account, e.g., `storage.editor`. To learn more about roles, see [Managing access with Yandex Identity and Access Management](../security/index.md).

       
   To work with objects in an [encrypted](../concepts/encryption.md) bucket, a user or [service account](../../iam/concepts/users/service-accounts.md) must have the following [roles for the encryption key](../../kms/operations/key-access.md) in addition to the `storage.configurer` [role](../security/index.md#storage-configurer):
   
   * `kms.keys.encrypter`: To read the key, [encrypt](../../kms/security/index.md#kms-keys-encrypter) and upload objects.
   * `kms.keys.decrypter`: To read the key, [decrypt](../../kms/security/index.md#kms-keys-decrypter) and download objects.
   * `kms.keys.encrypterDecrypter`: This role includes the `kms.keys.encrypter` and `kms.keys.decrypter` [permissions](../../kms/security/index.md#kms-keys-encrypterDecrypter).
   
   For more information, see [Key Management Service service roles](../../kms/security/index.md#service-roles).


   {% note tip %}

   You can assign a role for a folder or a bucket to a service account. A role for a folder gives the GUI client access to all the buckets in the folder. A role for a bucket gives the client access only to this particular bucket. For granular access, assign a role for a particular bucket.

   {% endnote %}

1. [Create a static access key](../../iam/operations/authentication/manage-access-keys.md#create-access-key).

        
    As a result, you will get the static access key data. To authenticate in Object Storage, you will need the following:
    
    * `key_id`: Static access key ID
    * `secret`: Secret key
    
    Save `key_id` and `secret`: you will not be able to get the key value again.

{% note info %}

A service account is only allowed to view a list of buckets in the folder it was created in.

A service account can perform actions with objects in buckets that are created in folders different from the service account folder. To enable this, [assign](../../iam/operations/sa/assign-role-for-sa.md) the service account [roles](../security/index.md#service-roles) for the appropriate folder or its bucket.

{% endnote %}

## Installation {#installation}

[Download](https://cyberduck.io/download/) the CyberDuck distribution for your OS and run it.

## Connection {#connection}

{% list tabs group=operating_system %}

- Windows {#windows}

  1. Run CyberDuck.
  1. Click **Open Connection**.
  1. Select the **Amazon S3** connection type.
  1. Specify the connection parameters:
      * **Server**: `storage.yandexcloud.net`.

        To connect to a particular bucket, open the **More options** tab and specify the bucket name in the **Path** field.
      * **Port**: `443`.
      * **Access key ID**: Static key ID [you got previously](#before-you-begin).
      * **Secret Access Key**: Static key contents [you got previously](#before-you-begin).
  1. Click **Connect**.

- macOS {#macos}

  1. Run CyberDuck.
  1. Click **Open Connection**.
  1. Select the **Amazon S3** connection type.
  1. Specify the connection parameters:
      * **Server**: `storage.yandexcloud.net`.

        To connect to a particular bucket, specify `<bucket_name>.storage.yandexcloud.net` in the **Server** field. This method only works with buckets with no dot in their names. For buckets with a dot in their names, follow the [alternative guide](#alternative-connection) below.
      * **Port**: `443`.
      * **Access key ID**: Static key ID [you got previously](#before-you-begin).
      * **Secret Access Key**: Static key contents [you got previously](#before-you-begin).
  1. Click **Connect**.

  To connect to a bucket with a dot in its name, e.g., `example.com`: {#alternative-connection}
  1. Download the [Deprecated path style requests](https://profiles.cyberduck.io/S3%20(Deprecated%20path%20style%20requests).cyberduckprofile) configuration file (for more information, see the [Cyberduck documentation](https://docs.cyberduck.io/protocols/s3/#connecting-using-deprecated-path-style-requests)).
      
      Some browsers automatically open the configuration file in a new tab. To download the configuration file, right-click the download link, select **Download Linked File As...**, and click **Save**.
  1. Open the configuration file.
  1. Specify the connection parameters the same as in the standard method.
  1. Expand the **More options** section and specify the name of your bucket in the **Path** field.
  1. Close the parameter window.
  1. Double-click the new connection to open it.

{% endlist %}


Once the connection is established, the bucket you created earlier will open.

{% note info %}

CyberDuck treats Object Storage as a hierarchical file system. This means that the keys of objects uploaded via CyberDuck will look like file paths, e.g., `prefix/subprefix/picture.jpg`.

{% endnote %}

Learn more about using CyberDuck with S3-compatible storages in the [CyberDuck documentation](https://docs.cyberduck.io/protocols/s3/).