[Yandex Cloud documentation](../../index.md) > [Yandex Object Storage](../index.md) > [Tools](index.md) > FUSE > s3fs

# s3fs

[s3fs](https://github.com/s3fs-fuse/s3fs-fuse) is a utility for Linux and macOS to mount Object Storage buckets via [FUSE](https://en.wikipedia.org/wiki/Filesystem_in_Userspace).

{% note info %}

We recommend using s3fs version 1.84 or higher.

{% endnote %}

If you experience any issues with s3fs, check the [official documentation](https://github.com/s3fs-fuse/s3fs-fuse/wiki) of the project, in particular, the [FAQ](https://github.com/s3fs-fuse/s3fs-fuse/wiki/FAQ).

s3fs performance depends on the speed of your local disk. Use high-speed disks, especially if you store a lot of small files a few hundred kilobytes in size or smaller. You can increase s3fs performance by enabling caching (`--use_cache <directory>` parameter). The s3fs cache grows indefinitely, so you need to clear it at regular intervals. You can read more in the [s3fs documentation](https://github.com/s3fs-fuse/s3fs-fuse/wiki/Fuse-Over-Amazon#details).

## Getting started {#before-you-begin}

1. [Create a service account](../../iam/operations/sa/create.md).
1. [Assign to the service account the roles](../../iam/operations/sa/assign-role-for-sa.md) required for your project, e.g., [storage.editor](../security/index.md#storage-editor) for a bucket (to work with a particular bucket) or a folder (to work with all buckets in this folder). For more information about roles, see [Access management with Yandex Identity and Access Management](../security/index.md).

          
    To work with objects in an [encrypted](../concepts/encryption.md) bucket, a user or [service account](../../iam/concepts/users/service-accounts.md) must have the following [roles for the encryption key](../../kms/operations/key-access.md) in addition to the `storage.configurer` [role](../security/index.md#storage-configurer):
    
    * `kms.keys.encrypter`: To read the key, [encrypt](../../kms/security/index.md#kms-keys-encrypter) and upload objects.
    * `kms.keys.decrypter`: To read the key, [decrypt](../../kms/security/index.md#kms-keys-decrypter) and download objects.
    * `kms.keys.encrypterDecrypter`: This role includes the `kms.keys.encrypter` and `kms.keys.decrypter` [permissions](../../kms/security/index.md#kms-keys-encrypterDecrypter).
    
    For more information, see [Key Management Service service roles](../../kms/security/index.md#service-roles).


1. [Create a static access key](../../iam/operations/authentication/manage-access-keys.md#create-access-key).

    
    As a result, you will get the static access key data. To authenticate in Object Storage, you will need the following:
    
    * `key_id`: Static access key ID
    * `secret`: Secret key
    
    Save `key_id` and `secret`: you will not be able to get the key value again.



To access the HTTP API directly, you need static key authentication, which is supported by the tools listed in [Supported tools](index.md).
  
{% note info %}

You can [disable using static keys for bucket access](../operations/buckets/disable-statickey-auth.md). Once disabled, access will be denied to all tools using this access option: the AWS CLI, SDK, and third-party applications. Access via [ephemeral keys](../security/ephemeral-keys.md), [temporary Security Token Service access keys](../security/sts.md), and [pre-signed URLs](../security/overview.md#pre-signed) will also be disabled. Only access with an [IAM token](../../iam/concepts/authorization/iam-token.md) or [anonymous access](../security/public-access.md) (if enabled) will remain.

{% endnote %}


You can use Yandex Lockbox to safely store the static key for access to Object Storage. For more information, see [Using a Yandex Lockbox secret to store a static access key](../tutorials/static-key-in-lockbox/index.md).

{% note info %}

A service account is only allowed to view a list of buckets in the folder it was created in.

A service account can perform actions with objects in buckets that are created in folders different from the service account folder. To enable this, [assign](../../iam/operations/sa/assign-role-for-sa.md) the service account [roles](../security/index.md#service-roles) for the appropriate folder or its bucket.

{% endnote %}

## Installation {#installation}

{% list tabs group=operating_system %}

- Ubuntu/Debian {#ubuntu}

  1. Make sure the FUSE utilities are installed in the distribution:

     ```bash
     apt list --installed | grep fuse
     ```

     {% note warning %}
     
     Many Linux distributions have the utilities for working with FUSE pre-installed by default. Reinstalling or deleting them may lead to OS failures.
     
     {% endnote %}

  1. If the FUSE utilities are not installed, run this command:

     ```bash
     sudo apt-get install fuse
     ```
  
  1. To install s3fs, follow [this guide](https://github.com/s3fs-fuse/s3fs-fuse#installation) in the project repository.

- CentOS/Fedora/Red Hat {#centos}

  1. Make sure the FUSE utilities are installed in the distribution:

     ```bash
     dnf list installed | grep fuse
     ```

     {% note warning %}
     
     Many Linux distributions have the utilities for working with FUSE pre-installed by default. Reinstalling or deleting them may lead to OS failures.
     
     {% endnote %}

  1. If the FUSE utilities are not installed, run this command:

     ```bash
     sudo dnf install fuse
     ```
  
  1. To install s3fs, follow [this guide](https://github.com/s3fs-fuse/s3fs-fuse#installation) in the project repository.

- macOS {#macos}

  1. Install the [macFUSE](https://osxfuse.github.io/) package.
  1. [Enable](https://github.com/macfuse/macfuse/wiki/Getting-Started#enabling-support-for-third-party-kernel-extensions-apple-silicon-macs) support for third-party core extensions. This step is only required the first time you use MacFUSE on an Apple Silicon Mac.
  1. [Allow](https://github.com/macfuse/macfuse/wiki/Getting-Started#allow-the-macfuse-kernel-extension-to-load-apple-silicon-and-intel-macs) loading the MacFUSE core extension (Apple Silicon and Intel Mac).

      For more information on installing macFUSE, see [this installation guide](https://github.com/osxfuse/osxfuse/wiki/FAQ#2-installuninstall-questions) in the macFUSE GitHub repository.
  
  1. To install s3fs, follow [this guide](https://github.com/s3fs-fuse/s3fs-fuse#installation) in the project repository.

   {% endlist %}

## Setup {#setup}

To configure s3fs, save the [previously obtained](#before-you-begin) key ID and the secret key to the `~/.passwd-s3fs` file in `<key_ID>:<secret_key>` format and restrict access to the `~/.passwd-s3fs` file in the following way:

```bash
echo <key_ID>:<secret_key> > ~/.passwd-s3fs
chmod 600 ~/.passwd-s3fs
```

## Mounting a bucket {#mounting-bucket}

1. Select the folder where you want to mount your bucket and make sure you have permissions for this operation.
1. Run this command:

    ```bash
    s3fs <bucket_name> /mount/<folder_path> -o passwd_file=$HOME/.passwd-s3fs \
        -o url=https://storage.yandexcloud.net -o use_path_request_style
    ```

   To allow other PC users to access the folder, specify the `-o allow_other` option.
   
   To set access permissions to the folder you are going to mount the bucket to, specify the `-o mp_umask=<required_permissions>` option.

You can configure mounting a bucket when starting the system. To do this, open the `/etc/fstab` file and add a line in the following format:

```bash
s3fs#<bucket_name> /mount/<folder_path> fuse _netdev,allow_other,use_path_request_style,url=https://storage.yandexcloud.net,passwd_file=/home/<username>/.passwd-s3fs 0 0
```

For descriptions of all s3fs parameters, see the [project's wiki page](https://github.com/s3fs-fuse/s3fs-fuse/wiki/Fuse-Over-Amazon) on GitHub.