[Yandex Cloud documentation](../../index.md) > [Yandex Object Storage](../index.md) > [Tools](index.md) > File browsers > WinSCP

# WinSCP

[WinSCP](https://winscp.net/eng/docs/introduction) is a GUI client for Windows that allows you to work with cloud storages, including compatible with the Amazon S3 API.

{% note info %}

To work with Object Storage, use version 5.14 or later.

{% endnote %}

## Getting started {#before-you-begin}

1. [Create a bucket](../operations/buckets/create.md).
1. [Create](../../iam/operations/sa/create.md) a service account.
1. [Assign](../../iam/operations/sa/assign-role-for-sa.md) the required role to the service account, e.g., `storage.editor`. For more information about roles, see [Managing access with Yandex Identity and Access Management](../security/index.md).

       
   To work with objects in an [encrypted](../concepts/encryption.md) bucket, a user or [service account](../../iam/concepts/users/service-accounts.md) must have the following [roles for the encryption key](../../kms/operations/key-access.md) in addition to the `storage.configurer` [role](../security/index.md#storage-configurer):
   
   * `kms.keys.encrypter`: To read the key, [encrypt](../../kms/security/index.md#kms-keys-encrypter) and upload objects.
   * `kms.keys.decrypter`: To read the key, [decrypt](../../kms/security/index.md#kms-keys-decrypter) and download objects.
   * `kms.keys.encrypterDecrypter`: This role includes the `kms.keys.encrypter` and `kms.keys.decrypter` [permissions](../../kms/security/index.md#kms-keys-encrypterDecrypter).
   
   For more information, see [Key Management Service service roles](../../kms/security/index.md#service-roles).


   {% note tip %}

   You can assign a role for a folder or a bucket to a service account. A role for a folder gives the GUI client access to all the buckets in the folder. A role for a bucket gives the client access only to this particular bucket. For granular access, assign a role for a particular bucket.

   {% endnote %}

1. [Create a static access key](../../iam/operations/authentication/manage-access-keys.md#create-access-key).

        
    As a result, you will get the static access key data. To authenticate in Object Storage, you will need the following:
    
    * `key_id`: Static access key ID
    * `secret`: Secret key
    
    Save `key_id` and `secret`: you will not be able to get the key value again.

{% note info %}

A service account is only allowed to view a list of buckets in the folder it was created in.

A service account can perform actions with objects in buckets that are created in folders different from the service account folder. To enable this, [assign](../../iam/operations/sa/assign-role-for-sa.md) the service account [roles](../security/index.md#service-roles) for the appropriate folder or its bucket.

{% endnote %}

## Installation {#installation}

[Download](https://winscp.net/eng/download.php) the WinSCP distribution and run it.

## Connection {#connection}

1. Run WinSCP.
1. In the **Sessions** tab, select **New Session...**.
1. Under **Sessions**, specify the following parameters:
    * **File protocol**: **Amazon S3**.
    * **Host name**: `storage.yandexcloud.net`.
    * **Port number**: `443`.
    * **Access key ID**: [Previously obtained](#before-you-begin) static key ID.
    * **Secret access key**: [Previously obtained](#before-you-begin) static key contents.

   To connect to a particular bucket, click **Advanced...**. In the **Advanced Site Settings** window, select **Directories** in the left-hand menu, under **Environment**. In the **Remote directory:** field, specify the bucket name and click **OK**.
1. Click **Login**.

Once the connection is established, the right-hand panel will show the bucket you previously created.

{% note info %}

WinSCP treats Object Storage as a hierarchical file system. This means that the keys of objects uploaded via WinSCP look like file paths, e.g., `prefix/subprefix/picture.jpg`.

{% endnote %}

To learn more about how to use WinSCP with S3-compatible storage, see the [WinSCP documentation](https://winscp.net/eng/docs/guide_amazon_s3#buckets).