[Yandex Cloud documentation](../../index.md) > [Yandex Object Storage](../index.md) > [Tutorials](index.md) > Connecting a bucket as a disk in Windows

# Connecting a bucket as a disk in Windows

In this tutorial, you will use [rclone](https://rclone.org) to set up data synchronization between an Yandex Object Storage bucket and your local desktop. You will mount the bucket as a disk in Windows.

{% note info %}

This section describes how to connect a bucket in Windows. When connecting with other OSs, see [this rclone guide](https://rclone.org/install/). For [rclone configuring](#rclone-config) and [bucket mounting](#bucket-mount), the steps are identical to those for Windows.

{% endnote %}

To mount your bucket as a disk:

1. [Get your cloud ready](#before-begin).
1. [Set up the runtime environment](#environment-prepare).


1. [Create a service account](#create-sa).
1. [Create a static access key](#create-static-key).


1. [Create a bucket](#bucket-create).
1. [Set up a connection to Object Storage](#rclone-config).
1. [Mount your bucket](#bucket-mount).
1. [Set up automatic mounting](#auto-mount).

If you no longer need the resources you created, [delete them](#clear-out).

## Getting started {#before-begin}

Sign up for Yandex Cloud and create a [billing account](../../billing/concepts/billing-account.md):
1. Navigate to the [management console](https://console.yandex.cloud) and log in to Yandex Cloud or create a new account.
1. On the **[Yandex Cloud Billing](https://center.yandex.cloud/billing/accounts)** page, make sure you have a billing account linked and it has the `ACTIVE` or `TRIAL_ACTIVE` [status](../../billing/concepts/billing-account-statuses.md). If you do not have a billing account, [create one](../../billing/quickstart/index.md) and [link](../../billing/operations/pin-cloud.md) a cloud to it.

If you have an active billing account, you can create or select a [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) for your infrastructure on the [cloud page](https://console.yandex.cloud/cloud).

[Learn more about clouds and folders here](../../resource-manager/concepts/resources-hierarchy.md).


### Required paid resources {#paid-resources}

The cost for bucket support includes:

* Fee for storing data in a bucket (see [Object Storage pricing](../pricing.md#prices-storage)).
* Fee for data operations (see [Object Storage pricing](../pricing.md#prices-operations)).


## Set up the runtime environment {#environment-prepare}

1. Download and install the [winfsp distribution](https://winfsp.dev/rel/) from the `winfsp` website.
1. Download the [sysinternals suite utilities archive](https://docs.microsoft.com/en-us/sysinternals/downloads/) from the Microsoft website and unpack it to your local working folder.
1. Download the [Windows Service Wrapper (WinSW) executable](https://github.com/winsw/winsw/releases) depending on your OS configuration and save it to a dedicated folder.
1. Download the [rclone utility archive](https://rclone.org/downloads/) from the `rclone` website and unpack it to your local working folder.
1. Add the folders containing the utilities and the distribution to the `PATH` variable. Proceed as follows:

    1. Click **Start** and type **Change system environment variables** in the Windows search bar.
    1. Click **Environment Variables...** at the bottom right.
    1. In the window that opens, find the `PATH` parameter and click **Edit**.
    1. Add your folder path to the list.
    1. Click **OK**.


## Create a service account {#create-sa}

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the folder where you want to create a service account.
  1. Navigate to **Identity and Access Management**.
  1. Click **Create service account**.
  1. In the **Name** field, specify `sa-win-disk-connect`.
  1. Click ![](../../_assets/console-icons/plus.svg) **Add role** and select the `storage.editor` role.
  1. Click **Create service account**.

- YC CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. Create a service account named `sa-win-disk-connect`:

      ```bash
      yc iam service-account create --name sa-win-disk-connect
      ```

      The naming requirements are as follows:

      * Length: between 3 and 63 characters.
      * It can only contain lowercase Latin letters, numbers, and hyphens.
      * It must start with a letter and cannot end with a hyphen.

      For more information about the `yc iam service-account create` command, see the [CLI reference](../../cli/cli-ref/iam/cli-ref/service-account/create.md).

  1. Assign the `storage.editor` role to the service account:

      ```bash
      yc resource-manager folder add-access-binding <folder_ID> \
        --role storage.editor \
        --subject serviceAccount:<service_account_ID>
      ```
  
      For more information about the `yc resource-manager folder add-access-binding` command, see the [CLI reference](../../cli/cli-ref/resource-manager/cli-ref/folder/add-access-binding.md).

- API {#api}

  1. To create a service account, use the [create](../../iam/api-ref/ServiceAccount/create.md) method for the [ServiceAccount](../../iam/api-ref/ServiceAccount/index.md) resource.

  1. [Assign](../../organization/operations/add-role.md) the `storage.editor` role to the service account.
  
{% endlist %}

To work with objects in an [encrypted](../concepts/encryption.md) bucket, a user or [service account](../../iam/concepts/users/service-accounts.md) must have the following [roles for the encryption key](../../kms/operations/key-access.md) in addition to the `storage.configurer` [role](../security/index.md#storage-configurer):

* `kms.keys.encrypter`: To read the key, [encrypt](../../kms/security/index.md#kms-keys-encrypter) and upload objects.
* `kms.keys.decrypter`: To read the key, [decrypt](../../kms/security/index.md#kms-keys-decrypter) and download objects.
* `kms.keys.encrypterDecrypter`: This role includes the `kms.keys.encrypter` and `kms.keys.decrypter` [permissions](../../kms/security/index.md#kms-keys-encrypterDecrypter).

For more information, see [Key Management Service service roles](../../kms/security/index.md#service-roles).

## Create a static access key {#create-static-key}

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), navigate to the folder the service account belongs to.
  1. Navigate to **Identity and Access Management**.
  1. In the left-hand panel, select ![FaceRobot](../../_assets/console-icons/face-robot.svg) **Service accounts**.
  1. In the list that opens, select `sa-win-disk-connect`.
  1. In the top panel, click ![](../../_assets/console-icons/plus.svg) **Create new key**.
  1. Select **Create static access key**.
  1. Enter a description for the key and click **Create**.
  1. Save the ID and secret key. After you close this dialog, the key value will no longer be available.

- YC CLI {#cli}

  1. Create an access key for the `sa-win-disk-connect` service account:

     ```bash
     yc iam access-key create --service-account-name sa-win-disk-connect
     ```

     Result:

     ```
     access_key:
       id: aje6t3vsbj8l********
       service_account_id: ajepg0mjt06s********
       created_at: "2022-07-18T14:37:51Z"
       key_id: 0n8X6WY6S24N7Oj*****
     secret: JyTRFdqw8t1kh2-OJNz4JX5ZTz9Dj1rI9hx*****
     ```

     For more information about the `yc iam access-key create` command, see the [CLI reference](../../cli/cli-ref/iam/cli-ref/access-key/create.md).

  1. Save the ID (`key_id`) and secret key (`secret`). You will not be able to get the secret key again.

- API {#api}

  To create an access key, use the [create](../../iam/awscompatibility/api-ref/AccessKey/create.md) method for the [AccessKey](../../iam/awscompatibility/api-ref/AccessKey/index.md) resource.

{% endlist %}

As a result, you will get the static access key data. To authenticate in Object Storage, you will need the following:

* `key_id`: Static access key ID
* `secret`: Secret key

Save `key_id` and `secret`: you will not be able to get the key value again.


## Create a bucket {#bucket-create}

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the folder where you want to create a bucket.
  1. Navigate to **Object Storage**.
  1. At the top right, click **Create bucket**.
  1. In the ** Name** field, enter a name for the bucket consistent with the [naming conventions](../concepts/bucket.md#naming).
  1. In the **Read objects**, **Read object list**, and **Read settings** fields, select **With authorization**.
  1. Click **Create bucket**.
 
- AWS CLI {#aws-cli}
  
  1. If you do not have the AWS CLI yet, [install and configure it](../tools/aws-cli.md).
  1. Create a bucket by entering its name consistent with the [naming conventions](../concepts/bucket.md#naming):
  
     ```bash
     aws --endpoint-url https://storage.yandexcloud.net \
       s3 mb s3://<bucket_name>
     ```

     Result:
     
     ```text
     make_bucket: <bucket_name>
     ```


- Terraform {#tf}

  {% note info %}
  
  If you access Object Storage via Terraform under a [service account](../../iam/concepts/users/service-accounts.md), [assign](../../iam/operations/sa/assign-role-for-sa.md) to the service account the relevant [role](../security/index.md#roles-list), e.g., `storage.admin`, for the folder you are going to create the resources in.
  
  {% endnote %}

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../terraform/authentication.md) using the appropriate method.

  1. Describe the properties for creating a service account and access key in the configuration file:

     ```hcl
     ...
     // Creating a service account
     resource "yandex_iam_service_account" "sa" {
       name = "<service_account_name>"
     }
     
     // Assigning a role to a service account
     resource "yandex_resourcemanager_folder_iam_member" "sa-admin" {
       folder_id = "<folder_ID>"
       role      = "storage.admin"
       member    = "serviceAccount:${yandex_iam_service_account.sa.id}"
     }
     
     // Creating a static access key
     resource "yandex_iam_service_account_static_access_key" "sa-static-key" {
       service_account_id = yandex_iam_service_account.sa.id
       description        = "static access key for object storage"
     }
     ```

  1. Add a section with bucket properties to the configuration file and enter the bucket name following the [naming requirements](../concepts/bucket.md#naming):
  
     ```hcl
     resource "yandex_storage_bucket" "<bucket_name>" {
       access_key = yandex_iam_service_account_static_access_key.sa-static-key.access_key
       secret_key = yandex_iam_service_account_static_access_key.sa-static-key.secret_key
       bucket     = "<bucket_name>"
     }
     ```
     
     For more information about the `yandex_storage_bucket` resource, see [this Terraform provider guide](../../terraform/resources/storage_bucket.md).
     
  1. Make sure the configuration files are correct.

     1. In the terminal, navigate to the directory where you created your configuration file.
     1. Run a check using this command:

        ```bash
        terraform plan
        ```

     If the configuration is correct, the terminal will display a list of the resources and their settings. Otherwise, Terraform will show any detected errors. 

  1. Deploy the cloud resources.
  
     1. If the configuration is correct, run this command:

        ```bash
        terraform apply
        ```

     1. To confirm resource creation, type `yes` and press **Enter**.


- API {#api}

  Use the [create](../api-ref/Bucket/create.md) REST API method for the [Bucket](../api-ref/Bucket/index.md) resource, the [BucketService/Create](../api-ref/grpc/Bucket/create.md) gRPC API call, or the [create](../s3/api-ref/bucket/create.md) S3 API method.

{% endlist %}

## Set up a connection to Object Storage {#rclone-config}

1. Launch the PowerShell command line, navigate to the folder with the `rclone` utility and run its configuration session:

   ```powershell
   ./rclone.exe config
   ```

1. Follow the prompts to create a new connection profile:

   1. Start creating a new profile by entering `n` in the terminal.
   1. Enter the connection name: `s3-connect`.
   1. Select the storage type by entering `4` in the terminal.
   1. Select the provider by entering `1` in the terminal.
   1. Select manual entry of credentials by typing `1` in the terminal.

   
   1. In the terminal, enter the secret key ID you [got previously](#create-static-key).
   1. In the terminal, enter the secret key value you [got previously](#create-static-key).


   1. Specify the region by entering `ru-central1` in the terminal.
   1. Specify the endpoint by entering `storage.yandexcloud.net` in the terminal.
   1. You can leave all other settings at their defaults by pressing **Enter** to skip them.

{% note info %}

You can perform advanced connection setup if required. To do this, type `y` at the `Edit advanced config?` step. For more information about advanced settings, see the `rclone` [documentation](https://rclone.org/s3/).

{% endnote %}

## Mount a bucket {#bucket-mount}

1. Check your connection to the bucket. In the same command line window you used to configure the connection, run the following command with the bucket name specified:

   ```powershell
   ./rclone.exe ls s3-connect:<bucket_name>
   ```

   If your configuration is correct, you will see a list of objects in the bucket.

1. Mount your bucket to the file system specifying the bucket name and an available drive letter in the file system:

   ```powershell
   ./rclone.exe mount s3-connect:<bucket_name> <disk_letter>: --vfs-cache-mode full --file-perms 0777 --dir-perms 0777
   ```

   You will see a new disk with the objects from the bucket in Windows Explorer.

1. To unmount the bucket, press **Ctrl** + **C**.

## Set up automatic mounting {#auto-mount}

For the bucket to mount automatically when the user logs in, create a [VBScript](https://en.wikipedia.org/wiki/VBScript) launch script and add it to the system registry. 

1. In the working folder on your local PC, create a file named `bucket_mount.vbs` and paste the following code into it:

    ```text
    Set WshShell = CreateObject("WScript.Shell")
    command = "<path_to_rclone_folder>\rclone.exe mount s3-connect:<bucket_name> <drive_letter>: --vfs-cache-mode full --file-perms 0777 --dir-perms 0777"
    WshShell.Run command, 0, False
    ```

    In the file, specify the bucket name, drive letter, and full path to `rclone.exe`. For example: `C:\bucket-mounter\rclone\rclone.exe`.

1. Open your system registry editor, `regedit.exe`, and proceed as follows in the window that opens:

    1. Go to the `HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run` branch and create a string parameter named `bucket-mounter` in it.
    1. Change the `bucket-mounter` parameter value to full path to the VBS script file created earlier. For example: `C:\bucket-mounter\bucket_mount.vbs`

From now on, your bucket will automatically mount into the OS each time the user logs on to the PC.

## How to delete the resources you created {#clear-out}

To stop paying for the resources you created:

* [Delete the objects](../operations/objects/delete-all.md) from the bucket.
* [Delete the bucket](../operations/buckets/delete.md).