---
title: "How to set a role condition on a specific bucket"
description: "The Data Platform Identity Access Manager (IAM) allows you to set fine-grained conditions in your Project"
url: https://docs.ovhcloud.com/de/guides/public-cloud/data-platform/tutorials-bucket-role-conditions
lang: de
lastUpdated: 2026-09-14
---
> For AI agents: the complete documentation index is available at https://docs.ovhcloud.com/de/llms.txt, the full documentation bundle is available at https://docs.ovhcloud.com/de/llms-full.txt.

# How to set a role condition on a specific bucket

## Objective

The Data Platform [Identity Access Manager (IAM)](https://docs.ovhcloud.com/de/guides/public-cloud/data-platform/landing-page-iam.md) allows you to set fine-grained conditions in your Project:

- on resources properties
- on users properties
- on data, through Advanced Data Access Control

The purpose of this tutorial is to show how to give users in your Project restricted access to only the [Lakehouse Manager bucket](https://docs.ovhcloud.com/de/guides/public-cloud/data-platform/lakehouse-manager-buckets.md) called _my\_bucket_.

## Requirements

You will need:

- an [IAM role](https://docs.ovhcloud.com/de/guides/public-cloud/data-platform/iam-roles-conditions.md) that grants access to the resource `bucket` (such as the default "DataStore Editor" role)

## Tutorial

To restrict access to specific [buckets in your Lakehouse Manager](https://docs.ovhcloud.com/de/guides/public-cloud/data-platform/lakehouse-manager-buckets.md), you must set a condition on the _**technical name**_ when binding a role granting access to _Data Store buckets_.

:::info
Data Store is the original name of the buckets on Data Platform.
:::

[Bind](https://docs.ovhcloud.com/de/guides/public-cloud/data-platform/iam-roles-conditions.md#bind-a-role-to-a-user-service-account-or-group) such a role to the group/user of your choice.

Then, add a [condition](https://docs.ovhcloud.com/de/guides/public-cloud/data-platform/iam-roles-conditions.md#add-a-condition-when-binding-a-role) to the role binding.

![Tutorial — Add condition](/images/public-cloud/data-platform/getting-further/iam/picts/add-condition.png)
The condition must be set on the _technical name_ of the resource, which intuitively would look like the following:

```text
Name == "my_bucket"
```

However, just adding this condition would filter **the entire role** to the resources called "my\_bucket", including resources that are not buckets (like queries, dashboards, pipelines, etc..). In other words, if your role gives access to any other resource, they will be filtered just like buckets.

Consequently, it is recommended to set conditions as follows.

### Using the visual builder

If your initial role grants access to other resources, it is important to start by adding a first **rule** which will allow access to all resources that are not buckets which are planned by the role.

:::info
Through conditions, you cannot give access to resources/actions that were not initially permitted by the role. Conditions can only filter a role further.
:::

- Field: _Resource_
- Operator: _Not equals_
- Value: _Bucket_

![Using the visual builder — Visual condition1](/images/public-cloud/data-platform/getting-further/iam/picts/visual-condition1.png)
Then, add a **branching** with an _OR_ operator.

![Using the visual builder — Visual condition2](/images/public-cloud/data-platform/getting-further/iam/picts/visual-condition2.png)
In the branching, add two rules linked by an _AND_ operator.

First rule:

- Field: _Resource_
- Operator: _Equals_
- Value: _Bucket_

Second rule:

- Field: _Technical name_
- Operator: _Equals_
- Value: _my\_bucket_

![Using the visual builder — Visual condition3](/images/public-cloud/data-platform/getting-further/iam/picts/visual-condition3.png)
Press **Confirm**. The user/group will now have access only to the bucket "my\_bucket", and access to all other resources contained in the role.

:::info
This branching system can also be used to restrict _write_/_delete_ access to only some objects (for example, the ones that have the tag "dev") while allowing _read_ access to the remaining objects.
:::

### Using the CEL editor

In CEL, the condition would be the following:

```text
Resource != "bucket"
||
(
  Resource == "bucket"
  &&
  Name == "my_bucket"
)
```

![Using the CEL editor — Cel condition1](/images/public-cloud/data-platform/getting-further/iam/picts/cel-condition1.png)
To go further, see the customization capabilities of the Identity Access Manager in our documentation.

[<span aria-hidden="true">↪</span> Learn more about roles and conditions](https://docs.ovhcloud.com/de/guides/public-cloud/data-platform/iam-roles-conditions.md)

Also, don't hesitate to **get in touch** if you need anything, our support & product team is dedicated to helping you deliver faster any AI applications you have in mind.

## Go further

If you need training or technical assistance to implement our solutions, contact your sales representative or click on [this link](https://www.ovhcloud.com/de/professional-services/) to get a quote and ask our Professional Services experts for a custom analysis of your project.

Ask questions, give your feedback and interact directly with the team building the Data Platform on the dedicated [Discord channel](https://discord.gg/ovhcloud).

If you need support with your OVHcloud services, create a request in our [Help Centre](https://help.ovhcloud.com/csm?id=csm_get_help).

Join our [community of users](https://community.ovhcloud.com/).