Using R2 with Granted and the AWS CLI

Posted July 14, 2026 with tags #aws #cloudflare

Recently, I’ve been exploring Cloudflare’s R2 service, an S3-compatible object store.

At home and work, I use Granted to manage my AWS credentials and sessions. It’s a convenient wrapper for switching between multiple accounts without polluting my local environment.

Given R2 is meant to be a (largely) drop-in replacement for S3, I thought I’d do a quick writeup on what’s needed to use R2 credentials with the AWS CLI.

To start, I’m assuming Granted is installed and set up with your credential manager of choice. I use pass.

Generate an account API token via the dashboard, copying the provided S3-compatible credentials. If you have existing API tokens for R2, you can derive credentials per the documentation.

Add these credentials into Granted.

granted credentials add cloudflare

Granted should begin populating your ~/.aws/config with the cloudflare profile.

You should update this profile to use an alternate S3 endpoint, providing your account’s dedicated R2 endpoint. It’s best that the region corresponds to your preferred bucket location.

[profile cloudflare]
region             = oc # https://developers.cloudflare.com/r2/reference/data-location/#available-hints
credential_process = granted credential-process --profile=cloudflare
services           = cloudflare

[services cloudflare]
s3 =
  endpoint_url = https://<your-account-id>.r2.cloudflarestorage.com

With your AWS configuration set up, it’s a quick matter to assume and access your R2 buckets. Done!

assume cloudflare
aws s3 ls