diff --git a/weed/shell/command_s3_iam_export.go b/weed/shell/command_s3_iam_export.go
index d72907f6e..b0a1c6d7f 100644
--- a/weed/shell/command_s3_iam_export.go
+++ b/weed/shell/command_s3_iam_export.go
@@ -59,7 +59,7 @@ func (c *commandS3IAMExport) Do(args []string, commandEnv *CommandEnv, writer io
 
 		var out io.Writer = writer
 		if *file != "" {
-			fp, err := os.Create(*file)
+			fp, err := os.OpenFile(*file, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600)
 			if err != nil {
 				return fmt.Errorf("create file: %v", err)
 			}
diff --git a/weed/shell/command_s3_user_provision.go b/weed/shell/command_s3_user_provision.go
index 397c07ed7..040fafa3d 100644
--- a/weed/shell/command_s3_user_provision.go
+++ b/weed/shell/command_s3_user_provision.go
@@ -156,7 +156,11 @@ func (c *commandS3UserProvision) Do(args []string, commandEnv *CommandEnv, write
 		}
 		_, err = client.CreateUser(ctx, &iam_pb.CreateUserRequest{Identity: identity})
 		if err != nil {
-			return fmt.Errorf("create user: %v", err)
+			// Rollback: remove the policy we just created
+			if _, delErr := client.DeletePolicy(ctx, &iam_pb.DeletePolicyRequest{Name: policyName}); delErr != nil {
+				fmt.Fprintf(writer, "Warning: failed to rollback policy %q: %v\n", policyName, delErr)
+			}
+			return fmt.Errorf("create user: %w", err)
 		}
 		fmt.Fprintf(writer, "Created user %q with policy %q attached\n", *name, policyName)