This tutorial explains how to setup a KES Server to use Azure Key Vault as the persistent key store: K E S C l i e n t K E S S e r v e r A z u r e K e y V a u l t Azure Key Vault Azure Key Vault is a managed KMS service that provides a secret store that can be used by KES.

AWS Secrets Manager works as a key-value store for secrets like passwords, access tokens, and cryptographic keys. AWS encrypts these secrets with the AWS Key Management Service (AWS-KMS). This tutorial shows how to set up a KES server that uses AWS Secrets Manager as a persistent key store protected by AWS-KMS: K E S C l i e n t K E S S e r v e r A W S S e c A r W e S t - s K - M M S a n a g e r AWS Secrets Manager Prerequisite You need an AWS access key and AWS secret key pair with sufficient IAM policy permissions to create, retrieve, and delete secrets with AWS Secrets Manager. Create AWS Access/Secret Key Pair.

This section provides documentation on the AIStor Key Encryption Service (KES). AIStor KES is a maintained fork of the MinIO KES project under MinIO’s enterprise license. For new or long-term deployments, consider using AIStor Key Manager to replace KES. Migrate from KES Community Edition to AIStor KES on Linux The following procedure describes how to migrate from the deprecated KES Community Edition (KES CE) to the latest stable AIStor KES release. This procedure assumes an existing KES CE cluster running latest available release.

Description The mc inventory commands allow you to configure and manage inventory jobs on an AIStor deployment. Inventory jobs generate reports of objects in a bucket based on specified filters and schedules. Added in RELEASE.2025-12-20T04-58-37Z mc inventory and its subcommands require AIStor Client RELEASE.2025-12-19T20-11-44Z or later and AIStor Server RELEASE.2025-12-20T04-58-37Z or later. Subcommands mc inventory includes the following subcommands:

mc idp ldap accesskey edit modifies the specified access key on the local server. Syntax Example The following example modifies the secret for the access key mykey on the myaistor deployment:

The mc ilm tier rm command removes an remote tier that has not been used to transition any objects. The mc ilm tier remove command has equivalent functionality to mc ilm tier rm Once a tier has transitioned objects, it cannot be permanently returned to the original tier. To temporarily return objects to the original tier, use mc ilm restore.

The mc license commands work with cluster registration for MinIO SUBNET. Use the commands to register a deployment, display information about the cluster’s current license, or update the license key for a cluster. Subcommands mc license includes the following subcommands: Subcommand Description info Display information about the AIStor deployment’s license status. register Connect your deployment with your MinIO SUBNET account. update Update or renew the license for an AIStor deployment.

The mc idp openid info command outputs the configuration for a specified OIDC provider on a specified AIStor deployment. Optionally validates the configuration with the --check flag. Example and syntax Example The following example outputs the configuration settings defined for the test_config set of OIDC settings on the myaistor deployment and adds the optional --check flag to report whether the configuration is valid.

The mc ilm rule import command imports an object lifecycle management configuration and applies it to an AIStor bucket. The mc ilm rule import command imports from STDIN by default. You can input the contents from a .json file, such as one produced by mc ilm rule export. The following command imports the lifecycle management configuration from mydata-lifecycle-config.json and applies it to the mydata bucket on the myaistor deployment:

The mc legalhold command sets, removes, or retrieves the object legal hold (WORM) settings for object(s). Subcommands mc legalhold includes the following subcommands: Subcommand Description clear Removes the current legal hold setting for an object or objects. info Returns the current legal hold setting for an object or objects. set Enables legal hold Write-Once Read-Many (WORM) object locking on an object or objects.